fixup! fixup! ... and another all nighter.

internal/cache/backends/config_test.go

@@ -0,0 +1,59 @@
+//go:build !yaegi
+
+package backends
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDefaultHybridConfig verifies the default hybrid configuration
+func TestDefaultHybridConfig(t *testing.T) {
+	redisAddr := "localhost:6379"
+
+	config := DefaultHybridConfig(redisAddr)
+
+	require.NotNil(t, config)
+
+	// Verify top-level config
+	assert.Equal(t, BackendTypeHybrid, config.Type)
+	assert.True(t, config.AsyncWrites)
+	assert.True(t, config.EnableMetrics)
+
+	// Verify L1 (memory) config
+	require.NotNil(t, config.L1Config)
+	assert.Equal(t, BackendTypeMemory, config.L1Config.Type)
+	assert.Equal(t, 500, config.L1Config.MaxSize)
+	assert.Equal(t, int64(10*1024*1024), config.L1Config.MaxMemoryBytes) // 10MB
+	assert.Equal(t, 1*time.Minute, config.L1Config.CleanupInterval)
+
+	// Verify L2 (Redis) config exists
+	require.NotNil(t, config.L2Config)
+	assert.Equal(t, BackendTypeRedis, config.L2Config.Type)
+}
+
+func TestDefaultHybridConfig_DifferentRedisAddr(t *testing.T) {
+	tests := []struct {
+		name      string
+		redisAddr string
+	}{
+		{"localhost", "localhost:6379"},
+		{"remote host", "redis.example.com:6379"},
+		{"IP address", "192.168.1.100:6379"},
+		{"custom port", "localhost:6380"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := DefaultHybridConfig(tt.redisAddr)
+
+			require.NotNil(t, config)
+			assert.Equal(t, BackendTypeHybrid, config.Type)
+			assert.NotNil(t, config.L1Config)
+			assert.NotNil(t, config.L2Config)
+		})
+	}
+}

internal/cache/backends/interface_test.go

@@ -250,6 +250,10 @@ func testClear(t *testing.T, ctx context.Context, backend CacheBackend) {
 		require.NoError(t, err)
 	}
 
+	// Give async writes time to complete before clearing
+	// This prevents race conditions with async write workers
+	time.Sleep(50 * time.Millisecond)
+
 	// Clear all
 	err := backend.Clear(ctx)
 	require.NoError(t, err)
@@ -395,8 +399,23 @@ func setupRedisBackend(t *testing.T) CacheBackend {
 
 func setupHybridBackend(t *testing.T) CacheBackend {
 	t.Helper()
-	// This will be implemented in hybrid_test.go
-	// For now, return nil to allow compilation
-	t.Skip("HybridBackend implementation pending")
-	return nil
+
+	primary := newMockBackend()
+	secondary := newMockBackend()
+
+	config := &HybridConfig{
+		Primary:         primary,
+		Secondary:       secondary,
+		AsyncBufferSize: 100,
+		Logger:          NewTestLogger(t),
+	}
+
+	hybrid, err := NewHybridBackend(config)
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		hybrid.Close()
+	})
+
+	return hybrid
 }

internal/cache/backends/memory_test.go

@@ -499,3 +499,285 @@ func TestMemoryBackend_ValueIsolation(t *testing.T) {
 	assert.True(t, exists)
 	assert.Equal(t, originalValue, retrieved2, "Original value should not be modified")
 }
+
+// TestMemoryBackend_Keys tests the Keys method with pattern matching
+func TestMemoryBackend_Keys(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Add test data
+	testKeys := []string{"user:1", "user:2", "session:abc", "session:def", "token:xyz"}
+	for _, key := range testKeys {
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	t.Run("AllKeys", func(t *testing.T) {
+		keys, err := backend.Keys(ctx, "*")
+		require.NoError(t, err)
+		assert.Len(t, keys, 5)
+	})
+
+	t.Run("SpecificPattern", func(t *testing.T) {
+		// Simple exact match
+		keys, err := backend.Keys(ctx, "user:1")
+		require.NoError(t, err)
+		assert.Len(t, keys, 1)
+		assert.Contains(t, keys, "user:1")
+	})
+
+	t.Run("ExcludesExpired", func(t *testing.T) {
+		// Add an expired key
+		expiredKey := "expired:key"
+		err := backend.Set(ctx, expiredKey, []byte("value"), 1*time.Millisecond)
+		require.NoError(t, err)
+
+		// Wait for expiration
+		time.Sleep(10 * time.Millisecond)
+
+		keys, err := backend.Keys(ctx, "*")
+		require.NoError(t, err)
+		assert.NotContains(t, keys, expiredKey, "Expired keys should not be returned")
+	})
+
+	t.Run("AfterClose", func(t *testing.T) {
+		closedBackend, _ := NewMemoryBackend(DefaultConfig())
+		closedBackend.Close()
+
+		_, err := closedBackend.Keys(ctx, "*")
+		assert.Error(t, err)
+		assert.Equal(t, ErrBackendUnavailable, err)
+	})
+}
+
+// TestMemoryBackend_Size tests the Size method
+func TestMemoryBackend_Size(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	// Initially empty
+	size, err := backend.Size(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, int64(0), size)
+
+	// Add items
+	for i := 0; i < 5; i++ {
+		key := fmt.Sprintf("key-%d", i)
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+	}
+
+	size, err = backend.Size(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, int64(5), size)
+
+	// Delete one
+	backend.Delete(ctx, "key-0")
+
+	size, err = backend.Size(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, int64(4), size)
+
+	// After close
+	backend.Close()
+	_, err = backend.Size(ctx)
+	assert.Error(t, err)
+	assert.Equal(t, ErrBackendUnavailable, err)
+}
+
+// TestMemoryBackend_TTL tests the TTL method
+func TestMemoryBackend_TTL(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("ExistingKey", func(t *testing.T) {
+		key := "ttl-key"
+		ttl := 1 * time.Minute
+
+		err := backend.Set(ctx, key, []byte("value"), ttl)
+		require.NoError(t, err)
+
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		assert.Greater(t, remaining, 50*time.Second)
+		assert.LessOrEqual(t, remaining, ttl)
+	})
+
+	t.Run("NonExistentKey", func(t *testing.T) {
+		_, err := backend.TTL(ctx, "non-existent")
+		assert.Error(t, err)
+		assert.Equal(t, ErrCacheMiss, err)
+	})
+
+	t.Run("NoExpiration", func(t *testing.T) {
+		key := "no-expiry"
+		// TTL of 0 typically means no expiration
+		err := backend.Set(ctx, key, []byte("value"), 0)
+		require.NoError(t, err)
+
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		// No expiration returns 0
+		assert.Equal(t, time.Duration(0), remaining)
+	})
+
+	t.Run("AfterClose", func(t *testing.T) {
+		closedBackend, _ := NewMemoryBackend(DefaultConfig())
+		closedBackend.Close()
+
+		_, err := closedBackend.TTL(ctx, "key")
+		assert.Error(t, err)
+		assert.Equal(t, ErrBackendUnavailable, err)
+	})
+}
+
+// TestMemoryBackend_Expire tests the Expire method
+func TestMemoryBackend_Expire(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	ctx := context.Background()
+
+	t.Run("UpdateTTL", func(t *testing.T) {
+		key := "expire-key"
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+
+		// Update to shorter TTL
+		err = backend.Expire(ctx, key, 5*time.Second)
+		require.NoError(t, err)
+
+		// Check new TTL
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		assert.LessOrEqual(t, remaining, 5*time.Second)
+	})
+
+	t.Run("NonExistentKey", func(t *testing.T) {
+		err := backend.Expire(ctx, "non-existent", 1*time.Minute)
+		assert.Error(t, err)
+		assert.Equal(t, ErrCacheMiss, err)
+	})
+
+	t.Run("RemoveExpiration", func(t *testing.T) {
+		key := "no-expire-key"
+		err := backend.Set(ctx, key, []byte("value"), 1*time.Minute)
+		require.NoError(t, err)
+
+		// Set TTL to 0 to remove expiration
+		err = backend.Expire(ctx, key, 0)
+		require.NoError(t, err)
+
+		// TTL should now be 0
+		remaining, err := backend.TTL(ctx, key)
+		require.NoError(t, err)
+		assert.Equal(t, time.Duration(0), remaining)
+	})
+
+	t.Run("AfterClose", func(t *testing.T) {
+		closedBackend, _ := NewMemoryBackend(DefaultConfig())
+		closedBackend.Close()
+
+		err := closedBackend.Expire(ctx, "key", 1*time.Minute)
+		assert.Error(t, err)
+		assert.Equal(t, ErrBackendUnavailable, err)
+	})
+}
+
+// TestMemoryBackend_IsHealthy tests the IsHealthy method
+func TestMemoryBackend_IsHealthy(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+
+	// Should be healthy when open
+	assert.True(t, backend.IsHealthy())
+
+	// Should be unhealthy after close
+	backend.Close()
+	assert.False(t, backend.IsHealthy())
+}
+
+// TestMemoryBackend_Type tests the Type method
+func TestMemoryBackend_Type(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	backendType := backend.Type()
+	assert.Equal(t, TypeMemory, backendType)
+}
+
+// TestMemoryBackend_Capabilities tests the Capabilities method
+func TestMemoryBackend_Capabilities(t *testing.T) {
+	t.Parallel()
+
+	backend, err := NewMemoryBackend(DefaultConfig())
+	require.NoError(t, err)
+	defer backend.Close()
+
+	caps := backend.Capabilities()
+	require.NotNil(t, caps)
+
+	// Memory backend should not be distributed or persistent
+	assert.False(t, caps.Distributed)
+	assert.False(t, caps.Persistent)
+
+	// Should support eviction and TTL
+	assert.True(t, caps.Eviction)
+	assert.True(t, caps.TTL)
+	assert.True(t, caps.SupportsExpire)
+	assert.True(t, caps.SupportsMultiGet)
+
+	// Check limits
+	assert.Greater(t, caps.MaxKeySize, int64(0))
+	assert.Greater(t, caps.MaxValueSize, int64(0))
+}
+
+// TestMatchPattern tests the matchPattern helper function
+func TestMatchPattern(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		pattern string
+		key     string
+		matches bool
+	}{
+		{"*", "any-key", true},
+		{"*", "another", true},
+		{"user:1", "user:1", true},
+		{"user:1", "user:2", false},
+		{"*:suffix", "prefix:suffix", true},
+		{"*suffix", "prefix-suffix", true},
+		{"*abc", "xyzabc", true},
+		{"*abc", "xyz", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("%s-%s", tt.pattern, tt.key), func(t *testing.T) {
+			result := matchPattern(tt.pattern, tt.key)
+			assert.Equal(t, tt.matches, result)
+		})
+	}
+}

internal/cache/backends/test_helpers_test.go

@@ -44,6 +44,10 @@ func (l *TestLogger) Errorf(format string, args ...interface{}) {
 	l.Error(format, args...)
 }
 
+func (l *TestLogger) Warnf(format string, args ...interface{}) {
+	l.t.Logf("[WARN] "+format, args...)
+}
+
 // MiniredisServer manages a miniredis instance for testing
 type MiniredisServer struct {
 	server *miniredis.Miniredis

internal/cache/cache_test.go

@@ -1880,19 +1880,20 @@ func TestConcurrentManagerOperations(t *testing.T) {
 // TestTTLExpirationAndCleanup tests TTL expiration and cleanup routines comprehensively
 func TestTTLExpirationAndCleanup(t *testing.T) {
 	config := DefaultConfig()
-	config.CleanupInterval = 10 * time.Millisecond
+	config.CleanupInterval = 50 * time.Millisecond
 	config.EnableAutoCleanup = true
 	cache := New(config)
 	defer cache.Close()
 
 	// Test various TTL scenarios
+	// Note: Timing increased 5x to account for race detector overhead
 	testCases := []struct {
 		key string
 		ttl time.Duration
 	}{
-		{"very-short", 5 * time.Millisecond},
-		{"short", 25 * time.Millisecond},
-		{"medium", 100 * time.Millisecond},
+		{"very-short", 25 * time.Millisecond},
+		{"short", 125 * time.Millisecond},
+		{"medium", 500 * time.Millisecond},
 		{"long", 1 * time.Hour},
 	}
 
@@ -1908,13 +1909,13 @@ func TestTTLExpirationAndCleanup(t *testing.T) {
 	}
 
 	// Wait for very short items to expire
-	time.Sleep(15 * time.Millisecond)
+	time.Sleep(75 * time.Millisecond)
 	if _, exists := cache.Get("very-short"); exists {
 		t.Error("Very short item should be expired")
 	}
 
 	// Wait for short items to expire
-	time.Sleep(30 * time.Millisecond)
+	time.Sleep(150 * time.Millisecond)
 	if _, exists := cache.Get("short"); exists {
 		t.Error("Short item should be expired")
 	}
@@ -1930,16 +1931,16 @@ func TestTTLExpirationAndCleanup(t *testing.T) {
 	}
 
 	// Test manual cleanup
-	cache.Set("manual-cleanup", "value", 1*time.Millisecond)
-	time.Sleep(5 * time.Millisecond)
+	cache.Set("manual-cleanup", "value", 5*time.Millisecond)
+	time.Sleep(25 * time.Millisecond)
 	cache.Cleanup()
 
 	// Add many expired items to test bulk cleanup
 	for i := 0; i < 100; i++ {
 		key := fmt.Sprintf("bulk-%d", i)
-		cache.Set(key, fmt.Sprintf("value-%d", i), 1*time.Millisecond)
+		cache.Set(key, fmt.Sprintf("value-%d", i), 5*time.Millisecond)
 	}
-	time.Sleep(5 * time.Millisecond)
+	time.Sleep(25 * time.Millisecond)
 
 	sizeBefore := cache.Size()
 	cache.Cleanup()
@@ -2038,3 +2039,88 @@ func TestCacheStatisticsAndMetrics(t *testing.T) {
 		t.Error("Memory usage should increase after adding large item")
 	}
 }
+
+// ============================================================================
+// noOpLogger Tests
+// ============================================================================
+
+// TestNoOpLogger_AllMethods tests all noOpLogger methods to ensure they don't panic
+func TestNoOpLogger_AllMethods(t *testing.T) {
+	logger := &noOpLogger{}
+
+	// Test simple message methods
+	logger.Debug("test debug message")
+	logger.Info("test info message")
+	logger.Error("test error message")
+	logger.Warn("test warn message")
+	logger.Fatal("test fatal message")
+
+	// Test formatted message methods
+	logger.Debugf("test debug: %s", "value")
+	logger.Infof("test info: %s", "value")
+	logger.Errorf("test error: %s", "value")
+	logger.Warnf("test warn: %s", "value")
+	logger.Fatalf("test fatal: %s", "value")
+
+	// If we reach here, all methods executed without panicking
+	// This is expected behavior for a no-op logger
+}
+
+// TestNoOpLogger_WithField verifies WithField returns the same logger
+func TestNoOpLogger_WithField(t *testing.T) {
+	logger := &noOpLogger{}
+
+	result := logger.WithField("key", "value")
+
+	if result != logger {
+		t.Error("WithField should return the same logger instance")
+	}
+
+	// Verify the returned logger works
+	result.Info("test message after WithField")
+}
+
+// TestNoOpLogger_WithFields verifies WithFields returns the same logger
+func TestNoOpLogger_WithFields(t *testing.T) {
+	logger := &noOpLogger{}
+
+	fields := map[string]interface{}{
+		"key1": "value1",
+		"key2": 123,
+		"key3": true,
+	}
+
+	result := logger.WithFields(fields)
+
+	if result != logger {
+		t.Error("WithFields should return the same logger instance")
+	}
+
+	// Verify the returned logger works
+	result.Info("test message after WithFields")
+}
+
+// TestNoOpLogger_Chaining verifies method chaining works
+func TestNoOpLogger_Chaining(t *testing.T) {
+	logger := &noOpLogger{}
+
+	// Use WithField and verify it returns a usable logger
+	result := logger.WithField("key1", "value1")
+
+	// Verify the result can be used for logging (Logger interface methods)
+	result.Info("info after WithField")
+	result.Infof("infof after WithField: %s", "test")
+	result.Debug("debug after WithField")
+	result.Debugf("debugf after WithField: %d", 123)
+	result.Error("error after WithField")
+	result.Errorf("errorf after WithField: %v", true)
+
+	// Use WithFields and verify it returns a usable logger
+	result2 := logger.WithFields(map[string]interface{}{
+		"key2": "value2",
+		"key3": 123,
+	})
+
+	// Verify the result can be used for logging
+	result2.Infof("message after WithFields: %s", "test")
+}

