fix: harden scaffold after review — manifest drift check, vet-safe logging, panic-path header guard

manifest_test.go

@@ -1,6 +1,7 @@
 package traefikllmgateway
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"net/http"
@@ -10,10 +11,13 @@ import (
 	"testing"
 )
 
-// yamlToJSONLite converts the small, known-shape testData block of
-// .traefik.yml to JSON via a scripted extraction — we cannot import a YAML
-// lib. Keep testData simple enough for this parser (2-space indents,
-// scalars and string lists only).
+// testDataConfig decodes a hand-maintained JSON mirror of the .traefik.yml
+// testData block — we cannot import a YAML library (stdlib only). The
+// mirror is drift-checked against the raw manifest by the assertions below:
+// every top-level key and scalar value the mirror encodes must also appear
+// in .traefik.yml's raw bytes, so an edit to either side that removes or
+// renames a testData field fails this test instead of silently going
+// stale.
 func testDataConfig(t *testing.T) *Config {
 	t.Helper()
 	raw, err := os.ReadFile(".traefik.yml")
@@ -23,6 +27,26 @@ func testDataConfig(t *testing.T) *Config {
 	if !regexp.MustCompile(`(?m)^testData:`).Match(raw) {
 		t.Fatal(".traefik.yml missing testData")
 	}
+
+	// Drift check: every top-level key and scalar value referenced by the
+	// mirror blob below must appear in the raw manifest bytes.
+	mirrorTokens := []string{
+		"providers", "groups", "users", // top-level testData keys
+		"openai", "type: openai", "test-key", "gpt-test", // providers.openai
+		"default",       // groups.default and users.inline[0].group
+		"tester",        // users.inline[0].name
+		"test-user-key", // users.inline[0].apiKey
+	}
+	var missing []string
+	for _, tok := range mirrorTokens {
+		if !bytes.Contains(raw, []byte(tok)) {
+			missing = append(missing, tok)
+		}
+	}
+	if len(missing) > 0 {
+		t.Fatalf("manifest drift: mirror blob references %v not found in .traefik.yml — update the mirror or the manifest so they match", missing)
+	}
+
 	cfg := CreateConfig()
 	// mirror of testData, kept in sync by this test living next to the manifest
 	blob := `{"providers":{"openai":{"type":"openai","apiKey":"test-key","models":["gpt-test"]}},