test(diff,api,parser): cover the profile-diff branches codecov flagged

- plist parse failures from both the token loop and element decoding, plus a
  root-level scalar with no container to name it
- every inconclusive path in profileContentChange: no enricher, unreadable
  local file, failed download, and unparseable content on either side
- GetProfileContent transport failures: unbuildable request, dead connection,
  and a truncated body, which must error rather than return half a profile
- readProfileContent for a missing file and an unreadable path
- WithProfileEnricher

Patch coverage for this branch is now 100%.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEpzMNJnGaBLAfrPeqknCy

Author: robbiet480

internal/api/client_test.go

@@ -1124,3 +1124,49 @@ func TestEnrichProfileContents(t *testing.T) {
 		t.Errorf("uuid-less profile: got content %q, want empty", profiles[2].Content)
 	}
 }
+
+func TestGetProfileContentTransportErrors(t *testing.T) {
+	t.Run("unbuildable request URL", func(t *testing.T) {
+		// A control character in the base URL cannot be turned into a request.
+		c := &Client{baseURL: "https://example.com/\x7f", token: "tok", httpClient: &http.Client{}}
+		if _, err := c.GetProfileContent(context.Background(), "u"); err == nil {
+			t.Error("expected an error building the request")
+		}
+	})
+
+	t.Run("connection failure", func(t *testing.T) {
+		ts := httptest.NewServer(http.NotFoundHandler())
+		url := ts.URL
+		ts.Close() // nothing is listening any more
+
+		t.Setenv("FLEET_PLAN_INSECURE", "1")
+		c, err := NewClient(url, "tok")
+		if err != nil {
+			t.Fatalf("NewClient: %v", err)
+		}
+		if _, err := c.GetProfileContent(context.Background(), "u"); err == nil {
+			t.Error("expected a transport error")
+		}
+	})
+
+	t.Run("truncated response body", func(t *testing.T) {
+		// Hijack the connection so the headers promise 512 bytes, then hang up
+		// after 7. The client must fail while reading rather than hand back a
+		// half profile that would diff as a pile of removed keys.
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			conn, buf, err := http.NewResponseController(w).Hijack()
+			if err != nil {
+				t.Errorf("hijack: %v", err)
+				return
+			}
+			defer func() { _ = conn.Close() }()
+			_, _ = buf.WriteString("HTTP/1.1 200 OK\r\nContent-Length: 512\r\n\r\n<plist>")
+			_ = buf.Flush()
+		}))
+		defer ts.Close()
+
+		if _, err := testClient(t, ts, "tok").GetProfileContent(context.Background(), "u"); err == nil {
+			t.Error("expected an error reading the truncated body")
+		}
+	})
+}

internal/diff/differ_test.go

@@ -2508,3 +2508,66 @@ func TestDiffProfilesWithoutEnricher(t *testing.T) {
 		t.Errorf("path field: got %q", got)
 	}
 }
+
+func TestWithProfileEnricher(t *testing.T) {
+	var o diffOptions
+	enricher := &fakeProfileEnricher{}
+	WithProfileEnricher(enricher)(&o)
+	if o.profileEnricher != enricher {
+		t.Error("WithProfileEnricher did not set the enricher")
+	}
+}
+
+func TestProfileContentChangeInconclusive(t *testing.T) {
+	const validPlist = `<plist version="1.0"><dict><key>A</key><string>1</string></dict></plist>`
+
+	tests := []struct {
+		name     string
+		cur      api.Profile
+		proposed parser.ParsedProfile
+		enricher ProfileEnricher
+	}{
+		{
+			name:     "no enricher configured",
+			cur:      api.Profile{ProfileUUID: "u"},
+			proposed: parser.ParsedProfile{Content: validPlist},
+		},
+		{
+			name:     "local file could not be read",
+			cur:      api.Profile{ProfileUUID: "u"},
+			proposed: parser.ParsedProfile{Content: ""},
+			enricher: &fakeProfileEnricher{content: map[string]string{"u": validPlist}},
+		},
+		{
+			// The download failed, so Content stays empty.
+			name:     "stored content unavailable",
+			cur:      api.Profile{ProfileUUID: "u"},
+			proposed: parser.ParsedProfile{Content: validPlist},
+			enricher: &fakeProfileEnricher{content: map[string]string{}},
+		},
+		{
+			name:     "stored content is not parseable",
+			cur:      api.Profile{ProfileUUID: "u"},
+			proposed: parser.ParsedProfile{Content: validPlist},
+			enricher: &fakeProfileEnricher{content: map[string]string{"u": "not a profile"}},
+		},
+		{
+			name:     "local content is not parseable",
+			cur:      api.Profile{ProfileUUID: "u"},
+			proposed: parser.ParsedProfile{Content: "not a profile"},
+			enricher: &fakeProfileEnricher{content: map[string]string{"u": validPlist}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			change, conclusive := profileContentChange(tt.cur, tt.proposed, tt.enricher)
+			if conclusive {
+				t.Errorf("conclusive: got true, want false (change=%+v)", change)
+			}
+			if change != nil {
+				t.Errorf("change: got %+v, want nil", change)
+			}
+		})
+	}
+}

internal/diff/profilekeys_test.go

@@ -211,3 +211,39 @@ func TestProfileDiffSummaryNeverIncludesValues(t *testing.T) {
 		t.Errorf("summary: got %q", summary)
 	}
 }
+
+func TestPlistKeysMalformed(t *testing.T) {
+	// Each of these must return an error so diffProfiles falls back to
+	// name-only matching instead of reporting nonsense keys.
+	tests := []struct {
+		name    string
+		content string
+	}{
+		{"truncated document", `<plist><dict><key>a</key><string>b`},
+		{"truncated inside a key", `<plist><dict><key>abc`},
+		{"truncated inside a value", `<plist><dict><key>a</key><string>abc`},
+		{"stray angle bracket in a value", `<plist><dict><key>a</key><string><</string></dict></plist>`},
+		// Malformed markup outside any element the walker decodes directly,
+		// so the failure surfaces from the token loop rather than a decode.
+		{"stray angle bracket in an array", `<plist><dict><key>a</key><array><</array></dict></plist>`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if _, err := plistKeys([]byte(tt.content)); err == nil {
+				t.Error("expected an error")
+			}
+		})
+	}
+}
+
+func TestPlistKeysValueOutsideContainer(t *testing.T) {
+	// A plist whose root is a bare scalar rather than a dict: there is no
+	// container to name the value, so it lands under the empty path.
+	keys, err := plistKeys([]byte(`<plist version="1.0"><string>bare</string></plist>`))
+	if err != nil {
+		t.Fatalf("plistKeys: %v", err)
+	}
+	if keys[""] != "bare" {
+		t.Errorf("got %v, want the value under the empty path", keys)
+	}
+}

internal/parser/parser_test.go

@@ -1110,3 +1110,32 @@ func TestIsNoTeam(t *testing.T) {
 		})
 	}
 }
+
+func TestReadProfileContent(t *testing.T) {
+	dir := t.TempDir()
+
+	good := filepath.Join(dir, "profile.mobileconfig")
+	if err := os.WriteFile(good, []byte("<plist/>"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name string
+		path string
+		want string
+	}{
+		{name: "readable file", path: good, want: "<plist/>"},
+		{name: "missing file", path: filepath.Join(dir, "nope.mobileconfig")},
+		// A directory stats fine but cannot be read; content diffing then
+		// falls back to name-only matching rather than failing the parse.
+		{name: "path is a directory", path: dir},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := readProfileContent(tt.path); got != tt.want {
+				t.Errorf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}