internal/cache/resilience/circuit_breaker_backend_test.go

@@ -0,0 +1,561 @@
+//go:build !yaegi
+
+package resilience
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/lukaszraczylo/traefikoidc/internal/cache/backends"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// mockBackend is a simple mock implementation for testing
+type mockBackend struct {
+	data       map[string]mockEntry
+	mu         sync.RWMutex
+	failSet    bool
+	failGet    bool
+	failDelete bool
+	failExists bool
+	failClear  bool
+	failPing   bool
+	callCount  int
+}
+
+type mockEntry struct {
+	value     []byte
+	expiresAt time.Time
+}
+
+func newMockBackend() *mockBackend {
+	return &mockBackend{
+		data: make(map[string]mockEntry),
+	}
+}
+
+func (m *mockBackend) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failSet {
+		return errors.New("mock set error")
+	}
+
+	expiresAt := time.Now().Add(ttl)
+	if ttl == 0 {
+		expiresAt = time.Now().Add(24 * time.Hour)
+	}
+
+	m.data[key] = mockEntry{
+		value:     value,
+		expiresAt: expiresAt,
+	}
+	return nil
+}
+
+func (m *mockBackend) Get(ctx context.Context, key string) ([]byte, time.Duration, bool, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	m.callCount++
+
+	if m.failGet {
+		return nil, 0, false, errors.New("mock get error")
+	}
+
+	entry, exists := m.data[key]
+	if !exists {
+		return nil, 0, false, nil
+	}
+
+	if time.Now().After(entry.expiresAt) {
+		return nil, 0, false, nil
+	}
+
+	ttl := time.Until(entry.expiresAt)
+	return entry.value, ttl, true, nil
+}
+
+func (m *mockBackend) Delete(ctx context.Context, key string) (bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failDelete {
+		return false, errors.New("mock delete error")
+	}
+
+	_, existed := m.data[key]
+	delete(m.data, key)
+	return existed, nil
+}
+
+func (m *mockBackend) Exists(ctx context.Context, key string) (bool, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	m.callCount++
+
+	if m.failExists {
+		return false, errors.New("mock exists error")
+	}
+
+	entry, exists := m.data[key]
+	if !exists {
+		return false, nil
+	}
+
+	if time.Now().After(entry.expiresAt) {
+		return false, nil
+	}
+
+	return true, nil
+}
+
+func (m *mockBackend) Clear(ctx context.Context) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failClear {
+		return errors.New("mock clear error")
+	}
+
+	m.data = make(map[string]mockEntry)
+	return nil
+}
+
+func (m *mockBackend) GetStats() map[string]interface{} {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	return map[string]interface{}{
+		"hits":       int64(0),
+		"misses":     int64(0),
+		"call_count": m.callCount,
+	}
+}
+
+func (m *mockBackend) Close() error {
+	return nil
+}
+
+func (m *mockBackend) Ping(ctx context.Context) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.callCount++
+
+	if m.failPing {
+		return errors.New("mock ping error")
+	}
+	return nil
+}
+
+// Constructor Tests
+
+func TestNewCircuitBreakerBackend_WithDefaultConfig(t *testing.T) {
+	mockBE := newMockBackend()
+
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+	require.NotNil(t, cb)
+
+	// Verify it implements the interface (compile-time check)
+	var _ backends.CacheBackend = cb
+}
+
+func TestNewCircuitBreakerBackend_WithCustomConfig(t *testing.T) {
+	mockBE := newMockBackend()
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         3,
+		FailureThreshold:    0.5,
+		Timeout:             5 * time.Second,
+		HalfOpenMaxRequests: 2,
+		ResetTimeout:        10 * time.Second,
+	}
+
+	cb := NewCircuitBreakerBackend(mockBE, config)
+	require.NotNil(t, cb)
+}
+
+// Set Operation Tests
+
+func TestCircuitBreakerBackend_Set_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	err := cb.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	assert.NoError(t, err)
+	assert.Equal(t, 1, mockBE.callCount)
+
+	// Verify value was stored
+	value, _, exists, _ := mockBE.Get(ctx, "key1")
+	assert.True(t, exists)
+	assert.Equal(t, []byte("value1"), value)
+}
+
+func TestCircuitBreakerBackend_Set_Failure(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failSet = true
+
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	err := cb.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	assert.Error(t, err)
+}
+
+func TestCircuitBreakerBackend_Set_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failSet = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures to open circuit
+	for i := 0; i < 5; i++ {
+		cb.Set(ctx, "key", []byte("value"), 1*time.Minute)
+	}
+
+	// Circuit should be open now
+	err := cb.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Get Operation Tests
+
+func TestCircuitBreakerBackend_Get_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// First set a value
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	// Now get it through circuit breaker
+	value, _, exists, err := cb.Get(ctx, "key1")
+
+	assert.NoError(t, err)
+	assert.True(t, exists)
+	assert.Equal(t, []byte("value1"), value)
+}
+
+func TestCircuitBreakerBackend_Get_Failure(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failGet = true
+
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	_, _, _, err := cb.Get(ctx, "key1")
+
+	assert.Error(t, err)
+}
+
+func TestCircuitBreakerBackend_Get_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failGet = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Get(ctx, "key")
+	}
+
+	// Circuit should be open
+	_, _, _, err := cb.Get(ctx, "key2")
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Delete Operation Tests
+
+func TestCircuitBreakerBackend_Delete_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Set a value first
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	// Delete through circuit breaker
+	deleted, err := cb.Delete(ctx, "key1")
+
+	assert.NoError(t, err)
+	assert.True(t, deleted)
+
+	// Verify it's deleted
+	exists, _ := mockBE.Exists(ctx, "key1")
+	assert.False(t, exists)
+}
+
+func TestCircuitBreakerBackend_Delete_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failDelete = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Delete(ctx, "key")
+	}
+
+	// Circuit should be open
+	_, err := cb.Delete(ctx, "key2")
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Exists Operation Tests
+
+func TestCircuitBreakerBackend_Exists_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Set a value first
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+
+	// Check existence through circuit breaker
+	exists, err := cb.Exists(ctx, "key1")
+
+	assert.NoError(t, err)
+	assert.True(t, exists)
+}
+
+func TestCircuitBreakerBackend_Exists_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failExists = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Exists(ctx, "key")
+	}
+
+	// Circuit should be open
+	_, err := cb.Exists(ctx, "key2")
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Clear Operation Tests
+
+func TestCircuitBreakerBackend_Clear_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Set some values
+	mockBE.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+	mockBE.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+
+	// Clear through circuit breaker
+	err := cb.Clear(ctx)
+
+	assert.NoError(t, err)
+
+	// Verify cleared
+	exists1, _ := mockBE.Exists(ctx, "key1")
+	exists2, _ := mockBE.Exists(ctx, "key2")
+	assert.False(t, exists1)
+	assert.False(t, exists2)
+}
+
+func TestCircuitBreakerBackend_Clear_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failClear = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Clear(ctx)
+	}
+
+	// Circuit should be open
+	err := cb.Clear(ctx)
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// GetStats Tests
+
+func TestCircuitBreakerBackend_GetStats(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+
+	// Perform some operations
+	cb.Set(ctx, "key1", []byte("value1"), 1*time.Minute)
+	cb.Get(ctx, "key1")
+
+	stats := cb.GetStats()
+
+	require.NotNil(t, stats)
+
+	// Should have circuit breaker stats
+	assert.Contains(t, stats, "circuit_breaker")
+
+	cbStats, ok := stats["circuit_breaker"].(map[string]interface{})
+	require.True(t, ok)
+
+	// Verify circuit breaker stats fields
+	assert.Contains(t, cbStats, "state")
+	assert.Contains(t, cbStats, "consecutive_failures")
+	assert.Contains(t, cbStats, "total_requests")
+	assert.Contains(t, cbStats, "total_failures")
+	assert.Contains(t, cbStats, "success_rate")
+}
+
+func TestCircuitBreakerBackend_GetStats_NilBackendStats(t *testing.T) {
+	// Create a mock backend that returns nil stats
+	mockBE := &mockBackendNilStats{}
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	stats := cb.GetStats()
+
+	require.NotNil(t, stats)
+	assert.Contains(t, stats, "circuit_breaker")
+}
+
+// mockBackendNilStats returns nil from GetStats
+type mockBackendNilStats struct {
+	mockBackend
+}
+
+func (m *mockBackendNilStats) GetStats() map[string]interface{} {
+	return nil
+}
+
+// Ping Tests
+
+func TestCircuitBreakerBackend_Ping_Success(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	ctx := context.Background()
+	err := cb.Ping(ctx)
+
+	assert.NoError(t, err)
+}
+
+func TestCircuitBreakerBackend_Ping_CircuitOpen(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failPing = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures: 2,
+		Timeout:     100 * time.Millisecond,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures
+	for i := 0; i < 5; i++ {
+		cb.Ping(ctx)
+	}
+
+	// Circuit should be open
+	err := cb.Ping(ctx)
+	assert.Error(t, err)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+}
+
+// Close Tests
+
+func TestCircuitBreakerBackend_Close(t *testing.T) {
+	mockBE := newMockBackend()
+	cb := NewCircuitBreakerBackend(mockBE, nil)
+
+	err := cb.Close()
+	assert.NoError(t, err)
+}
+
+// Circuit Recovery Test
+
+func TestCircuitBreakerBackend_CircuitRecovery(t *testing.T) {
+	mockBE := newMockBackend()
+	mockBE.failSet = true
+
+	config := &CircuitBreakerConfig{
+		MaxFailures:         2,
+		Timeout:             200 * time.Millisecond,
+		HalfOpenMaxRequests: 1,
+	}
+	cb := NewCircuitBreakerBackend(mockBE, config)
+
+	ctx := context.Background()
+
+	// Trigger failures to open circuit
+	for i := 0; i < 5; i++ {
+		cb.Set(ctx, "key", []byte("value"), 1*time.Minute)
+	}
+
+	// Verify circuit is open
+	err := cb.Set(ctx, "key2", []byte("value2"), 1*time.Minute)
+	assert.Equal(t, backends.ErrCircuitOpen, err)
+
+	// Wait for timeout
+	time.Sleep(250 * time.Millisecond)
+
+	// Fix the backend
+	mockBE.mu.Lock()
+	mockBE.failSet = false
+	mockBE.mu.Unlock()
+
+	// Circuit should be in half-open state, allow a test request
+	err = cb.Set(ctx, "key3", []byte("value3"), 1*time.Minute)
+
+	// After success threshold is met, circuit should close
+	if err == nil {
+		// Circuit recovered
+		err2 := cb.Set(ctx, "key4", []byte("value4"), 1*time.Minute)
+		assert.NoError(t, err2, "Circuit should be closed after recovery")
+	}
+}

