work work ... haaaard work

src/SbomService/StellaOps.SbomService.Tests/EntrypointEndpointsTests.cs

@@ -0,0 +1,61 @@
+using System.Net;
+using System.Net.Http.Json;
+using StellaOps.SbomService.Models;
+
+namespace StellaOps.SbomService.Tests;
+
+public class EntrypointEndpointsTests : IClassFixture<SbomServiceWebApplicationFactory>
+{
+    private readonly SbomServiceWebApplicationFactory _factory;
+
+    public EntrypointEndpointsTests(SbomServiceWebApplicationFactory factory)
+    {
+        _factory = factory;
+    }
+
+    [Fact]
+    public async Task Get_entrypoints_requires_tenant()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.GetAsync("/entrypoints");
+        response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
+    }
+
+    [Fact]
+    public async Task Get_entrypoints_returns_seeded_list()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.GetAsync("/entrypoints?tenant=tenant-a");
+        response.EnsureSuccessStatusCode();
+
+        var payload = await response.Content.ReadFromJsonAsync<EntrypointListResponse>();
+        payload.Should().NotBeNull();
+        payload!.Tenant.Should().Be("tenant-a");
+        payload.Items.Should().NotBeEmpty();
+        payload.Items.Select(e => e.Artifact).Should().Contain("ghcr.io/stellaops/sample-api");
+    }
+
+    [Fact]
+    public async Task Post_entrypoints_upserts_and_returns_ordered_list()
+    {
+        var client = _factory.CreateClient();
+
+        var upsert = new EntrypointUpsertRequest(
+            Tenant: "tenant-a",
+            Artifact: "ghcr.io/stellaops/sample-api",
+            Service: "web",
+            Path: "/api/v2",
+            Scope: "runtime",
+            RuntimeFlag: true);
+
+        var post = await client.PostAsJsonAsync("/entrypoints", upsert);
+        post.EnsureSuccessStatusCode();
+
+        var payload = await post.Content.ReadFromJsonAsync<EntrypointListResponse>();
+        payload.Should().NotBeNull();
+        payload!.Items.First(e => e.Service == "web").Path.Should().Be("/api/v2");
+        payload.Items.Should().BeInAscendingOrder(e => e.Artifact);
+    }
+}

src/SbomService/StellaOps.SbomService.Tests/ProjectionEndpointTests.cs

@@ -3,6 +3,7 @@ using System.Net.Http.Json;
 using System.Reflection;
 using FluentAssertions;
 using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;

src/SbomService/StellaOps.SbomService.Tests/SbomEndpointsTests.cs

@@ -23,7 +23,8 @@ public class SbomEndpointsTests : IClassFixture<WebApplicationFactory<Program>>
 
         var response = await client.GetAsync("/sbom/paths");
 
-        response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
+        var body = await response.Content.ReadAsStringAsync();
+        response.StatusCode.Should().Be(HttpStatusCode.BadRequest, body);
     }
 
     [Fact]
@@ -47,7 +48,7 @@ public class SbomEndpointsTests : IClassFixture<WebApplicationFactory<Program>>
         var client = _factory.CreateClient();
 
         var response = await client.GetAsync("/sbom/versions?artifact=ghcr.io/stellaops/sample-api");
-        response.EnsureSuccessStatusCode();
+        response.StatusCode.Should().Be(HttpStatusCode.OK, await response.Content.ReadAsStringAsync());
 
         var payload = await response.Content.ReadFromJsonAsync<SbomTimelineResult>();
         payload.Should().NotBeNull();

src/SbomService/StellaOps.SbomService.Tests/SbomEventEndpointsTests.cs

@@ -31,9 +31,10 @@ public class SbomEventEndpointsTests : IClassFixture<WebApplicationFactory<Progr
 
         var events = await client.GetFromJsonAsync<List<SbomVersionCreatedEvent>>("/internal/sbom/events");
         events.Should().NotBeNull();
-        events!.Should().HaveCount(1);
-        events[0].SnapshotId.Should().Be("snap-001");
-        events[0].TenantId.Should().Be("tenant-a");
+        var nonNullEvents = events!;
+        nonNullEvents.Should().HaveCount(1);
+        nonNullEvents[0].SnapshotId.Should().Be("snap-001");
+        nonNullEvents[0].TenantId.Should().Be("tenant-a");
 
         // Requesting the projection should not duplicate events.
         var projectionResponse = await client.GetAsync("/sboms/snap-001/projection?tenant=tenant-a");