# TASK 3.1: Add regression coverage for admin contract, secret preservation, and facade header emission

## Summary

Add regression tests proving the new `customHeaders` behavior works through the admin API, encrypted storage, runtime binding, and Brink request construction path.

This task closes the slice by validating both the secret-handling contract and the runtime header propagation behavior.

## Dependencies

- [TASK 2.1](./TASK2.1.md)
- [TASK 2.2](./TASK2.2.md)

## Files to Modify

### API tests

- `backend/tests/Kds.Ai.ApiService.Tests/Kds.Ai.ApiService.Tests/Endpoints/AdminCustomerEndpointsTests.cs`
- `backend/tests/Kds.Ai.ApiService.Tests/Kds.Ai.ApiService.Tests/Endpoints/AdminCustomerOnboardingFlowTests.cs`
- `backend/tests/Kds.Ai.ApiService.Tests/Kds.Ai.ApiService.Tests/Endpoints/BrinkPosManualEtlEndpointTests.cs` if stored payload helpers need updating
- `backend/tests/Kds.Ai.ApiService.Tests/Kds.Ai.ApiService.Tests/Services/CustomerEtlProvisioningServiceTests.cs` if payload reads need explicit regression coverage

### Integration tests

- `backend/tests/Kds.Ai.Integrations.Tests/BrinkPos/RepositoryBackedBrinkConnectionBindingServiceTests.cs`
- add or extend Brink transport/facade tests in the relevant Brink test project if one already covers request construction

### Live/manual tests to keep compatible

- `backend/tests/Kds.Ai.Integrations.Tests/BrinkPos/BrinkPosDownstreamLiveTests.cs`
- `backend/tests/Kds.Ai.Integrations.Tests/BrinkPos/BrinkPosExtractRawLiveTests.cs`

## Required Coverage

### Admin API

- create customer with `customHeaders` persists encrypted payload correctly,
- get/list customer redacts custom header values,
- update customer preserves existing custom header values when `[REDACTED]` is sent,
- update customer can add, replace, and remove headers,
- invalid header names or reserved headers are rejected with a clear validation error.

### Runtime binding

- repository-backed binding returns custom headers from stored credentials,
- legacy fallback path still works unchanged when DB credentials are absent.

### Brink transport

- request construction includes all configured custom headers,
- current `AccessToken` and `LocationToken` behavior still works,
- reserved transport headers cannot be overridden by custom headers.

### Compatibility

- existing tests or seed helpers that construct `BrinkPosCredentialPayload` compile after the payload shape change,
- stored payloads without custom headers still behave correctly.

## Verification Commands

- `dotnet test C:\Repos\euvic\KDSAI\backend\tests\Kds.Ai.ApiService.Tests\Kds.Ai.ApiService.Tests\Kds.Ai.ApiService.Tests.csproj`
- `dotnet test C:\Repos\euvic\KDSAI\backend\tests\Kds.Ai.Integrations.Tests\Kds.Ai.Integrations.Tests.csproj`
- `dotnet build C:\Repos\euvic\KDSAI\Kds.Ai.slnx -p:TreatWarningsAsErrors=true`

Run live tests as well if the implementation touches live-covered Brink credential wiring and the required environment is available.

## Acceptance Criteria

- [ ] API tests cover create, read, update, redaction, and validation behavior for `customHeaders`
- [ ] Integration tests cover runtime binding and request header emission
- [ ] Existing seed/helper code is updated for the new payload shape
- [ ] Required test projects pass
- [ ] Final solution build passes with warnings treated as errors

## Notes

- Prefer extending existing tests and helpers over creating many new fixtures.
- The most important regressions to prevent are secret leakage and missing downstream headers.