internal/cleanup/cleanup_test.go

@@ -0,0 +1,931 @@
+//go:build !yaegi
+
+package cleanup
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Mock logger for testing
+type mockLogger struct {
+	mu       sync.Mutex
+	logs     []string
+	errLogs  []string
+	debugLog []string
+}
+
+func (m *mockLogger) Logf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.logs = append(m.logs, format)
+}
+
+func (m *mockLogger) ErrorLogf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.errLogs = append(m.errLogs, format)
+}
+
+func (m *mockLogger) DebugLogf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.debugLog = append(m.debugLog, format)
+}
+
+func (m *mockLogger) getLogCount() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return len(m.logs)
+}
+
+// BackgroundTask tests
+func TestNewBackgroundTask(t *testing.T) {
+	logger := &mockLogger{}
+	var wg sync.WaitGroup
+	runCount := 0
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {
+		runCount++
+	}, logger, &wg)
+
+	if task == nil {
+		t.Fatal("Expected NewBackgroundTask to return non-nil")
+	}
+
+	if task.name != "test-task" {
+		t.Errorf("Expected name 'test-task', got '%s'", task.name)
+	}
+
+	if task.interval != 100*time.Millisecond {
+		t.Errorf("Expected interval 100ms, got %v", task.interval)
+	}
+
+	if task.IsRunning() {
+		t.Error("Expected task to not be running initially")
+	}
+}
+
+func TestBackgroundTask_Start(t *testing.T) {
+	logger := &mockLogger{}
+	runCount := int32(0)
+
+	task := NewBackgroundTask("test-task", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	task.Start()
+
+	if !task.IsRunning() {
+		t.Error("Expected task to be running after Start()")
+	}
+
+	// Wait for at least 2 executions
+	time.Sleep(120 * time.Millisecond)
+
+	task.Stop()
+
+	count := atomic.LoadInt32(&runCount)
+	if count < 2 {
+		t.Errorf("Expected at least 2 executions, got %d", count)
+	}
+}
+
+func TestBackgroundTask_Stop(t *testing.T) {
+	logger := &mockLogger{}
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+
+	task.Start()
+	time.Sleep(50 * time.Millisecond)
+	task.Stop()
+
+	if task.IsRunning() {
+		t.Error("Expected task to not be running after Stop()")
+	}
+
+	// Calling Stop again should not panic
+	task.Stop()
+}
+
+func TestBackgroundTask_DoubleStart(t *testing.T) {
+	logger := &mockLogger{}
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+
+	task.Start()
+	logCountBefore := logger.getLogCount()
+
+	// Second start should be ignored
+	task.Start()
+
+	logCountAfter := logger.getLogCount()
+	if logCountAfter <= logCountBefore {
+		t.Error("Expected log message about task already running")
+	}
+
+	task.Stop()
+}
+
+func TestBackgroundTask_ExecuteWithPanic(t *testing.T) {
+	logger := &mockLogger{}
+	panicCount := int32(0)
+
+	task := NewBackgroundTask("panic-task", 50*time.Millisecond, func() {
+		count := atomic.AddInt32(&panicCount, 1)
+		if count == 1 {
+			panic("test panic")
+		}
+	}, logger)
+
+	task.Start()
+	time.Sleep(120 * time.Millisecond)
+	task.Stop()
+
+	// Task should recover from panic and continue
+	finalCount := atomic.LoadInt32(&panicCount)
+	if finalCount < 2 {
+		t.Errorf("Expected task to continue after panic, got %d executions", finalCount)
+	}
+
+	stats := task.GetStats()
+	if stats["errorCount"].(int64) < 1 {
+		t.Error("Expected error count to be at least 1")
+	}
+}
+
+func TestBackgroundTask_GetStats(t *testing.T) {
+	logger := &mockLogger{}
+	runCount := int32(0)
+
+	task := NewBackgroundTask("test-task", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	task.Start()
+	time.Sleep(120 * time.Millisecond)
+	task.Stop()
+
+	stats := task.GetStats()
+
+	if stats["name"] != "test-task" {
+		t.Errorf("Expected name 'test-task', got %v", stats["name"])
+	}
+
+	if !stats["isRunning"].(bool) == true {
+		// Task should be stopped
+	}
+
+	if stats["runCount"].(int64) < 2 {
+		t.Errorf("Expected runCount >= 2, got %v", stats["runCount"])
+	}
+}
+
+func TestBackgroundTask_WithWaitGroup(t *testing.T) {
+	logger := &mockLogger{}
+	var wg sync.WaitGroup
+	runCount := int32(0)
+
+	task := NewBackgroundTask("test-task", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger, &wg)
+
+	task.Start()
+
+	// Wait for task to start
+	time.Sleep(100 * time.Millisecond)
+
+	// Stop and wait
+	done := make(chan bool)
+	go func() {
+		task.Stop()
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Error("Timeout waiting for task to stop")
+	}
+}
+
+// TaskRegistry tests
+func TestNewTaskRegistry(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	if registry == nil {
+		t.Fatal("Expected NewTaskRegistry to return non-nil")
+	}
+
+	if registry.maxTasks != 10 {
+		t.Errorf("Expected maxTasks 10, got %d", registry.maxTasks)
+	}
+
+	if registry.GetTaskCount() != 0 {
+		t.Error("Expected initial task count to be 0")
+	}
+}
+
+func TestTaskRegistry_RegisterTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	err := registry.RegisterTask("test-task", task)
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if registry.GetTaskCount() != 1 {
+		t.Error("Expected task count to be 1")
+	}
+}
+
+func TestTaskRegistry_RegisterTask_Duplicate(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task1 := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+
+	err1 := registry.RegisterTask("test-task", task1)
+	if err1 != nil {
+		t.Errorf("Expected no error on first registration, got %v", err1)
+	}
+
+	err2 := registry.RegisterTask("test-task", task2)
+	if err2 == nil {
+		t.Error("Expected error when registering duplicate task")
+	}
+}
+
+func TestTaskRegistry_RegisterTask_Nil(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	err := registry.RegisterTask("test-task", nil)
+	if err == nil {
+		t.Error("Expected error when registering nil task")
+	}
+}
+
+func TestTaskRegistry_RegisterTask_MaxLimit(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 2)
+
+	task1 := NewBackgroundTask("task1", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("task2", 100*time.Millisecond, func() {}, logger)
+	task3 := NewBackgroundTask("task3", 100*time.Millisecond, func() {}, logger)
+
+	registry.RegisterTask("task1", task1)
+	registry.RegisterTask("task2", task2)
+	err := registry.RegisterTask("task3", task3)
+
+	if err == nil {
+		t.Error("Expected error when exceeding max tasks")
+	}
+}
+
+func TestTaskRegistry_UnregisterTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+
+	if registry.GetTaskCount() != 1 {
+		t.Error("Expected task count to be 1")
+	}
+
+	registry.UnregisterTask("test-task")
+
+	if registry.GetTaskCount() != 0 {
+		t.Error("Expected task count to be 0 after unregister")
+	}
+}
+
+func TestTaskRegistry_UnregisterTask_Running(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+	task.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	registry.UnregisterTask("test-task")
+
+	if task.IsRunning() {
+		t.Error("Expected task to be stopped after unregister")
+	}
+}
+
+func TestTaskRegistry_GetTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+
+	retrieved, exists := registry.GetTask("test-task")
+	if !exists {
+		t.Error("Expected task to exist")
+	}
+
+	if retrieved != task {
+		t.Error("Expected to retrieve the same task")
+	}
+
+	_, exists = registry.GetTask("non-existent")
+	if exists {
+		t.Error("Expected non-existent task to not exist")
+	}
+}
+
+func TestTaskRegistry_StopAllTasks(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task1 := NewBackgroundTask("task1", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("task2", 100*time.Millisecond, func() {}, logger)
+
+	registry.RegisterTask("task1", task1)
+	registry.RegisterTask("task2", task2)
+
+	task1.Start()
+	task2.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	registry.StopAllTasks()
+
+	if task1.IsRunning() || task2.IsRunning() {
+		t.Error("Expected all tasks to be stopped")
+	}
+
+	if registry.GetTaskCount() != 0 {
+		t.Error("Expected task count to be 0 after StopAllTasks")
+	}
+}
+
+func TestTaskRegistry_CreateSingletonTask(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	runCount := int32(0)
+	task1, err1 := registry.CreateSingletonTask("singleton", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	if err1 != nil {
+		t.Errorf("Expected no error, got %v", err1)
+	}
+
+	if task1 == nil {
+		t.Fatal("Expected task to be created")
+	}
+
+	if !task1.IsRunning() {
+		t.Error("Expected task to be running")
+	}
+
+	// Try to create same task again
+	task2, err2 := registry.CreateSingletonTask("singleton", 50*time.Millisecond, func() {
+		atomic.AddInt32(&runCount, 1)
+	}, logger)
+
+	if err2 != nil {
+		t.Errorf("Expected no error on second call, got %v", err2)
+	}
+
+	if task2 != task1 {
+		t.Error("Expected to get the same task instance")
+	}
+
+	time.Sleep(120 * time.Millisecond)
+	task1.Stop()
+
+	if atomic.LoadInt32(&runCount) < 2 {
+		t.Error("Expected task to have run multiple times")
+	}
+}
+
+func TestTaskRegistry_GetAllTasks(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task1 := NewBackgroundTask("task1", 100*time.Millisecond, func() {}, logger)
+	task2 := NewBackgroundTask("task2", 100*time.Millisecond, func() {}, logger)
+
+	registry.RegisterTask("task1", task1)
+	registry.RegisterTask("task2", task2)
+
+	allTasks := registry.GetAllTasks()
+
+	if len(allTasks) != 2 {
+		t.Errorf("Expected 2 tasks, got %d", len(allTasks))
+	}
+
+	if _, ok := allTasks["task1"]; !ok {
+		t.Error("Expected task1 in results")
+	}
+
+	if _, ok := allTasks["task2"]; !ok {
+		t.Error("Expected task2 in results")
+	}
+}
+
+func TestTaskRegistry_GetStats(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+	task.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	stats := registry.GetStats()
+
+	if stats["totalTasks"].(int) != 1 {
+		t.Errorf("Expected totalTasks 1, got %v", stats["totalTasks"])
+	}
+
+	if stats["runningTasks"].(int) != 1 {
+		t.Errorf("Expected runningTasks 1, got %v", stats["runningTasks"])
+	}
+
+	if _, ok := stats["memory"]; !ok {
+		t.Error("Expected memory stats")
+	}
+
+	task.Stop()
+}
+
+func TestGlobalTaskRegistry(t *testing.T) {
+	// Reset before test
+	ResetGlobalTaskRegistry()
+
+	registry1 := GetGlobalTaskRegistry()
+	registry2 := GetGlobalTaskRegistry()
+
+	if registry1 != registry2 {
+		t.Error("Expected singleton to return same instance")
+	}
+
+	// Cleanup
+	ResetGlobalTaskRegistry()
+}
+
+func TestResetGlobalTaskRegistry(t *testing.T) {
+	ResetGlobalTaskRegistry()
+
+	registry := GetGlobalTaskRegistry()
+	logger := &mockLogger{}
+	task := NewBackgroundTask("test-task", 100*time.Millisecond, func() {}, logger)
+	registry.RegisterTask("test-task", task)
+	task.Start()
+
+	time.Sleep(50 * time.Millisecond)
+
+	ResetGlobalTaskRegistry()
+
+	// Should get a new instance
+	newRegistry := GetGlobalTaskRegistry()
+	if newRegistry.GetTaskCount() != 0 {
+		t.Error("Expected new registry to be empty")
+	}
+}
+
+// TaskCircuitBreaker tests
+func TestNewTaskCircuitBreaker(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(5, 30*time.Second, logger)
+
+	if cb == nil {
+		t.Fatal("Expected NewTaskCircuitBreaker to return non-nil")
+	}
+
+	if cb.failureThreshold != 5 {
+		t.Errorf("Expected failureThreshold 5, got %d", cb.failureThreshold)
+	}
+
+	if cb.timeout != 30*time.Second {
+		t.Errorf("Expected timeout 30s, got %v", cb.timeout)
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected initial state to be closed")
+	}
+}
+
+func TestTaskCircuitBreaker_CanCreateTask(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(3, 100*time.Millisecond, logger)
+
+	err := cb.CanCreateTask("test-task")
+	if err != nil {
+		t.Errorf("Expected no error initially, got %v", err)
+	}
+}
+
+func TestTaskCircuitBreaker_OnTaskFailure(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(3, 100*time.Millisecond, logger)
+
+	// Record failures
+	for i := 0; i < 3; i++ {
+		cb.OnTaskFailure("test-task", nil)
+	}
+
+	// Circuit should be open
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit breaker to be open after threshold failures")
+	}
+
+	// Should not be able to create task
+	err := cb.CanCreateTask("test-task")
+	if err == nil {
+		t.Error("Expected error when circuit breaker is open")
+	}
+}
+
+func TestTaskCircuitBreaker_OnTaskSuccess(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(5, 100*time.Millisecond, logger)
+
+	cb.OnTaskFailure("test-task", nil)
+	cb.OnTaskFailure("test-task", nil)
+
+	cb.OnTaskSuccess("test-task")
+
+	// Task-specific failures should be reset
+	err := cb.CanCreateTask("test-task")
+	if err != nil {
+		t.Errorf("Expected no error after success, got %v", err)
+	}
+}
+
+func TestTaskCircuitBreaker_Reset(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(2, 100*time.Millisecond, logger)
+
+	cb.OnTaskFailure("test-task", nil)
+	cb.OnTaskFailure("test-task", nil)
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit breaker to be open")
+	}
+
+	cb.Reset()
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected circuit breaker to be closed after reset")
+	}
+
+	err := cb.CanCreateTask("test-task")
+	if err != nil {
+		t.Errorf("Expected no error after reset, got %v", err)
+	}
+}
+
+func TestTaskCircuitBreaker_TimeoutRecovery(t *testing.T) {
+	logger := &mockLogger{}
+	cb := NewTaskCircuitBreaker(2, 100*time.Millisecond, logger)
+
+	// Open circuit breaker
+	cb.OnTaskFailure("test-task", nil)
+	cb.OnTaskFailure("test-task", nil)
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit breaker to be open")
+	}
+
+	// Wait for timeout
+	time.Sleep(150 * time.Millisecond)
+
+	// Circuit breaker should reset, but task-specific failures remain
+	// Need to check with a different task name
+	err := cb.CanCreateTask("different-task")
+	if err != nil {
+		t.Errorf("Expected no error for different task after timeout, got %v", err)
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected circuit breaker to be closed after timeout")
+	}
+
+	// Original task still has too many failures
+	err = cb.CanCreateTask("test-task")
+	if err == nil {
+		t.Error("Expected error for original task with too many failures")
+	}
+}
+
+// TaskMemoryMonitor tests
+func TestNewTaskMemoryMonitor(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	if monitor == nil {
+		t.Fatal("Expected NewTaskMemoryMonitor to return non-nil")
+	}
+
+	if monitor.registry != registry {
+		t.Error("Expected registry to be set")
+	}
+
+	if monitor.memoryThreshold != 1024*1024*1024 {
+		t.Errorf("Expected default threshold 1GB, got %d", monitor.memoryThreshold)
+	}
+}
+
+func TestTaskMemoryMonitor_SetMemoryThreshold(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	monitor.SetMemoryThreshold(512 * 1024 * 1024)
+
+	stats := monitor.GetStats()
+	if stats["memoryThreshold"].(uint64) != 512*1024*1024 {
+		t.Error("Expected threshold to be updated")
+	}
+}
+
+func TestTaskMemoryMonitor_StartStop(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	monitor.StartMonitoring()
+
+	stats := monitor.GetStats()
+	if !stats["isMonitoring"].(bool) {
+		t.Error("Expected monitor to be running")
+	}
+
+	// Double start should be ignored
+	monitor.StartMonitoring()
+
+	monitor.StopMonitoring()
+
+	stats = monitor.GetStats()
+	if stats["isMonitoring"].(bool) {
+		t.Error("Expected monitor to be stopped")
+	}
+
+	// Double stop should be safe
+	monitor.StopMonitoring()
+}
+
+func TestTaskMemoryMonitor_GetStats(t *testing.T) {
+	logger := &mockLogger{}
+	registry := NewTaskRegistry(logger, 10)
+	monitor := NewTaskMemoryMonitor(logger, registry)
+
+	stats := monitor.GetStats()
+
+	if _, ok := stats["isMonitoring"]; !ok {
+		t.Error("Expected isMonitoring in stats")
+	}
+
+	if _, ok := stats["currentMemory"]; !ok {
+		t.Error("Expected currentMemory in stats")
+	}
+
+	if _, ok := stats["memoryThreshold"]; !ok {
+		t.Error("Expected memoryThreshold in stats")
+	}
+}
+
+// WorkerPool tests
+func TestNewWorkerPool(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(4, 10, logger)
+
+	if pool == nil {
+		t.Fatal("Expected NewWorkerPool to return non-nil")
+	}
+
+	if pool.workers != 4 {
+		t.Errorf("Expected 4 workers, got %d", pool.workers)
+	}
+}
+
+func TestWorkerPool_DefaultWorkers(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(0, 0, logger)
+
+	// Should default to NumCPU
+	if pool.workers <= 0 {
+		t.Error("Expected positive number of workers")
+	}
+}
+
+func TestWorkerPool_StartStop(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+
+	metrics := pool.GetMetrics()
+	if !metrics["isRunning"].(bool) {
+		t.Error("Expected worker pool to be running")
+	}
+
+	// Double start should be ignored
+	pool.Start()
+
+	pool.Stop()
+
+	metrics = pool.GetMetrics()
+	if metrics["isRunning"].(bool) {
+		t.Error("Expected worker pool to be stopped")
+	}
+
+	// Double stop should be safe
+	pool.Stop()
+}
+
+func TestWorkerPool_Submit(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	executed := int32(0)
+	var wg sync.WaitGroup
+
+	for i := 0; i < 3; i++ {
+		wg.Add(1)
+		err := pool.Submit(func() {
+			defer wg.Done()
+			atomic.AddInt32(&executed, 1)
+		})
+
+		if err != nil {
+			t.Errorf("Expected no error submitting task, got %v", err)
+		}
+	}
+
+	// Wait for tasks to complete
+	done := make(chan bool)
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Error("Timeout waiting for tasks to complete")
+	}
+
+	if atomic.LoadInt32(&executed) != 3 {
+		t.Errorf("Expected 3 tasks executed, got %d", atomic.LoadInt32(&executed))
+	}
+}
+
+func TestWorkerPool_SubmitWhenStopped(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	err := pool.Submit(func() {})
+	if err == nil {
+		t.Error("Expected error when submitting to stopped pool")
+	}
+}
+
+func TestWorkerPool_TaskPanic(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	executed := int32(0)
+	var wg sync.WaitGroup
+
+	wg.Add(2)
+	// Submit task that panics
+	pool.Submit(func() {
+		defer wg.Done()
+		panic("test panic")
+	})
+
+	// Submit normal task
+	pool.Submit(func() {
+		defer wg.Done()
+		atomic.AddInt32(&executed, 1)
+	})
+
+	// Wait for tasks
+	done := make(chan bool)
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Error("Timeout waiting for tasks")
+	}
+
+	// Pool should still be functional
+	metrics := pool.GetMetrics()
+	if metrics["tasksFailed"].(int64) < 1 {
+		t.Error("Expected at least one failed task")
+	}
+}
+
+func TestWorkerPool_GetMetrics(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(2, 5, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	pool.Submit(func() {
+		defer wg.Done()
+		time.Sleep(10 * time.Millisecond)
+	})
+
+	pool.Submit(func() {
+		defer wg.Done()
+		time.Sleep(10 * time.Millisecond)
+	})
+
+	wg.Wait()
+
+	metrics := pool.GetMetrics()
+
+	if metrics["workers"].(int) != 2 {
+		t.Errorf("Expected 2 workers, got %v", metrics["workers"])
+	}
+
+	if metrics["tasksProcessed"].(int64) != 2 {
+		t.Errorf("Expected 2 processed tasks, got %v", metrics["tasksProcessed"])
+	}
+
+	if metrics["tasksQueued"].(int64) != 2 {
+		t.Errorf("Expected 2 queued tasks, got %v", metrics["tasksQueued"])
+	}
+}
+
+func TestWorkerPool_Concurrent(t *testing.T) {
+	logger := &mockLogger{}
+	pool := NewWorkerPool(4, 20, logger)
+
+	pool.Start()
+	defer pool.Stop()
+
+	executed := int32(0)
+	var wg sync.WaitGroup
+
+	taskCount := 10
+	for i := 0; i < taskCount; i++ {
+		wg.Add(1)
+		err := pool.Submit(func() {
+			defer wg.Done()
+			atomic.AddInt32(&executed, 1)
+			time.Sleep(10 * time.Millisecond)
+		})
+
+		if err != nil {
+			wg.Done()
+			t.Errorf("Failed to submit task: %v", err)
+		}
+	}
+
+	// Wait for all tasks
+	done := make(chan bool)
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(5 * time.Second):
+		t.Error("Timeout waiting for concurrent tasks")
+	}
+
+	if atomic.LoadInt32(&executed) != int32(taskCount) {
+		t.Errorf("Expected %d tasks executed, got %d", taskCount, atomic.LoadInt32(&executed))
+	}
+}

internal/compat/compatibility_test.go

@@ -0,0 +1,495 @@
+//go:build !yaegi
+
+package compat
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestGetLayer_Singleton(t *testing.T) {
+	// Reset global state
+	layerOnce = sync.Once{}
+	layer = nil
+
+	layer1 := GetLayer()
+	layer2 := GetLayer()
+
+	if layer1 != layer2 {
+		t.Error("Expected GetLayer to return same instance")
+	}
+}
+
+func TestGetLayer_Initialize(t *testing.T) {
+	// Reset global state
+	layerOnce = sync.Once{}
+	layer = nil
+
+	l := GetLayer()
+
+	// Check default mappings exist
+	if _, exists := l.GetMapping("ProviderURL"); !exists {
+		t.Error("Expected ProviderURL mapping to exist")
+	}
+
+	if _, exists := l.GetMapping("ClientID"); !exists {
+		t.Error("Expected ClientID mapping to exist")
+	}
+
+	// Check deprecations exist
+	if _, deprecated := l.CheckDeprecation("LogLevel"); !deprecated {
+		t.Error("Expected LogLevel to be marked deprecated")
+	}
+}
+
+func TestRegisterMapping(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("OldField", "New.Field")
+
+	newPath, exists := l.GetMapping("OldField")
+	if !exists {
+		t.Error("Expected mapping to exist")
+	}
+
+	if newPath != "New.Field" {
+		t.Errorf("Expected 'New.Field', got '%s'", newPath)
+	}
+}
+
+func TestRegisterConverter(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	converter := func(oldValue interface{}) (interface{}, error) {
+		if str, ok := oldValue.(string); ok {
+			return str + "_converted", nil
+		}
+		return oldValue, nil
+	}
+
+	l.RegisterConverter("TestField", converter)
+
+	result, err := l.Convert("TestField", "test")
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+
+	if result != "test_converted" {
+		t.Errorf("Expected 'test_converted', got '%v'", result)
+	}
+}
+
+func TestConvert_NoConverter(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	// No converter registered
+	result, err := l.Convert("UnknownField", "value")
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if result != "value" {
+		t.Error("Expected original value when no converter exists")
+	}
+}
+
+func TestRegisterDeprecation(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterDeprecation("OldField", "This field is deprecated")
+
+	message, deprecated := l.CheckDeprecation("OldField")
+	if !deprecated {
+		t.Error("Expected field to be deprecated")
+	}
+
+	if message != "This field is deprecated" {
+		t.Errorf("Expected deprecation message, got '%s'", message)
+	}
+}
+
+func TestCheckDeprecation_NotDeprecated(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	_, deprecated := l.CheckDeprecation("NewField")
+	if deprecated {
+		t.Error("Expected field not to be deprecated")
+	}
+}
+
+func TestMigrateMap_BasicMapping(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("OldField", "New.Field")
+
+	oldConfig := map[string]interface{}{
+		"OldField": "value123",
+	}
+
+	newConfig, warnings := l.MigrateMap(oldConfig)
+
+	if len(warnings) != 0 {
+		t.Errorf("Expected no warnings, got %d", len(warnings))
+	}
+
+	// Check nested structure
+	if newMap, ok := newConfig["New"].(map[string]interface{}); ok {
+		if val, exists := newMap["Field"]; !exists || val != "value123" {
+			t.Errorf("Expected nested field value 'value123', got %v", val)
+		}
+	} else {
+		t.Error("Expected nested map structure")
+	}
+}
+
+func TestMigrateMap_WithDeprecation(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("DeprecatedField", "New.Field")
+	l.RegisterDeprecation("DeprecatedField", "Field is deprecated")
+
+	oldConfig := map[string]interface{}{
+		"DeprecatedField": "value",
+	}
+
+	_, warnings := l.MigrateMap(oldConfig)
+
+	if len(warnings) != 1 {
+		t.Errorf("Expected 1 warning, got %d", len(warnings))
+	}
+
+	if warnings[0] != "Field is deprecated" {
+		t.Errorf("Expected deprecation warning, got '%s'", warnings[0])
+	}
+}
+
+func TestMigrateMap_WithConverter(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("Seconds", "Duration")
+	l.RegisterConverter("Seconds", func(oldValue interface{}) (interface{}, error) {
+		if seconds, ok := oldValue.(int); ok {
+			return seconds * 1000, nil // Convert to milliseconds
+		}
+		return oldValue, nil
+	})
+
+	oldConfig := map[string]interface{}{
+		"Seconds": 60,
+	}
+
+	newConfig, _ := l.MigrateMap(oldConfig)
+
+	if val, ok := newConfig["Duration"]; !ok || val != 60000 {
+		t.Errorf("Expected Duration to be 60000, got %v", val)
+	}
+}
+
+func TestMigrateMap_NoMapping(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	oldConfig := map[string]interface{}{
+		"UnmappedField": "value",
+	}
+
+	newConfig, _ := l.MigrateMap(oldConfig)
+
+	if val, ok := newConfig["UnmappedField"]; !ok || val != "value" {
+		t.Error("Expected unmapped field to be copied as-is")
+	}
+}
+
+func TestSplitPath(t *testing.T) {
+	tests := []struct {
+		path     string
+		expected []string
+	}{
+		{"Simple", []string{"Simple"}},
+		{"Nested.Path", []string{"Nested", "Path"}},
+		{"Deep.Nested.Path", []string{"Deep", "Nested", "Path"}},
+		{"", []string{}},
+		{"Single", []string{"Single"}},
+	}
+
+	for _, tt := range tests {
+		result := splitPath(tt.path)
+		if len(result) != len(tt.expected) {
+			t.Errorf("Path '%s': expected %d segments, got %d", tt.path, len(tt.expected), len(result))
+			continue
+		}
+
+		for i, segment := range result {
+			if segment != tt.expected[i] {
+				t.Errorf("Path '%s': segment %d expected '%s', got '%s'", tt.path, i, tt.expected[i], segment)
+			}
+		}
+	}
+}
+
+func TestIsArrayPath(t *testing.T) {
+	tests := []struct {
+		segment  string
+		expected bool
+	}{
+		{"Addresses[0]", true},
+		{"Items[5]", true},
+		{"Simple", false},
+		{"NoArray", false},
+		{"[start", true},
+	}
+
+	for _, tt := range tests {
+		result := isArrayPath(tt.segment)
+		if result != tt.expected {
+			t.Errorf("Segment '%s': expected %v, got %v", tt.segment, tt.expected, result)
+		}
+	}
+}
+
+func TestSetNestedValue_SingleLevel(t *testing.T) {
+	m := make(map[string]interface{})
+	setNestedValue(m, "Field", "value")
+
+	if val, ok := m["Field"]; !ok || val != "value" {
+		t.Error("Expected single level field to be set")
+	}
+}
+
+func TestSetNestedValue_MultiLevel(t *testing.T) {
+	m := make(map[string]interface{})
+	setNestedValue(m, "Parent.Child", "value")
+
+	parent, ok := m["Parent"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected Parent to be a map")
+	}
+
+	if val, ok := parent["Child"]; !ok || val != "value" {
+		t.Error("Expected nested field to be set")
+	}
+}
+
+func TestSetNestedValue_DeepNesting(t *testing.T) {
+	m := make(map[string]interface{})
+	setNestedValue(m, "Level1.Level2.Level3", "deep_value")
+
+	level1, ok := m["Level1"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected Level1 to be a map")
+	}
+
+	level2, ok := level1["Level2"].(map[string]interface{})
+	if !ok {
+		t.Fatal("Expected Level2 to be a map")
+	}
+
+	if val, ok := level2["Level3"]; !ok || val != "deep_value" {
+		t.Error("Expected deeply nested field to be set")
+	}
+}
+
+// ConfigAdapter tests
+
+func TestNewConfigAdapter(t *testing.T) {
+	config := map[string]interface{}{"key": "value"}
+	adapter := NewConfigAdapter(config)
+
+	if adapter == nil {
+		t.Fatal("Expected adapter to be created")
+	}
+
+	if adapter.newConfig == nil {
+		t.Error("Expected config to be stored")
+	}
+}
+
+func TestConfigAdapter_RegisterGetter(t *testing.T) {
+	adapter := NewConfigAdapter(nil)
+
+	called := false
+	adapter.RegisterGetter("TestPath", func() interface{} {
+		called = true
+		return "test_value"
+	})
+
+	val, exists := adapter.Get("TestPath")
+	if !exists {
+		t.Error("Expected getter to exist")
+	}
+
+	if val != "test_value" {
+		t.Errorf("Expected 'test_value', got %v", val)
+	}
+
+	if !called {
+		t.Error("Expected getter function to be called")
+	}
+}
+
+type TestConfig struct {
+	Provider struct {
+		IssuerURL string
+		ClientID  string
+	}
+	Session struct {
+		EncryptionKey string
+	}
+}
+
+func TestConfigAdapter_GetNestedField(t *testing.T) {
+	config := &TestConfig{}
+	config.Provider.IssuerURL = "https://test.com"
+	config.Provider.ClientID = "test-client"
+	config.Session.EncryptionKey = "secret123"
+
+	adapter := NewConfigAdapter(config)
+
+	// Test nested field access
+	val, exists := adapter.getNestedField("Provider.IssuerURL")
+	if !exists {
+		t.Error("Expected field to exist")
+	}
+
+	if val != "https://test.com" {
+		t.Errorf("Expected 'https://test.com', got %v", val)
+	}
+
+	// Test another nested field
+	val2, exists2 := adapter.getNestedField("Provider.ClientID")
+	if !exists2 || val2 != "test-client" {
+		t.Error("Expected ClientID to be accessible")
+	}
+
+	// Test non-existent field
+	_, exists3 := adapter.getNestedField("NonExistent.Field")
+	if exists3 {
+		t.Error("Expected non-existent field to return false")
+	}
+}
+
+// Race condition tests
+
+func TestCompatibilityLayer_ConcurrentAccess(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	var wg sync.WaitGroup
+
+	// Concurrent registrations
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			l.RegisterMapping(string(rune('A'+idx%26)), "New.Field")
+		}(i)
+	}
+
+	// Concurrent reads
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			_, _ = l.GetMapping(string(rune('A' + idx%26)))
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestCompatibilityLayer_ConcurrentMigrate(t *testing.T) {
+	l := &CompatibilityLayer{
+		mappings:     make(map[string]string),
+		converters:   make(map[string]Converter),
+		deprecations: make(map[string]string),
+	}
+
+	l.RegisterMapping("OldField", "New.Field")
+
+	var wg sync.WaitGroup
+
+	// Concurrent migrations
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			oldConfig := map[string]interface{}{
+				"OldField": "value",
+			}
+			_, _ = l.MigrateMap(oldConfig)
+		}()
+	}
+
+	wg.Wait()
+}
+
+func TestConfigAdapter_ConcurrentAccess(t *testing.T) {
+	config := &TestConfig{}
+	config.Provider.IssuerURL = "https://test.com"
+
+	adapter := NewConfigAdapter(config)
+
+	var wg sync.WaitGroup
+
+	// Concurrent getter registrations
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			path := string(rune('A' + idx%26))
+			adapter.RegisterGetter(path, func() interface{} {
+				return "value"
+			})
+		}(i)
+	}
+
+	// Concurrent gets
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			path := string(rune('A' + idx%26))
+			_, _ = adapter.Get(path)
+		}(i)
+	}
+
+	wg.Wait()
+}

internal/features/flags_test.go

@@ -0,0 +1,483 @@
+//go:build !yaegi
+
+package features
+
+import (
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestFeatureManager_Register(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	if !m.flags["TEST_FEATURE"].enabled.Load() == false {
+		t.Error("Expected feature to be disabled by default")
+	}
+
+	m.Register("TEST_ENABLED", "Test enabled feature", true)
+	if m.flags["TEST_ENABLED"].enabled.Load() != true {
+		t.Error("Expected feature to be enabled")
+	}
+}
+
+func TestFeatureManager_IsEnabled(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", true)
+
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be enabled")
+	}
+
+	if m.IsEnabled("NON_EXISTENT") {
+		t.Error("Expected non-existent feature to return false")
+	}
+}
+
+func TestFeatureManager_EnableDisable(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	// Enable the feature
+	m.Enable("TEST_FEATURE")
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be enabled")
+	}
+
+	// Disable the feature
+	m.Disable("TEST_FEATURE")
+	if m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be disabled")
+	}
+
+	// Enable/Disable non-existent feature should not panic
+	m.Enable("NON_EXISTENT")
+	m.Disable("NON_EXISTENT")
+}
+
+func TestFeatureManager_Toggle(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	// Toggle from false to true
+	m.Toggle("TEST_FEATURE")
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be enabled after toggle")
+	}
+
+	// Toggle from true to false
+	m.Toggle("TEST_FEATURE")
+	if m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected feature to be disabled after toggle")
+	}
+
+	// Toggle non-existent feature should not panic
+	m.Toggle("NON_EXISTENT")
+}
+
+func TestFeatureManager_OnChange(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	var callbackCalled atomic.Bool
+	var callbackValue atomic.Bool
+
+	m.OnChange("TEST_FEATURE", func(enabled bool) {
+		callbackCalled.Store(true)
+		callbackValue.Store(enabled)
+	})
+
+	// Enable should trigger callback
+	m.Enable("TEST_FEATURE")
+
+	// Wait briefly for callback
+	time.Sleep(10 * time.Millisecond)
+
+	if !callbackCalled.Load() {
+		t.Error("Expected callback to be called")
+	}
+
+	if !callbackValue.Load() {
+		t.Error("Expected callback value to be true")
+	}
+
+	// Setting to same value should NOT trigger callback again
+	callbackCalled.Store(false)
+	m.Enable("TEST_FEATURE")
+	time.Sleep(10 * time.Millisecond)
+
+	if callbackCalled.Load() {
+		t.Error("Expected callback NOT to be called when value doesn't change")
+	}
+}
+
+func TestFeatureManager_LoadFromEnv(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+	m.Register("TEST_FEATURE_2", "Test feature 2", false)
+
+	// Set environment variables
+	os.Setenv("FEATURE_TEST_FEATURE", "true")
+	os.Setenv("FEATURE_TEST_FEATURE_2", "1")
+	defer func() {
+		os.Unsetenv("FEATURE_TEST_FEATURE")
+		os.Unsetenv("FEATURE_TEST_FEATURE_2")
+	}()
+
+	m.LoadFromEnv()
+
+	if !m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected TEST_FEATURE to be enabled from env")
+	}
+
+	if !m.IsEnabled("TEST_FEATURE_2") {
+		t.Error("Expected TEST_FEATURE_2 to be enabled from env (value=1)")
+	}
+}
+
+func TestFeatureManager_LoadFromEnv_FalseValues(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", true) // Default true
+
+	// Set to false
+	os.Setenv("FEATURE_TEST_FEATURE", "false")
+	defer os.Unsetenv("FEATURE_TEST_FEATURE")
+
+	m.LoadFromEnv()
+
+	if m.IsEnabled("TEST_FEATURE") {
+		t.Error("Expected TEST_FEATURE to be disabled from env")
+	}
+}
+
+func TestFeatureManager_GetAll(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("FEATURE_1", "Feature 1", true)
+	m.Register("FEATURE_2", "Feature 2", false)
+
+	all := m.GetAll()
+
+	if len(all) != 2 {
+		t.Errorf("Expected 2 features, got %d", len(all))
+	}
+
+	if !all["FEATURE_1"] {
+		t.Error("Expected FEATURE_1 to be enabled")
+	}
+
+	if all["FEATURE_2"] {
+		t.Error("Expected FEATURE_2 to be disabled")
+	}
+}
+
+func TestFeatureManager_Reset(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("FEATURE_1", "Feature 1", true)
+	m.Register("FEATURE_2", "Feature 2", true)
+
+	var callbackCalled atomic.Int32
+	m.OnChange("FEATURE_1", func(enabled bool) {
+		callbackCalled.Add(1)
+	})
+
+	m.Reset()
+
+	// All features should be disabled
+	if m.IsEnabled("FEATURE_1") {
+		t.Error("Expected FEATURE_1 to be disabled after reset")
+	}
+
+	if m.IsEnabled("FEATURE_2") {
+		t.Error("Expected FEATURE_2 to be disabled after reset")
+	}
+
+	// Callbacks should be cleared
+	m.Enable("FEATURE_1")
+	time.Sleep(10 * time.Millisecond)
+
+	if callbackCalled.Load() != 0 {
+		t.Error("Expected callbacks to be cleared after reset")
+	}
+}
+
+func TestGetManager_Singleton(t *testing.T) {
+	// Reset global state for clean test
+	managerOnce = sync.Once{}
+	manager = nil
+
+	m1 := GetManager()
+	m2 := GetManager()
+
+	if m1 != m2 {
+		t.Error("Expected GetManager to return same instance")
+	}
+}
+
+func TestGetManager_Initialize(t *testing.T) {
+	// Reset global state for clean test
+	managerOnce = sync.Once{}
+	manager = nil
+
+	m := GetManager()
+
+	// Should have default feature flags
+	all := m.GetAll()
+	if len(all) < 6 {
+		t.Errorf("Expected at least 6 default feature flags, got %d", len(all))
+	}
+
+	// Check specific flags exist
+	flags := []string{
+		UseUnifiedConfig,
+		UseNewFileStructure,
+		UseStandardErrors,
+		UseEnhancedLogging,
+		UseOptimizedTests,
+		UseRedisRESP,
+	}
+
+	for _, flag := range flags {
+		if _, exists := m.flags[flag]; !exists {
+			t.Errorf("Expected default flag %s to exist", flag)
+		}
+	}
+}
+
+func TestHelperFunctions(t *testing.T) {
+	// Reset global state
+	managerOnce = sync.Once{}
+	manager = nil
+
+	// Test IsUnifiedConfigEnabled
+	if IsUnifiedConfigEnabled() {
+		t.Error("Expected unified config to be disabled by default")
+	}
+
+	GetManager().Enable(UseUnifiedConfig)
+	if !IsUnifiedConfigEnabled() {
+		t.Error("Expected unified config to be enabled")
+	}
+
+	// Reset for next test
+	GetManager().Reset()
+
+	// Test IsNewFileStructureEnabled
+	if IsNewFileStructureEnabled() {
+		t.Error("Expected new file structure to be disabled by default")
+	}
+
+	GetManager().Enable(UseNewFileStructure)
+	if !IsNewFileStructureEnabled() {
+		t.Error("Expected new file structure to be enabled")
+	}
+
+	// Test IsStandardErrorsEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseStandardErrors)
+	if !IsStandardErrorsEnabled() {
+		t.Error("Expected standard errors to be enabled")
+	}
+
+	// Test IsEnhancedLoggingEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseEnhancedLogging)
+	if !IsEnhancedLoggingEnabled() {
+		t.Error("Expected enhanced logging to be enabled")
+	}
+
+	// Test IsOptimizedTestsEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseOptimizedTests)
+	if !IsOptimizedTestsEnabled() {
+		t.Error("Expected optimized tests to be enabled")
+	}
+
+	// Test IsRedisRESPEnabled
+	GetManager().Reset()
+	GetManager().Enable(UseRedisRESP)
+	if !IsRedisRESPEnabled() {
+		t.Error("Expected Redis RESP to be enabled")
+	}
+}
+
+// Race condition tests
+func TestFeatureManager_ConcurrentAccess(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	var wg sync.WaitGroup
+	iterations := 100
+
+	// Concurrent enables
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.Enable("TEST_FEATURE")
+		}()
+	}
+
+	// Concurrent disables
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.Disable("TEST_FEATURE")
+		}()
+	}
+
+	// Concurrent reads
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = m.IsEnabled("TEST_FEATURE")
+		}()
+	}
+
+	wg.Wait()
+
+	// Should not panic - final state is not deterministic but that's ok
+}
+
+func TestFeatureManager_ConcurrentCallbacks(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("TEST_FEATURE", "Test feature", false)
+
+	var callbackCount atomic.Int32
+	var wg sync.WaitGroup
+
+	// Register multiple callbacks concurrently
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.OnChange("TEST_FEATURE", func(enabled bool) {
+				callbackCount.Add(1)
+			})
+		}()
+	}
+
+	wg.Wait()
+
+	// Toggle the feature
+	m.Toggle("TEST_FEATURE")
+
+	// Wait for callbacks
+	time.Sleep(50 * time.Millisecond)
+
+	// All 10 callbacks should have been called
+	if callbackCount.Load() != 10 {
+		t.Errorf("Expected 10 callbacks, got %d", callbackCount.Load())
+	}
+}
+
+func TestFeatureManager_ConcurrentGetAll(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	for i := 0; i < 5; i++ {
+		m.Register(string(rune('A'+i)), "Feature", false)
+	}
+
+	var wg sync.WaitGroup
+
+	// Concurrent GetAll calls
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			all := m.GetAll()
+			if len(all) != 5 {
+				t.Errorf("Expected 5 flags, got %d", len(all))
+			}
+		}()
+	}
+
+	// Concurrent modifications
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			flag := string(rune('A' + (idx % 5)))
+			if idx%2 == 0 {
+				m.Enable(flag)
+			} else {
+				m.Disable(flag)
+			}
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestFeatureManager_LoadFromEnv_Concurrent(t *testing.T) {
+	m := &FeatureManager{
+		flags: make(map[string]*FeatureFlag),
+	}
+
+	m.Register("FEATURE_1", "Feature 1", false)
+	m.Register("FEATURE_2", "Feature 2", false)
+
+	os.Setenv("FEATURE_FEATURE_1", "true")
+	os.Setenv("FEATURE_FEATURE_2", "true")
+	defer func() {
+		os.Unsetenv("FEATURE_FEATURE_1")
+		os.Unsetenv("FEATURE_FEATURE_2")
+	}()
+
+	var wg sync.WaitGroup
+
+	// Load from env concurrently
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m.LoadFromEnv()
+		}()
+	}
+
+	wg.Wait()
+
+	// Both should be enabled
+	if !m.IsEnabled("FEATURE_1") || !m.IsEnabled("FEATURE_2") {
+		t.Error("Expected features to be enabled from env")
+	}
+}

internal/recovery/recovery_boost_test.go

@@ -0,0 +1,524 @@
+//go:build !yaegi
+
+package recovery
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// LogDebug Tests
+func TestBaseRecoveryMechanism_LogDebug(t *testing.T) {
+	logger := &mockLogger{}
+	base := NewBaseRecoveryMechanism("test-debug", logger)
+
+	// Call LogDebug
+	base.LogDebug("test message: %s", "value")
+
+	// Verify debug log was called
+	if len(logger.debugLog) != 1 {
+		t.Errorf("Expected 1 debug log entry, got %d", len(logger.debugLog))
+	}
+}
+
+func TestBaseRecoveryMechanism_LogDebug_NilLogger(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test", nil)
+
+	// Should not panic with nil logger
+	base.LogDebug("this should not crash")
+}
+
+// HTTPError Tests
+func TestHTTPError_Error(t *testing.T) {
+	err := &HTTPError{
+		StatusCode: 404,
+		Message:    "Not Found",
+	}
+
+	expected := "HTTP 404: Not Found"
+	if err.Error() != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, err.Error())
+	}
+}
+
+func TestHTTPError_IsRetryable(t *testing.T) {
+	tests := []struct {
+		name       string
+		statusCode int
+		retryable  bool
+	}{
+		{"500 Internal Server Error", 500, true},
+		{"502 Bad Gateway", 502, true},
+		{"503 Service Unavailable", 503, true},
+		{"504 Gateway Timeout", 504, true},
+		{"429 Too Many Requests", 429, true},
+		{"408 Request Timeout", 408, true},
+		{"400 Bad Request", 400, false},
+		{"401 Unauthorized", 401, false},
+		{"403 Forbidden", 403, false},
+		{"404 Not Found", 404, false},
+		{"200 OK", 200, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := &HTTPError{
+				StatusCode: tt.statusCode,
+				Message:    tt.name,
+			}
+
+			if err.IsRetryable() != tt.retryable {
+				t.Errorf("StatusCode %d: expected retryable=%v, got %v",
+					tt.statusCode, tt.retryable, err.IsRetryable())
+			}
+		})
+	}
+}
+
+// OIDCError Tests
+func TestOIDCError_Error_WithDescription(t *testing.T) {
+	err := &OIDCError{
+		Code:        "invalid_request",
+		Description: "Missing required parameter",
+	}
+
+	expected := "OIDC error invalid_request: Missing required parameter"
+	if err.Error() != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, err.Error())
+	}
+}
+
+func TestOIDCError_Error_WithoutDescription(t *testing.T) {
+	err := &OIDCError{
+		Code: "server_error",
+	}
+
+	expected := "OIDC error: server_error"
+	if err.Error() != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, err.Error())
+	}
+}
+
+func TestOIDCError_IsRetryable(t *testing.T) {
+	tests := []struct {
+		code      string
+		retryable bool
+	}{
+		{"temporarily_unavailable", true},
+		{"server_error", true},
+		{"invalid_request", false},
+		{"invalid_client", false},
+		{"invalid_grant", false},
+		{"unauthorized_client", false},
+		{"unsupported_grant_type", false},
+		{"access_denied", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.code, func(t *testing.T) {
+			err := &OIDCError{
+				Code: tt.code,
+			}
+
+			if err.IsRetryable() != tt.retryable {
+				t.Errorf("Code '%s': expected retryable=%v, got %v",
+					tt.code, tt.retryable, err.IsRetryable())
+			}
+		})
+	}
+}
+
+// FallbackMechanism Tests
+func TestNewFallbackMechanism(t *testing.T) {
+	logger := &mockLogger{}
+	fallbackFunc := func() error { return nil }
+
+	fm := NewFallbackMechanism("test-fallback", logger, fallbackFunc)
+
+	if fm == nil {
+		t.Fatal("Expected NewFallbackMechanism to return non-nil")
+	}
+
+	if fm.name != "test-fallback" {
+		t.Errorf("Expected name 'test-fallback', got '%s'", fm.name)
+	}
+
+	if fm.fallbackFunc == nil {
+		t.Error("Expected fallbackFunc to be set")
+	}
+}
+
+func TestFallbackMechanism_ExecuteWithContext_PrimarySuccess(t *testing.T) {
+	logger := &mockLogger{}
+	fallbackCalled := false
+	fallbackFunc := func() error {
+		fallbackCalled = true
+		return nil
+	}
+
+	fm := NewFallbackMechanism("test", logger, fallbackFunc)
+
+	// Primary function succeeds
+	err := fm.ExecuteWithContext(context.Background(), func() error {
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if fallbackCalled {
+		t.Error("Expected fallback to not be called when primary succeeds")
+	}
+
+	if fm.successCount != 1 {
+		t.Errorf("Expected successCount=1, got %d", fm.successCount)
+	}
+}
+
+func TestFallbackMechanism_ExecuteWithContext_FallbackSuccess(t *testing.T) {
+	logger := &mockLogger{}
+	fallbackCalled := false
+	fallbackFunc := func() error {
+		fallbackCalled = true
+		return nil
+	}
+
+	fm := NewFallbackMechanism("test", logger, fallbackFunc)
+
+	// Primary fails, fallback succeeds
+	err := fm.ExecuteWithContext(context.Background(), func() error {
+		return errors.New("primary failed")
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error (fallback succeeded), got %v", err)
+	}
+
+	if !fallbackCalled {
+		t.Error("Expected fallback to be called")
+	}
+
+	if fm.successCount != 1 {
+		t.Errorf("Expected successCount=1, got %d", fm.successCount)
+	}
+}
+
+func TestFallbackMechanism_ExecuteWithContext_BothFail(t *testing.T) {
+	logger := &mockLogger{}
+	fallbackFunc := func() error {
+		return errors.New("fallback failed")
+	}
+
+	fm := NewFallbackMechanism("test", logger, fallbackFunc)
+
+	// Both primary and fallback fail
+	err := fm.ExecuteWithContext(context.Background(), func() error {
+		return errors.New("primary failed")
+	})
+
+	if err == nil {
+		t.Error("Expected error when both primary and fallback fail")
+	}
+
+	if fm.failureCount != 1 {
+		t.Errorf("Expected failureCount=1, got %d", fm.failureCount)
+	}
+}
+
+func TestFallbackMechanism_ExecuteWithContext_NoFallback(t *testing.T) {
+	logger := &mockLogger{}
+	fm := NewFallbackMechanism("test", logger, nil) // No fallback function
+
+	// Primary fails, no fallback
+	primaryErr := errors.New("primary failed")
+	err := fm.ExecuteWithContext(context.Background(), func() error {
+		return primaryErr
+	})
+
+	if err != primaryErr {
+		t.Errorf("Expected primary error %v, got %v", primaryErr, err)
+	}
+
+	if fm.failureCount != 1 {
+		t.Errorf("Expected failureCount=1, got %d", fm.failureCount)
+	}
+}
+
+func TestFallbackMechanism_ExecuteWithContext_ContextCanceled(t *testing.T) {
+	logger := &mockLogger{}
+	fallbackFunc := func() error { return nil }
+	fm := NewFallbackMechanism("test", logger, fallbackFunc)
+
+	// Context already canceled
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	err := fm.ExecuteWithContext(ctx, func() error {
+		t.Error("Function should not be called when context is canceled")
+		return nil
+	})
+
+	if err != context.Canceled {
+		t.Errorf("Expected context.Canceled error, got %v", err)
+	}
+
+	if fm.failureCount != 1 {
+		t.Errorf("Expected failureCount=1, got %d", fm.failureCount)
+	}
+}
+
+func TestFallbackMechanism_Reset(t *testing.T) {
+	logger := &mockLogger{}
+	fm := NewFallbackMechanism("test", logger, nil)
+
+	// Record some metrics
+	fm.RecordRequest()
+	fm.RecordSuccess()
+	fm.RecordFailure()
+
+	if fm.totalRequests == 0 {
+		t.Error("Expected some requests before reset")
+	}
+
+	// Reset
+	fm.Reset()
+
+	if fm.totalRequests != 0 {
+		t.Errorf("Expected totalRequests=0 after reset, got %d", fm.totalRequests)
+	}
+
+	if fm.successCount != 0 {
+		t.Errorf("Expected successCount=0 after reset, got %d", fm.successCount)
+	}
+
+	if fm.failureCount != 0 {
+		t.Errorf("Expected failureCount=0 after reset, got %d", fm.failureCount)
+	}
+
+	if fm.lastSuccessStr != "never" {
+		t.Errorf("Expected lastSuccessStr='never' after reset, got '%s'", fm.lastSuccessStr)
+	}
+
+	if fm.lastFailureStr != "never" {
+		t.Errorf("Expected lastFailureStr='never' after reset, got '%s'", fm.lastFailureStr)
+	}
+}
+
+func TestFallbackMechanism_IsAvailable(t *testing.T) {
+	logger := &mockLogger{}
+	fm := NewFallbackMechanism("test", logger, nil)
+
+	// Fallback mechanism is always available
+	if !fm.IsAvailable() {
+		t.Error("Expected IsAvailable to return true")
+	}
+}
+
+func TestFallbackMechanism_GetMetrics(t *testing.T) {
+	logger := &mockLogger{}
+	fallbackFunc := func() error { return nil }
+	fm := NewFallbackMechanism("test-metrics", logger, fallbackFunc)
+
+	fm.RecordRequest()
+	fm.RecordSuccess()
+
+	metrics := fm.GetMetrics()
+
+	if metrics == nil {
+		t.Fatal("Expected GetMetrics to return non-nil")
+	}
+
+	if metrics["type"] != "fallback" {
+		t.Errorf("Expected type='fallback', got %v", metrics["type"])
+	}
+
+	if metrics["name"] != "test-metrics" {
+		t.Errorf("Expected name='test-metrics', got %v", metrics["name"])
+	}
+
+	if metrics["hasFallback"] != true {
+		t.Error("Expected hasFallback=true")
+	}
+
+	if metrics["totalRequests"].(int64) != 1 {
+		t.Errorf("Expected totalRequests=1, got %v", metrics["totalRequests"])
+	}
+}
+
+func TestFallbackMechanism_GetMetrics_NoFallback(t *testing.T) {
+	logger := &mockLogger{}
+	fm := NewFallbackMechanism("test", logger, nil)
+
+	metrics := fm.GetMetrics()
+
+	if metrics["hasFallback"] != false {
+		t.Error("Expected hasFallback=false when no fallback function")
+	}
+}
+
+// ============================================================================
+// CIRCUIT BREAKER ADDITIONAL TESTS
+// ============================================================================
+
+// TestCircuitBreaker_Execute tests the legacy Execute method
+func TestCircuitBreaker_Execute(t *testing.T) {
+	logger := &mockLogger{}
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, logger)
+
+	// Test successful execution via Execute (legacy method)
+	called := false
+	err := cb.Execute(func() error {
+		called = true
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if !called {
+		t.Error("Expected function to be called")
+	}
+
+	// Test error propagation via Execute
+	expectedErr := errors.New("test error")
+	err = cb.Execute(func() error {
+		return expectedErr
+	})
+
+	if err != expectedErr {
+		t.Errorf("Expected error %v, got %v", expectedErr, err)
+	}
+}
+
+// TestCircuitBreaker_ForceOpen tests forcing circuit breaker to open state
+func TestCircuitBreaker_ForceOpen(t *testing.T) {
+	logger := &mockLogger{}
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, logger)
+
+	// Initially circuit should be closed
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Errorf("Expected initial state Closed, got %v", cb.GetState())
+	}
+
+	// Force open
+	cb.ForceOpen()
+
+	// Verify state is now open
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Errorf("Expected state Open after ForceOpen, got %v", cb.GetState())
+	}
+
+	// Verify circuit blocks requests
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		t.Error("Function should not be called when circuit is forced open")
+		return nil
+	})
+
+	if err == nil {
+		t.Error("Expected error when circuit is forced open")
+	}
+
+	// Verify logger was called
+	if len(logger.logs) == 0 {
+		t.Error("Expected info log when forcing circuit open")
+	}
+}
+
+// TestCircuitBreaker_ForceClosed tests forcing circuit breaker to closed state
+func TestCircuitBreaker_ForceClosed(t *testing.T) {
+	logger := &mockLogger{}
+	config := DefaultCircuitBreakerConfig()
+	config.FailureThreshold = 1
+	cb := NewCircuitBreaker(config, logger)
+
+	// Trigger failures to open circuit
+	cb.ExecuteWithContext(context.Background(), func() error {
+		return errors.New("failure")
+	})
+	cb.ExecuteWithContext(context.Background(), func() error {
+		return errors.New("failure")
+	})
+	cb.ExecuteWithContext(context.Background(), func() error {
+		return errors.New("failure")
+	})
+
+	// Circuit should be open after failures
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Errorf("Expected state Open after failures, got %v", cb.GetState())
+	}
+
+	// Force closed
+	cb.ForceClosed()
+
+	// Verify state is now closed
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Errorf("Expected state Closed after ForceClosed, got %v", cb.GetState())
+	}
+
+	// Verify circuit allows requests
+	called := false
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		called = true
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error after forcing closed, got %v", err)
+	}
+
+	if !called {
+		t.Error("Expected function to be called after forcing closed")
+	}
+
+	// Verify counters are reset
+	metrics := cb.GetMetrics()
+	consecutiveFailures, ok := metrics["consecutiveFailures"].(int32)
+	if !ok || consecutiveFailures != 0 {
+		t.Errorf("Expected consecutiveFailures=0 after ForceClosed, got %v", consecutiveFailures)
+	}
+
+	// Verify logger was called
+	if len(logger.logs) == 0 {
+		t.Error("Expected info log when forcing circuit closed")
+	}
+}
+
+// TestCircuitBreaker_ForceOpen_AllowsRecovery tests that forced open can transition to half-open
+func TestCircuitBreaker_ForceOpen_AllowsRecovery(t *testing.T) {
+	logger := &mockLogger{}
+	config := DefaultCircuitBreakerConfig()
+	config.Timeout = 50 * time.Millisecond // Very short timeout for testing
+	cb := NewCircuitBreaker(config, logger)
+
+	// Force open
+	cb.ForceOpen()
+
+	// Wait for timeout to allow transition to half-open
+	time.Sleep(100 * time.Millisecond)
+
+	// Circuit should allow a test request in half-open state
+	called := false
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		called = true
+		return nil
+	})
+
+	// After successful execution, circuit should close
+	if err != nil {
+		t.Logf("Note: Circuit may still be in transition, error: %v", err)
+	}
+
+	if called {
+		// If called, verify circuit recovered
+		state := cb.GetState()
+		if state != CircuitBreakerClosed && state != CircuitBreakerHalfOpen {
+			t.Errorf("Expected Closed or HalfOpen after successful recovery, got %v", state)
+		}
+	}
+}

internal/recovery/recovery_test.go

@@ -0,0 +1,547 @@
+//go:build !yaegi
+
+package recovery
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Mock logger for testing
+type mockLogger struct {
+	mu       sync.Mutex
+	logs     []string
+	errLogs  []string
+	debugLog []string
+}
+
+func (m *mockLogger) Logf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.logs = append(m.logs, format)
+}
+
+func (m *mockLogger) ErrorLogf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.errLogs = append(m.errLogs, format)
+}
+
+func (m *mockLogger) DebugLogf(format string, args ...interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.debugLog = append(m.debugLog, format)
+}
+
+// BaseRecoveryMechanism tests
+func TestNewBaseRecoveryMechanism(t *testing.T) {
+	logger := &mockLogger{}
+	base := NewBaseRecoveryMechanism("test-recovery", logger)
+
+	if base == nil {
+		t.Fatal("Expected NewBaseRecoveryMechanism to return non-nil")
+	}
+
+	if base.name != "test-recovery" {
+		t.Errorf("Expected name 'test-recovery', got '%s'", base.name)
+	}
+
+	if base.totalRequests != 0 {
+		t.Error("Expected totalRequests to be 0")
+	}
+
+	if base.successCount != 0 {
+		t.Error("Expected successCount to be 0")
+	}
+
+	if base.failureCount != 0 {
+		t.Error("Expected failureCount to be 0")
+	}
+
+	if base.lastSuccessStr != "never" {
+		t.Error("Expected lastSuccessStr to be 'never'")
+	}
+
+	if base.lastFailureStr != "never" {
+		t.Error("Expected lastFailureStr to be 'never'")
+	}
+}
+
+func TestBaseRecoveryMechanism_RecordRequest(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test", &mockLogger{})
+
+	base.RecordRequest()
+	if atomic.LoadInt64(&base.totalRequests) != 1 {
+		t.Error("Expected totalRequests to be 1")
+	}
+
+	base.RecordRequest()
+	base.RecordRequest()
+	if atomic.LoadInt64(&base.totalRequests) != 3 {
+		t.Error("Expected totalRequests to be 3")
+	}
+}
+
+func TestBaseRecoveryMechanism_RecordSuccess(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test", &mockLogger{})
+
+	base.RecordSuccess()
+	if atomic.LoadInt64(&base.successCount) != 1 {
+		t.Error("Expected successCount to be 1")
+	}
+
+	base.successMutex.RLock()
+	lastSuccess := base.lastSuccessStr
+	base.successMutex.RUnlock()
+
+	if lastSuccess == "never" {
+		t.Error("Expected lastSuccessStr to be updated")
+	}
+}
+
+func TestBaseRecoveryMechanism_RecordFailure(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test", &mockLogger{})
+
+	base.RecordFailure()
+	if atomic.LoadInt64(&base.failureCount) != 1 {
+		t.Error("Expected failureCount to be 1")
+	}
+
+	base.failureMutex.RLock()
+	lastFailure := base.lastFailureStr
+	base.failureMutex.RUnlock()
+
+	if lastFailure == "never" {
+		t.Error("Expected lastFailureStr to be updated")
+	}
+}
+
+func TestBaseRecoveryMechanism_GetBaseMetrics(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test", &mockLogger{})
+
+	base.RecordRequest()
+	base.RecordRequest()
+	base.RecordSuccess()
+	base.RecordFailure()
+
+	metrics := base.GetBaseMetrics()
+
+	if metrics["totalRequests"].(int64) != 2 {
+		t.Error("Expected totalRequests to be 2")
+	}
+
+	if metrics["successCount"].(int64) != 1 {
+		t.Error("Expected successCount to be 1")
+	}
+
+	if metrics["failureCount"].(int64) != 1 {
+		t.Error("Expected failureCount to be 1")
+	}
+
+	if metrics["successRate"].(string) != "50.00%" {
+		t.Errorf("Expected successRate to be '50.00%%', got %v", metrics["successRate"])
+	}
+
+	if metrics["name"].(string) != "test" {
+		t.Error("Expected name to be 'test'")
+	}
+}
+
+func TestBaseRecoveryMechanism_ConcurrentAccess(t *testing.T) {
+	base := NewBaseRecoveryMechanism("test", &mockLogger{})
+
+	var wg sync.WaitGroup
+	iterations := 100
+
+	// Concurrent requests
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			base.RecordRequest()
+		}()
+	}
+
+	// Concurrent successes
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			base.RecordSuccess()
+		}()
+	}
+
+	// Concurrent failures
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			base.RecordFailure()
+		}()
+	}
+
+	wg.Wait()
+
+	if atomic.LoadInt64(&base.totalRequests) != int64(iterations) {
+		t.Errorf("Expected %d total requests, got %d", iterations, base.totalRequests)
+	}
+
+	if atomic.LoadInt64(&base.successCount) != int64(iterations) {
+		t.Errorf("Expected %d successes, got %d", iterations, base.successCount)
+	}
+
+	if atomic.LoadInt64(&base.failureCount) != int64(iterations) {
+		t.Errorf("Expected %d failures, got %d", iterations, base.failureCount)
+	}
+}
+
+// CircuitBreakerState tests
+func TestCircuitBreakerState_String(t *testing.T) {
+	tests := []struct {
+		state    CircuitBreakerState
+		expected string
+	}{
+		{CircuitBreakerClosed, "closed"},
+		{CircuitBreakerOpen, "open"},
+		{CircuitBreakerHalfOpen, "half-open"},
+		{CircuitBreakerState(99), "unknown"},
+	}
+
+	for _, tt := range tests {
+		if tt.state.String() != tt.expected {
+			t.Errorf("Expected state %d to be '%s', got '%s'", tt.state, tt.expected, tt.state.String())
+		}
+	}
+}
+
+// CircuitBreakerConfig tests
+func TestDefaultCircuitBreakerConfig(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+
+	if config.FailureThreshold != 5 {
+		t.Errorf("Expected FailureThreshold 5, got %d", config.FailureThreshold)
+	}
+
+	if config.SuccessThreshold != 2 {
+		t.Errorf("Expected SuccessThreshold 2, got %d", config.SuccessThreshold)
+	}
+
+	if config.Timeout != 30*time.Second {
+		t.Errorf("Expected Timeout 30s, got %v", config.Timeout)
+	}
+
+	if config.MaxRequests != 3 {
+		t.Errorf("Expected MaxRequests 3, got %d", config.MaxRequests)
+	}
+}
+
+// CircuitBreaker tests
+func TestNewCircuitBreaker(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	logger := &mockLogger{}
+	cb := NewCircuitBreaker(config, logger)
+
+	if cb == nil {
+		t.Fatal("Expected NewCircuitBreaker to return non-nil")
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected initial state to be Closed")
+	}
+
+	if cb.config.FailureThreshold != 5 {
+		t.Error("Expected config to be set")
+	}
+}
+
+func TestCircuitBreaker_InitiallyClosed(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	if !cb.IsAvailable() {
+		t.Error("Expected circuit breaker to be available initially")
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected state to be Closed")
+	}
+}
+
+func TestCircuitBreaker_ExecuteWithContext_Success(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	callCount := 0
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		callCount++
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if callCount != 1 {
+		t.Error("Expected function to be called once")
+	}
+
+	if atomic.LoadInt64(&cb.successCount) != 1 {
+		t.Error("Expected success count to be 1")
+	}
+}
+
+func TestCircuitBreaker_ExecuteWithContext_Failure(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	testErr := errors.New("test error")
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		return testErr
+	})
+
+	if err != testErr {
+		t.Errorf("Expected error %v, got %v", testErr, err)
+	}
+
+	if atomic.LoadInt64(&cb.failureCount) != 1 {
+		t.Error("Expected failure count to be 1")
+	}
+}
+
+func TestCircuitBreaker_OpensAfterThresholdFailures(t *testing.T) {
+	config := CircuitBreakerConfig{
+		FailureThreshold: 3,
+		SuccessThreshold: 2,
+		Timeout:          100 * time.Millisecond,
+		MaxRequests:      2,
+	}
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	testErr := errors.New("test error")
+
+	// Cause failures to reach threshold
+	for i := 0; i < 3; i++ {
+		_ = cb.ExecuteWithContext(context.Background(), func() error {
+			return testErr
+		})
+	}
+
+	// Circuit should now be open
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Errorf("Expected state to be Open after %d failures, got %s", config.FailureThreshold, cb.GetState())
+	}
+
+	if cb.IsAvailable() {
+		t.Error("Expected circuit breaker to be unavailable when open")
+	}
+
+	// Subsequent requests should be blocked
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		t.Error("Function should not be called when circuit is open")
+		return nil
+	})
+
+	if err == nil {
+		t.Error("Expected error when circuit is open")
+	}
+
+	if err.Error() != "circuit breaker is open" {
+		t.Errorf("Expected 'circuit breaker is open' error, got: %v", err)
+	}
+}
+
+func TestCircuitBreaker_TransitionsToHalfOpen(t *testing.T) {
+	config := CircuitBreakerConfig{
+		FailureThreshold: 2,
+		SuccessThreshold: 1,
+		Timeout:          50 * time.Millisecond,
+		MaxRequests:      2,
+	}
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	// Open the circuit
+	for i := 0; i < 2; i++ {
+		_ = cb.ExecuteWithContext(context.Background(), func() error {
+			return errors.New("fail")
+		})
+	}
+
+	if cb.GetState() != CircuitBreakerOpen {
+		t.Error("Expected circuit to be open")
+	}
+
+	// Wait for timeout
+	time.Sleep(60 * time.Millisecond)
+
+	// Next request should transition to half-open
+	err := cb.ExecuteWithContext(context.Background(), func() error {
+		return nil
+	})
+
+	if err != nil {
+		t.Errorf("Expected no error in half-open state, got %v", err)
+	}
+
+	// State should be closed after successful request in half-open
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Errorf("Expected state to be Closed after success in half-open, got %s", cb.GetState())
+	}
+}
+
+func TestCircuitBreaker_Reset(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	// Record some metrics
+	cb.RecordRequest()
+	cb.RecordSuccess()
+	cb.RecordFailure()
+
+	// Reset
+	cb.Reset()
+
+	if atomic.LoadInt64(&cb.totalRequests) != 0 {
+		t.Error("Expected totalRequests to be 0 after reset")
+	}
+
+	if atomic.LoadInt32(&cb.consecutiveFailures) != 0 {
+		t.Error("Expected consecutiveFailures to be 0 after reset")
+	}
+
+	if cb.GetState() != CircuitBreakerClosed {
+		t.Error("Expected state to be Closed after reset")
+	}
+}
+
+func TestCircuitBreaker_GetMetrics(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	cb.RecordRequest()
+	cb.RecordSuccess()
+
+	metrics := cb.GetMetrics()
+
+	if metrics == nil {
+		t.Fatal("Expected metrics to be non-nil")
+	}
+
+	if metrics["state"] != "closed" {
+		t.Errorf("Expected state 'closed', got %v", metrics["state"])
+	}
+
+	if metrics["totalRequests"].(int64) != 1 {
+		t.Errorf("Expected totalRequests 1, got %v", metrics["totalRequests"])
+	}
+
+	if metrics["successCount"].(int64) != 1 {
+		t.Error("Expected successCount to be 1")
+	}
+
+	if _, ok := metrics["config"]; !ok {
+		t.Error("Expected config in metrics")
+	}
+}
+
+func TestCircuitBreaker_ConcurrentExecute(t *testing.T) {
+	config := CircuitBreakerConfig{
+		FailureThreshold: 10,
+		SuccessThreshold: 2,
+		Timeout:          100 * time.Millisecond,
+		MaxRequests:      5,
+	}
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	var wg sync.WaitGroup
+	successCount := atomic.Int32{}
+	iterations := 50
+
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			err := cb.ExecuteWithContext(context.Background(), func() error {
+				time.Sleep(time.Millisecond)
+				if idx%2 == 0 {
+					return nil
+				}
+				return errors.New("error")
+			})
+			if err == nil {
+				successCount.Add(1)
+			}
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Should have processed requests without panicking
+	if atomic.LoadInt64(&cb.totalRequests) < int64(iterations) {
+		t.Logf("Processed %d requests out of %d (some may have been blocked)", cb.totalRequests, iterations)
+	}
+}
+
+func TestCircuitBreaker_ContextCancellation(t *testing.T) {
+	config := DefaultCircuitBreakerConfig()
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	// Execute with valid context
+	err := cb.ExecuteWithContext(ctx, func() error {
+		// Cancel during execution
+		cancel()
+		// Circuit breaker doesn't check context during execution by design
+		// It's the responsibility of the function to check context
+		return nil
+	})
+
+	// Should complete successfully - circuit breaker passes context but doesn't enforce it
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+}
+
+func TestCircuitBreaker_HalfOpenMaxRequests(t *testing.T) {
+	config := CircuitBreakerConfig{
+		FailureThreshold: 2,
+		SuccessThreshold: 1,
+		Timeout:          50 * time.Millisecond,
+		MaxRequests:      1,
+	}
+	cb := NewCircuitBreaker(config, &mockLogger{})
+
+	// Open the circuit
+	for i := 0; i < 2; i++ {
+		_ = cb.ExecuteWithContext(context.Background(), func() error {
+			return errors.New("fail")
+		})
+	}
+
+	// Wait for timeout to transition to half-open
+	time.Sleep(60 * time.Millisecond)
+
+	// First request should be allowed
+	allowed := cb.allowRequest()
+	if !allowed {
+		t.Error("Expected first request to be allowed in half-open state")
+	}
+
+	// Manually transition to half-open if not already
+	cb.stateMutex.Lock()
+	atomic.StoreInt32(&cb.state, int32(CircuitBreakerHalfOpen))
+	cb.stateMutex.Unlock()
+
+	// Increment half-open requests to max
+	atomic.StoreInt32(&cb.halfOpenRequests, int32(config.MaxRequests))
+
+	// Next request should be blocked
+	allowed = cb.allowRequest()
+	if allowed {
+		t.Error("Expected request to be blocked when max half-open requests reached")
+	}
+}

internal/token/cache.go

@@ -134,12 +134,15 @@ func (tc *TokenCache) StartCleanup(interval time.Duration) {
 		return // Already running
 	}
 
+	// Create fresh stop channel for this cleanup session
+	tc.cleanupStop = make(chan bool, 1)
 	tc.cleanupTicker = time.NewTicker(interval)
+	tickerChan := tc.cleanupTicker.C // Capture channel before goroutine starts
 
 	go func() {
 		for {
 			select {
-			case <-tc.cleanupTicker.C:
+			case <-tickerChan:
 				tc.cleanupExpiredTokens()
 			case <-tc.cleanupStop:
 				return
@@ -157,9 +160,11 @@ func (tc *TokenCache) StopCleanup() {
 
 	if tc.cleanupTicker != nil {
 		tc.cleanupTicker.Stop()
+		select {
+		case tc.cleanupStop <- true: // Signal stop
+		default: // Channel might be full or goroutine already stopped
+		}
 		tc.cleanupTicker = nil
-		close(tc.cleanupStop)
-		tc.cleanupStop = make(chan bool)
 		tc.logger.Logf("Stopped token cache cleanup")
 	}
 }

internal/token/cache_test.go

@@ -0,0 +1,511 @@
+//go:build !yaegi
+
+package token
+
+import (
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Mock implementations
+type mockCache struct {
+	data map[string]map[string]interface{}
+	mu   sync.RWMutex
+}
+
+func newMockCache() *mockCache {
+	return &mockCache{
+		data: make(map[string]map[string]interface{}),
+	}
+}
+
+func (m *mockCache) Get(key string) (map[string]interface{}, bool) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	val, exists := m.data[key]
+	return val, exists
+}
+
+func (m *mockCache) Set(key string, value map[string]interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.data[key] = value
+}
+
+func (m *mockCache) Delete(key string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	delete(m.data, key)
+}
+
+type mockLogger struct{}
+
+func (m *mockLogger) Logf(format string, args ...interface{})      {}
+func (m *mockLogger) ErrorLogf(format string, args ...interface{}) {}
+
+type mockMetrics struct{}
+
+func (m *mockMetrics) RecordTokenRefresh()      {}
+func (m *mockMetrics) RecordTokenRefreshError() {}
+
+// TokenCache tests
+func TestNewTokenCache(t *testing.T) {
+	cache := newMockCache()
+	blacklist := newMockCache()
+	logger := &mockLogger{}
+	metrics := &mockMetrics{}
+
+	tokenCache := NewTokenCache(cache, blacklist, logger, metrics, 5*time.Minute)
+
+	if tokenCache == nil {
+		t.Fatal("Expected NewTokenCache to return non-nil")
+	}
+
+	if tokenCache.cache == nil {
+		t.Error("Expected cache to be set")
+	}
+
+	if tokenCache.maxTTL != 5*time.Minute {
+		t.Error("Expected maxTTL to be 5 minutes")
+	}
+}
+
+func TestTokenCache_CacheToken(t *testing.T) {
+	cache := newMockCache()
+	blacklist := newMockCache()
+	logger := &mockLogger{}
+	metrics := &mockMetrics{}
+	tokenCache := NewTokenCache(cache, blacklist, logger, metrics, 5*time.Minute)
+
+	claims := map[string]interface{}{
+		"sub": "user123",
+		"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
+	}
+
+	tokenCache.CacheToken("test-token", claims)
+
+	// Verify it was cached with metadata
+	stored, exists := cache.Get("test-token")
+	if !exists {
+		t.Error("Expected token to be cached")
+	}
+
+	if stored["sub"] != "user123" {
+		t.Error("Expected sub claim to be preserved")
+	}
+
+	if _, ok := stored["_cached_at"]; !ok {
+		t.Error("Expected _cached_at metadata to be added")
+	}
+}
+
+func TestTokenCache_CacheToken_EmptyToken(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	claims := map[string]interface{}{"sub": "user"}
+
+	// Should not cache empty token
+	tokenCache.CacheToken("", claims)
+
+	if len(cache.data) != 0 {
+		t.Error("Expected empty token not to be cached")
+	}
+}
+
+func TestTokenCache_CacheToken_EmptyClaims(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	// Should not cache with empty claims
+	tokenCache.CacheToken("test-token", map[string]interface{}{})
+
+	if len(cache.data) != 0 {
+		t.Error("Expected token with empty claims not to be cached")
+	}
+}
+
+func TestTokenCache_GetCachedToken(t *testing.T) {
+	cache := newMockCache()
+	blacklist := newMockCache()
+	tokenCache := NewTokenCache(cache, blacklist, &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	claims := map[string]interface{}{
+		"sub": "user123",
+		"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
+	}
+
+	tokenCache.CacheToken("test-token", claims)
+
+	// Retrieve token
+	retrieved, exists := tokenCache.GetCachedToken("test-token")
+	if !exists {
+		t.Error("Expected cached token to be found")
+	}
+
+	if retrieved["sub"] != "user123" {
+		t.Error("Expected sub claim to match")
+	}
+}
+
+func TestTokenCache_GetCachedToken_Expired(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	// Add expired token
+	expiredClaims := map[string]interface{}{
+		"sub": "user",
+		"exp": float64(time.Now().Add(-1 * time.Hour).Unix()),
+	}
+
+	tokenCache.CacheToken("expired-token", expiredClaims)
+
+	// Should not return expired token
+	_, exists := tokenCache.GetCachedToken("expired-token")
+	if exists {
+		t.Error("Expected expired token not to be returned")
+	}
+}
+
+func TestTokenCache_GetCachedToken_ExceedsMaxTTL(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 1*time.Millisecond)
+
+	claims := map[string]interface{}{
+		"sub":        "user",
+		"exp":        float64(time.Now().Add(1 * time.Hour).Unix()),
+		"_cached_at": time.Now().Add(-10 * time.Minute).Unix(),
+	}
+
+	cache.Set("old-token", claims)
+
+	// Should not return token that exceeds maxTTL
+	_, exists := tokenCache.GetCachedToken("old-token")
+	if exists {
+		t.Error("Expected token exceeding maxTTL not to be returned")
+	}
+}
+
+func TestTokenCache_GetCachedToken_Blacklisted(t *testing.T) {
+	cache := newMockCache()
+	blacklist := newMockCache()
+	tokenCache := NewTokenCache(cache, blacklist, &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	claims := map[string]interface{}{
+		"sub": "user",
+		"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
+	}
+
+	tokenCache.CacheToken("token", claims)
+
+	// Blacklist the token
+	blacklist.Set("token", map[string]interface{}{"reason": "test"})
+
+	// Should not return blacklisted token
+	_, exists := tokenCache.GetCachedToken("token")
+	if exists {
+		t.Error("Expected blacklisted token not to be returned")
+	}
+}
+
+func TestTokenCache_InvalidateToken(t *testing.T) {
+	cache := newMockCache()
+	blacklist := newMockCache()
+	tokenCache := NewTokenCache(cache, blacklist, &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	claims := map[string]interface{}{
+		"sub": "user",
+	}
+
+	tokenCache.CacheToken("token", claims)
+
+	// Invalidate
+	tokenCache.InvalidateToken("token")
+
+	// Should be removed from cache
+	_, exists := cache.Get("token")
+	if exists {
+		t.Error("Expected token to be removed from cache")
+	}
+
+	// Should be in blacklist
+	_, blacklisted := blacklist.Get("token")
+	if !blacklisted {
+		t.Error("Expected token to be blacklisted")
+	}
+}
+
+func TestTokenCache_StartStopCleanup(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	// Start cleanup
+	tokenCache.StartCleanup(100 * time.Millisecond)
+
+	// Verify ticker is set
+	if tokenCache.cleanupTicker == nil {
+		t.Error("Expected cleanup ticker to be started")
+	}
+
+	// Stop cleanup
+	tokenCache.StopCleanup()
+
+	// Wait briefly for cleanup to stop
+	time.Sleep(50 * time.Millisecond)
+
+	// Ticker should be nil after stop
+	if tokenCache.cleanupTicker != nil {
+		t.Error("Expected cleanup ticker to be stopped")
+	}
+}
+
+func TestTokenCache_StartCleanup_AlreadyRunning(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	// Start cleanup
+	tokenCache.StartCleanup(100 * time.Millisecond)
+	ticker1 := tokenCache.cleanupTicker
+
+	// Start again (should not create new ticker)
+	tokenCache.StartCleanup(100 * time.Millisecond)
+	ticker2 := tokenCache.cleanupTicker
+
+	if ticker1 != ticker2 {
+		t.Error("Expected same ticker when starting cleanup while already running")
+	}
+
+	tokenCache.StopCleanup()
+}
+
+// TokenBlacklist tests
+func TestNewTokenBlacklist(t *testing.T) {
+	blacklist := newMockCache()
+	logger := &mockLogger{}
+
+	tb := NewTokenBlacklist(blacklist, logger)
+
+	if tb == nil {
+		t.Fatal("Expected NewTokenBlacklist to return non-nil")
+	}
+
+	if tb.blacklist == nil {
+		t.Error("Expected blacklist to be set")
+	}
+}
+
+func TestTokenBlacklist_Add(t *testing.T) {
+	blacklist := newMockCache()
+	tb := NewTokenBlacklist(blacklist, &mockLogger{})
+
+	tb.Add("test-token", "test_reason")
+
+	// Verify token was blacklisted
+	data, exists := blacklist.Get("test-token")
+	if !exists {
+		t.Error("Expected token to be blacklisted")
+	}
+
+	if data["reason"] != "test_reason" {
+		t.Error("Expected reason to be stored")
+	}
+}
+
+func TestTokenBlacklist_AddJTI(t *testing.T) {
+	blacklist := newMockCache()
+	tb := NewTokenBlacklist(blacklist, &mockLogger{})
+
+	tb.AddJTI("jti-123")
+
+	// Verify JTI was blacklisted
+	data, exists := blacklist.Get("jti-123")
+	if !exists {
+		t.Error("Expected JTI to be blacklisted")
+	}
+
+	if data["reason"] != "jti_replay_detection" {
+		t.Error("Expected replay detection reason")
+	}
+}
+
+func TestTokenBlacklist_IsBlacklisted(t *testing.T) {
+	blacklist := newMockCache()
+	tb := NewTokenBlacklist(blacklist, &mockLogger{})
+
+	tb.Add("blacklisted-token", "test")
+
+	if !tb.IsBlacklisted("blacklisted-token") {
+		t.Error("Expected token to be blacklisted")
+	}
+
+	if tb.IsBlacklisted("not-blacklisted") {
+		t.Error("Expected token not to be blacklisted")
+	}
+}
+
+func TestTokenBlacklist_IsJTIBlacklisted(t *testing.T) {
+	blacklist := newMockCache()
+	tb := NewTokenBlacklist(blacklist, &mockLogger{})
+
+	tb.AddJTI("jti-123")
+
+	if !tb.IsJTIBlacklisted("jti-123") {
+		t.Error("Expected JTI to be blacklisted")
+	}
+
+	if tb.IsJTIBlacklisted("jti-456") {
+		t.Error("Expected JTI not to be blacklisted")
+	}
+}
+
+// TokenRevocationManager tests
+func TestNewTokenRevocationManager(t *testing.T) {
+	blacklist := NewTokenBlacklist(newMockCache(), &mockLogger{})
+	httpClient := &http.Client{}
+
+	trm := NewTokenRevocationManager("client-id", "secret", "https://revoke.url", httpClient, &mockLogger{}, blacklist)
+
+	if trm == nil {
+		t.Fatal("Expected NewTokenRevocationManager to return non-nil")
+	}
+
+	if trm.clientID != "client-id" {
+		t.Error("Expected clientID to be set")
+	}
+}
+
+func TestTokenRevocationManager_RevokeToken(t *testing.T) {
+	blacklist := NewTokenBlacklist(newMockCache(), &mockLogger{})
+	trm := NewTokenRevocationManager("client-id", "secret", "https://revoke.url", &http.Client{}, &mockLogger{}, blacklist)
+
+	err := trm.RevokeToken("test-token", "access_token", false)
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	// Token should be in blacklist
+	if !blacklist.IsBlacklisted("test-token") {
+		t.Error("Expected token to be blacklisted")
+	}
+}
+
+// Race condition tests
+func TestTokenCache_ConcurrentAccess(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	var wg sync.WaitGroup
+	iterations := 100
+
+	// Concurrent cache operations
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			claims := map[string]interface{}{
+				"sub": idx,
+				"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
+			}
+			token := string(rune('A' + idx%26))
+			tokenCache.CacheToken(token, claims)
+		}(i)
+	}
+
+	// Concurrent retrieve operations
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			token := string(rune('A' + idx%26))
+			_, _ = tokenCache.GetCachedToken(token)
+		}(i)
+	}
+
+	// Concurrent invalidations
+	for i := 0; i < iterations; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			token := string(rune('A' + idx%26))
+			tokenCache.InvalidateToken(token)
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestTokenBlacklist_ConcurrentAccess(t *testing.T) {
+	blacklist := newMockCache()
+	tb := NewTokenBlacklist(blacklist, &mockLogger{})
+
+	var wg sync.WaitGroup
+
+	// Concurrent adds
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			tb.Add(string(rune('A'+idx%26)), "test")
+		}(i)
+	}
+
+	// Concurrent checks
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			_ = tb.IsBlacklisted(string(rune('A' + idx%26)))
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestTokenCache_CleanupWithConcurrentOperations(t *testing.T) {
+	cache := newMockCache()
+	tokenCache := NewTokenCache(cache, newMockCache(), &mockLogger{}, &mockMetrics{}, 5*time.Minute)
+
+	var wg sync.WaitGroup
+	stopFlag := atomic.Bool{}
+
+	// Start cleanup
+	tokenCache.StartCleanup(50 * time.Millisecond)
+
+	// Goroutine adding tokens
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for i := 0; !stopFlag.Load() && i < 50; i++ {
+			claims := map[string]interface{}{
+				"sub": i,
+				"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
+			}
+			tokenCache.CacheToken(string(rune('A'+i%26)), claims)
+			time.Sleep(10 * time.Millisecond)
+		}
+	}()
+
+	// Goroutine invalidating tokens
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for i := 0; !stopFlag.Load() && i < 30; i++ {
+			tokenCache.InvalidateToken(string(rune('A' + i%26)))
+			time.Sleep(15 * time.Millisecond)
+		}
+	}()
+
+	// Let it run for a bit
+	time.Sleep(300 * time.Millisecond)
+	stopFlag.Store(true)
+
+	wg.Wait()
+
+	// Stop cleanup
+	tokenCache.StopCleanup()
+
+	// Should not have panicked
+}

internal/token/introspector_test.go

@@ -0,0 +1,279 @@
+//go:build !yaegi
+
+package token
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// Introspector tests
+func TestNewIntrospector(t *testing.T) {
+	introspector := NewIntrospector(
+		"client-id",
+		"client-secret",
+		"https://provider.example.com/introspect",
+		&http.Client{},
+		&mockLogger{},
+		[]string{"groups"},
+		[]string{"roles"},
+		"",
+	)
+
+	if introspector == nil {
+		t.Fatal("Expected NewIntrospector to return non-nil")
+	}
+
+	if introspector.clientID != "client-id" {
+		t.Error("Expected clientID to be set")
+	}
+
+	if introspector.clientSecret != "client-secret" {
+		t.Error("Expected clientSecret to be set")
+	}
+
+	if introspector.introspectionURL != "https://provider.example.com/introspect" {
+		t.Error("Expected introspectionURL to be set")
+	}
+
+	if len(introspector.groupsClaimPath) != 1 || introspector.groupsClaimPath[0] != "groups" {
+		t.Error("Expected groupsClaimPath to be set")
+	}
+
+	if len(introspector.rolesClaimPath) != 1 || introspector.rolesClaimPath[0] != "roles" {
+		t.Error("Expected rolesClaimPath to be set")
+	}
+}
+
+func TestIntrospector_IntrospectToken_NoEndpoint(t *testing.T) {
+	introspector := NewIntrospector(
+		"client-id",
+		"client-secret",
+		"", // No introspection endpoint
+		&http.Client{},
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	_, err := introspector.IntrospectToken("token", "")
+	if err == nil {
+		t.Error("Expected error when introspection endpoint not configured")
+	}
+
+	if err.Error() != "introspection endpoint not configured" {
+		t.Errorf("Expected configuration error, got: %v", err)
+	}
+}
+
+func TestIntrospector_IntrospectToken_Success(t *testing.T) {
+	// Create a test server
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" {
+			t.Errorf("Expected POST request, got %s", r.Method)
+		}
+
+		if err := r.ParseForm(); err != nil {
+			t.Errorf("Failed to parse form: %v", err)
+		}
+
+		// Verify parameters
+		if r.FormValue("token") != "test-token" {
+			t.Error("Expected token parameter")
+		}
+
+		if r.FormValue("token_type_hint") != "access_token" {
+			t.Error("Expected token_type_hint parameter")
+		}
+
+		if r.FormValue("client_id") != "test-client" {
+			t.Error("Expected client_id parameter")
+		}
+
+		// Return valid introspection response
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{
+			"active": true,
+			"scope": "openid profile email",
+			"client_id": "test-client",
+			"username": "testuser",
+			"token_type": "Bearer",
+			"exp": 1234567890,
+			"iat": 1234567800,
+			"sub": "user123",
+			"aud": "test-audience",
+			"iss": "https://issuer.example.com",
+			"custom_claim": "custom_value"
+		}`))
+	}))
+	defer server.Close()
+
+	introspector := NewIntrospector(
+		"test-client",
+		"test-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	resp, err := introspector.IntrospectToken("test-token", "access_token")
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if !resp.Active {
+		t.Error("Expected token to be active")
+	}
+
+	if resp.Scope != "openid profile email" {
+		t.Errorf("Expected scope 'openid profile email', got '%s'", resp.Scope)
+	}
+
+	if resp.ClientID != "test-client" {
+		t.Errorf("Expected client_id 'test-client', got '%s'", resp.ClientID)
+	}
+
+	if resp.Username != "testuser" {
+		t.Errorf("Expected username 'testuser', got '%s'", resp.Username)
+	}
+
+	if resp.TokenType != "Bearer" {
+		t.Errorf("Expected token_type 'Bearer', got '%s'", resp.TokenType)
+	}
+
+	// Check extra fields
+	if resp.Extra == nil {
+		t.Fatal("Expected Extra map to be populated")
+	}
+
+	if val, ok := resp.Extra["custom_claim"]; !ok || val != "custom_value" {
+		t.Error("Expected custom_claim in Extra fields")
+	}
+
+	// Standard fields should not be in Extra
+	if _, ok := resp.Extra["active"]; ok {
+		t.Error("Standard field 'active' should not be in Extra")
+	}
+}
+
+func TestIntrospector_IntrospectToken_HTTPError(t *testing.T) {
+	// Create a test server that returns an error
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+		w.Write([]byte(`{"error":"invalid_token"}`))
+	}))
+	defer server.Close()
+
+	introspector := NewIntrospector(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	_, err := introspector.IntrospectToken("bad-token", "")
+	if err == nil {
+		t.Error("Expected error for HTTP 401 response")
+	}
+}
+
+func TestIntrospector_IntrospectToken_InvalidJSON(t *testing.T) {
+	// Create a test server that returns invalid JSON
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{invalid json`))
+	}))
+	defer server.Close()
+
+	introspector := NewIntrospector(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	_, err := introspector.IntrospectToken("token", "")
+	if err == nil {
+		t.Error("Expected error for invalid JSON response")
+	}
+}
+
+func TestIntrospector_IntrospectToken_NoTokenTypeHint(t *testing.T) {
+	// Test that token_type_hint is optional
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := r.ParseForm(); err != nil {
+			t.Errorf("Failed to parse form: %v", err)
+		}
+
+		// Verify token_type_hint is not set when empty
+		if r.FormValue("token_type_hint") != "" {
+			t.Error("Expected no token_type_hint when not provided")
+		}
+
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"active":true}`))
+	}))
+	defer server.Close()
+
+	introspector := NewIntrospector(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	_, err := introspector.IntrospectToken("token", "") // Empty token type hint
+	if err != nil {
+		t.Errorf("Expected no error, got: %v", err)
+	}
+}
+
+func TestIntrospector_DetectTokenType_IDToken_AudienceString(t *testing.T) {
+	_ = NewIntrospector(
+		"test-client",
+		"client-secret",
+		"https://introspect.example.com",
+		&http.Client{},
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	// Mock JWT with audience matching client ID
+	// Note: parseJWT is a package-level function that we can't easily mock,
+	// so this test validates the logic assuming parseJWT works
+	// We'll test the DetectTokenType method indirectly
+
+	// This test would require mocking parseJWT which is complex
+	// Skip for now or implement when parseJWT is mockable
+	t.Skip("Requires parseJWT mocking - tested indirectly through integration")
+}
+
+func TestIntrospector_DetectTokenType_AccessToken_Scope(t *testing.T) {
+	// Similar to above - requires parseJWT mocking
+	t.Skip("Requires parseJWT mocking - tested indirectly through integration")
+}
+
+func TestIntrospector_ExtractGroupsAndRoles(t *testing.T) {
+	// Requires parseJWT mocking
+	t.Skip("Requires parseJWT mocking - tested indirectly through integration")
+}

internal/token/refresher_test.go

@@ -0,0 +1,351 @@
+//go:build !yaegi
+
+package token
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// Mock implementations for refresher tests
+type mockSessionManager struct{}
+
+func (m *mockSessionManager) GetSession(sessionID string) (SessionDataInterface, error) {
+	return nil, nil
+}
+
+func (m *mockSessionManager) SaveSession(session SessionDataInterface) error {
+	return nil
+}
+
+type mockSessionData struct {
+	idToken      string
+	accessToken  string
+	refreshToken string
+	idExpiry     time.Time
+	accessExpiry time.Time
+	saveErr      error
+}
+
+func (m *mockSessionData) GetIDToken() string {
+	return m.idToken
+}
+
+func (m *mockSessionData) GetAccessToken() string {
+	return m.accessToken
+}
+
+func (m *mockSessionData) GetRefreshToken() string {
+	return m.refreshToken
+}
+
+func (m *mockSessionData) GetIDTokenExpiry() time.Time {
+	return m.idExpiry
+}
+
+func (m *mockSessionData) GetAccessTokenExpiry() time.Time {
+	return m.accessExpiry
+}
+
+func (m *mockSessionData) SetTokens(idToken, accessToken, refreshToken string, idExp, accessExp time.Time) {
+	m.idToken = idToken
+	m.accessToken = accessToken
+	m.refreshToken = refreshToken
+	m.idExpiry = idExp
+	m.accessExpiry = accessExp
+}
+
+func (m *mockSessionData) SetIDToken(token string, expiry time.Time) {
+	m.idToken = token
+	m.idExpiry = expiry
+}
+
+func (m *mockSessionData) SetAccessToken(token string, expiry time.Time) {
+	m.accessToken = token
+	m.accessExpiry = expiry
+}
+
+func (m *mockSessionData) SetRefreshToken(token string) {
+	m.refreshToken = token
+}
+
+func (m *mockSessionData) SaveToCache() error {
+	return m.saveErr
+}
+
+type mockTokenVerifier struct {
+	shouldFail bool
+}
+
+func (m *mockTokenVerifier) VerifyToken(token string) error {
+	if m.shouldFail {
+		return fmt.Errorf("token verification failed")
+	}
+	return nil
+}
+
+// Refresher tests
+func TestNewRefresher(t *testing.T) {
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		"https://provider.example.com/token",
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	if refresher == nil {
+		t.Fatal("Expected NewRefresher to return non-nil")
+	}
+
+	if refresher.clientID != "client-id" {
+		t.Error("Expected clientID to be set")
+	}
+
+	if refresher.clientSecret != "client-secret" {
+		t.Error("Expected clientSecret to be set")
+	}
+
+	if refresher.tokenURL != "https://provider.example.com/token" {
+		t.Error("Expected tokenURL to be set")
+	}
+}
+
+func TestRefresher_RefreshToken_NilSession(t *testing.T) {
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		"https://provider.example.com/token",
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	result := refresher.RefreshToken(nil, nil, nil)
+	if result {
+		t.Error("Expected RefreshToken to return false for nil session")
+	}
+}
+
+func TestRefresher_RefreshToken_NoRefreshToken(t *testing.T) {
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		"https://provider.example.com/token",
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	session := &mockSessionData{
+		refreshToken: "", // No refresh token
+	}
+
+	result := refresher.RefreshToken(nil, nil, session)
+	if result {
+		t.Error("Expected RefreshToken to return false when no refresh token available")
+	}
+}
+
+func TestRefresher_ExchangeToken_UnsupportedGrantType(t *testing.T) {
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		"https://provider.example.com/token",
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	_, err := refresher.exchangeToken("unsupported_grant", "token", "", "")
+	if err == nil {
+		t.Error("Expected error for unsupported grant type")
+	}
+
+	if err.Error() != "unsupported grant type: unsupported_grant" {
+		t.Errorf("Expected unsupported grant type error, got: %v", err)
+	}
+}
+
+func TestRefresher_ExchangeToken_RefreshToken_RequestCreation(t *testing.T) {
+	// Test with valid refresh_token grant type but invalid URL to test request creation
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		"://invalid-url", // Invalid URL
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	_, err := refresher.exchangeToken("refresh_token", "refresh-token-value", "", "")
+	if err == nil {
+		t.Error("Expected error for invalid URL")
+	}
+}
+
+func TestRefresher_ExchangeToken_AuthorizationCode_WithPKCE(t *testing.T) {
+	// Create a test server that verifies the request
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" {
+			t.Errorf("Expected POST request, got %s", r.Method)
+		}
+
+		if err := r.ParseForm(); err != nil {
+			t.Errorf("Failed to parse form: %v", err)
+		}
+
+		// Verify PKCE parameters are included
+		if r.FormValue("code_verifier") != "test-verifier" {
+			t.Error("Expected code_verifier to be included")
+		}
+
+		if r.FormValue("code") != "auth-code" {
+			t.Error("Expected authorization code to be included")
+		}
+
+		if r.FormValue("grant_type") != "authorization_code" {
+			t.Error("Expected grant_type to be authorization_code")
+		}
+
+		// Return valid token response
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"access_token":"test-access","id_token":"test-id","expires_in":3600}`))
+	}))
+	defer server.Close()
+
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	resp, err := refresher.exchangeToken("authorization_code", "auth-code", "https://callback.example.com", "test-verifier")
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if resp.AccessToken != "test-access" {
+		t.Errorf("Expected access token 'test-access', got '%s'", resp.AccessToken)
+	}
+
+	if resp.IDToken != "test-id" {
+		t.Errorf("Expected ID token 'test-id', got '%s'", resp.IDToken)
+	}
+
+	if resp.ExpiresIn != 3600 {
+		t.Errorf("Expected expires_in 3600, got %d", resp.ExpiresIn)
+	}
+}
+
+func TestRefresher_ExchangeToken_HTTPError(t *testing.T) {
+	// Create a test server that returns an error
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+		w.Write([]byte(`{"error":"invalid_grant"}`))
+	}))
+	defer server.Close()
+
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	_, err := refresher.exchangeToken("refresh_token", "bad-token", "", "")
+	if err == nil {
+		t.Error("Expected error for HTTP 401 response")
+	}
+}
+
+func TestRefresher_ExchangeToken_InvalidJSON(t *testing.T) {
+	// Create a test server that returns invalid JSON
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{invalid json`))
+	}))
+	defer server.Close()
+
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	_, err := refresher.exchangeToken("refresh_token", "token", "", "")
+	if err == nil {
+		t.Error("Expected error for invalid JSON response")
+	}
+}
+
+func TestRefresher_GetNewTokenWithRefreshToken(t *testing.T) {
+	// Create a test server
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"access_token":"new-access","refresh_token":"new-refresh","expires_in":3600}`))
+	}))
+	defer server.Close()
+
+	refresher := NewRefresher(
+		"client-id",
+		"client-secret",
+		server.URL,
+		&http.Client{},
+		&mockLogger{},
+		&mockMetrics{},
+		&mockSessionManager{},
+		newMockCache(),
+		&mockTokenVerifier{},
+	)
+
+	resp, err := refresher.GetNewTokenWithRefreshToken("old-refresh")
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if resp.AccessToken != "new-access" {
+		t.Error("Expected new access token")
+	}
+
+	if resp.RefreshToken != "new-refresh" {
+		t.Error("Expected new refresh token")
+	}
+}

internal/token/token_boost_test.go

@@ -0,0 +1,574 @@
+//go:build !yaegi
+
+package token
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// Helper function to create a simple JWT token for testing
+func createTestJWT(header, claims map[string]interface{}) string {
+	headerJSON, _ := json.Marshal(header)
+	claimsJSON, _ := json.Marshal(claims)
+
+	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
+	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)
+
+	// Use fake signature
+	return headerB64 + "." + claimsB64 + ".fake-signature"
+}
+
+// parseJWT Tests
+func TestParseJWT_Valid(t *testing.T) {
+	header := map[string]interface{}{"alg": "RS256", "typ": "JWT"}
+	claims := map[string]interface{}{"sub": "user123", "aud": "client-id"}
+	token := createTestJWT(header, claims)
+
+	jwt, err := parseJWT(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if jwt == nil {
+		t.Fatal("Expected non-nil JWT")
+	}
+
+	if jwt.Header["alg"] != "RS256" {
+		t.Error("Expected alg to be RS256")
+	}
+
+	if jwt.Claims["sub"] != "user123" {
+		t.Error("Expected sub to be user123")
+	}
+}
+
+func TestParseJWT_InvalidFormat(t *testing.T) {
+	// Token with wrong number of parts
+	_, err := parseJWT("invalid.token")
+	if err == nil {
+		t.Error("Expected error for invalid token format")
+	}
+
+	if !strings.Contains(err.Error(), "expected 3 parts") {
+		t.Errorf("Expected error about parts, got: %v", err)
+	}
+}
+
+func TestParseJWT_InvalidBase64(t *testing.T) {
+	// Token with invalid base64
+	_, err := parseJWT("!@#$%^.invalid.base64")
+	if err == nil {
+		t.Error("Expected error for invalid base64")
+	}
+}
+
+// decodeSegment Tests
+func TestDecodeSegment_Valid(t *testing.T) {
+	data := map[string]interface{}{
+		"field1": "value1",
+		"field2": 123,
+	}
+	jsonData, _ := json.Marshal(data)
+	encoded := base64.RawURLEncoding.EncodeToString(jsonData)
+
+	result, err := decodeSegment(encoded)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if result["field1"] != "value1" {
+		t.Error("Expected field1 to be value1")
+	}
+
+	if result["field2"].(float64) != 123 {
+		t.Error("Expected field2 to be 123")
+	}
+}
+
+func TestDecodeSegment_WithPadding(t *testing.T) {
+	// Create data that needs padding
+	data := map[string]interface{}{"test": "value"}
+	jsonData, _ := json.Marshal(data)
+	// Use standard encoding to get padded version
+	encoded := base64.URLEncoding.EncodeToString(jsonData)
+	// Remove padding to test the function adds it back
+	encoded = strings.TrimRight(encoded, "=")
+
+	result, err := decodeSegment(encoded)
+	if err != nil {
+		t.Fatalf("Expected no error with unpadded segment, got: %v", err)
+	}
+
+	if result["test"] != "value" {
+		t.Error("Expected test to be value")
+	}
+}
+
+func TestDecodeSegment_InvalidBase64(t *testing.T) {
+	_, err := decodeSegment("!@#$%^&*()")
+	if err == nil {
+		t.Error("Expected error for invalid base64")
+	}
+}
+
+func TestDecodeSegment_InvalidJSON(t *testing.T) {
+	// Valid base64 but invalid JSON
+	invalid := base64.RawURLEncoding.EncodeToString([]byte("{invalid json"))
+	_, err := decodeSegment(invalid)
+	if err == nil {
+		t.Error("Expected error for invalid JSON")
+	}
+}
+
+// DetectTokenType Tests
+func TestDetectTokenType_IDToken_StringAudience(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"https://introspect.example.com",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"aud": "test-client", // Matches clientID
+		"sub": "user123",
+	}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "id_token" {
+		t.Errorf("Expected 'id_token', got '%s'", tokenType)
+	}
+}
+
+func TestDetectTokenType_IDToken_ArrayAudience(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"aud": []interface{}{"test-client", "other-client"},
+		"sub": "user123",
+	}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "id_token" {
+		t.Errorf("Expected 'id_token', got '%s'", tokenType)
+	}
+}
+
+func TestDetectTokenType_AccessToken_Scope(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"scope": "openid profile email",
+		"sub":   "user123",
+	}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "access_token" {
+		t.Errorf("Expected 'access_token', got '%s'", tokenType)
+	}
+}
+
+func TestDetectTokenType_IDToken_TokenUse(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"token_use": "id",
+		"sub":       "user123",
+	}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "id_token" {
+		t.Errorf("Expected 'id_token', got '%s'", tokenType)
+	}
+}
+
+func TestDetectTokenType_AccessToken_TokenUse(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"token_use": "access",
+		"sub":       "user123",
+	}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "access_token" {
+		t.Errorf("Expected 'access_token', got '%s'", tokenType)
+	}
+}
+
+func TestDetectTokenType_AccessToken_TypHeader(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256", "typ": "at+jwt"}
+	claims := map[string]interface{}{"sub": "user123"}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "access_token" {
+		t.Errorf("Expected 'access_token', got '%s'", tokenType)
+	}
+}
+
+func TestDetectTokenType_Unknown(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		nil,
+		nil,
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{"sub": "user123"}
+	token := createTestJWT(header, claims)
+
+	tokenType, err := introspector.DetectTokenType(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if tokenType != "unknown" {
+		t.Errorf("Expected 'unknown', got '%s'", tokenType)
+	}
+}
+
+// ExtractGroupsAndRoles Tests
+func TestExtractGroupsAndRoles_SimpleArrays(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		[]string{"groups"},
+		[]string{"roles"},
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"sub":    "user123",
+		"groups": []interface{}{"group1", "group2", "group3"},
+		"roles":  []interface{}{"role1", "role2"},
+	}
+	token := createTestJWT(header, claims)
+
+	groups, roles, err := introspector.ExtractGroupsAndRoles(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if len(groups) != 3 {
+		t.Errorf("Expected 3 groups, got %d", len(groups))
+	}
+
+	if len(roles) != 2 {
+		t.Errorf("Expected 2 roles, got %d", len(roles))
+	}
+
+	if groups[0] != "group1" {
+		t.Errorf("Expected first group to be 'group1', got '%s'", groups[0])
+	}
+}
+
+func TestExtractGroupsAndRoles_NestedClaims(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		[]string{"resource_access", "account", "roles"},
+		[]string{"realm_access", "roles"},
+		"",
+	)
+
+	header := map[string]interface{}{"alg": "RS256"}
+	claims := map[string]interface{}{
+		"sub": "user123",
+		"resource_access": map[string]interface{}{
+			"account": map[string]interface{}{
+				"roles": []interface{}{"manage-account", "view-profile"},
+			},
+		},
+		"realm_access": map[string]interface{}{
+			"roles": []interface{}{"admin", "user"},
+		},
+	}
+	token := createTestJWT(header, claims)
+
+	groups, roles, err := introspector.ExtractGroupsAndRoles(token)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+
+	if len(groups) != 2 {
+		t.Errorf("Expected 2 groups, got %d", len(groups))
+	}
+
+	if len(roles) != 2 {
+		t.Errorf("Expected 2 roles, got %d", len(roles))
+	}
+}
+
+func TestExtractGroupsAndRoles_InvalidToken(t *testing.T) {
+	introspector := NewIntrospector(
+		"test-client",
+		"secret",
+		"",
+		nil,
+		&mockLogger{},
+		[]string{"groups"},
+		[]string{"roles"},
+		"",
+	)
+
+	_, _, err := introspector.ExtractGroupsAndRoles("invalid.token")
+	if err == nil {
+		t.Error("Expected error for invalid token")
+	}
+}
+
+// extractStringSlice Tests (indirect via Introspector)
+func TestExtractStringSlice_StringArray(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	val := []interface{}{"value1", "value2", "value3"}
+	result := introspector.extractStringSlice(val)
+
+	if len(result) != 3 {
+		t.Errorf("Expected 3 values, got %d", len(result))
+	}
+
+	if result[0] != "value1" {
+		t.Errorf("Expected 'value1', got '%s'", result[0])
+	}
+}
+
+func TestExtractStringSlice_StringSlice(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	val := []string{"a", "b", "c"}
+	result := introspector.extractStringSlice(val)
+
+	if len(result) != 3 {
+		t.Errorf("Expected 3 values, got %d", len(result))
+	}
+}
+
+func TestExtractStringSlice_SingleString(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	result := introspector.extractStringSlice("single-value")
+
+	if len(result) != 1 {
+		t.Errorf("Expected 1 value, got %d", len(result))
+	}
+
+	if result[0] != "single-value" {
+		t.Errorf("Expected 'single-value', got '%s'", result[0])
+	}
+}
+
+func TestExtractStringSlice_CommaSeparated(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	result := introspector.extractStringSlice("value1,value2,value3")
+
+	if len(result) != 3 {
+		t.Errorf("Expected 3 values, got %d", len(result))
+	}
+
+	if result[0] != "value1" {
+		t.Errorf("Expected 'value1', got '%s'", result[0])
+	}
+}
+
+func TestExtractStringSlice_EmptyString(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	result := introspector.extractStringSlice("")
+
+	if result != nil {
+		t.Errorf("Expected nil for empty string, got %v", result)
+	}
+}
+
+func TestExtractStringSlice_InvalidType(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	result := introspector.extractStringSlice(12345)
+
+	if result != nil {
+		t.Errorf("Expected nil for invalid type, got %v", result)
+	}
+}
+
+// extractClaimValues Tests (indirect via Introspector)
+func TestExtractClaimValues_SimplePath(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	claims := map[string]interface{}{
+		"roles": []interface{}{"admin", "user"},
+	}
+
+	result := introspector.extractClaimValues(claims, []string{"roles"})
+
+	if len(result) != 2 {
+		t.Errorf("Expected 2 values, got %d", len(result))
+	}
+}
+
+func TestExtractClaimValues_NestedPath(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	claims := map[string]interface{}{
+		"resource": map[string]interface{}{
+			"account": map[string]interface{}{
+				"roles": []interface{}{"role1", "role2"},
+			},
+		},
+	}
+
+	result := introspector.extractClaimValues(claims, []string{"resource", "account", "roles"})
+
+	if len(result) != 2 {
+		t.Errorf("Expected 2 values, got %d", len(result))
+	}
+}
+
+func TestExtractClaimValues_EmptyPath(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	claims := map[string]interface{}{"roles": []interface{}{"admin"}}
+
+	result := introspector.extractClaimValues(claims, []string{})
+
+	if result != nil {
+		t.Errorf("Expected nil for empty path, got %v", result)
+	}
+}
+
+func TestExtractClaimValues_PathNotFound(t *testing.T) {
+	introspector := NewIntrospector("", "", "", nil, &mockLogger{}, nil, nil, "")
+
+	claims := map[string]interface{}{"other": "value"}
+
+	result := introspector.extractClaimValues(claims, []string{"roles"})
+
+	if len(result) != 0 {
+		t.Errorf("Expected 0 values for missing path, got %d", len(result))
+	}
+}
+
+// TokenRevocationManager revokeWithProvider test
+func TestTokenRevocationManager_RevokeWithProvider(t *testing.T) {
+	logger := &mockLogger{}
+	cache := newMockCache()
+	blacklist := NewTokenBlacklist(cache, logger)
+	trm := NewTokenRevocationManager(
+		"client-id",
+		"client-secret",
+		"https://provider.example.com/revoke",
+		nil, // http client
+		logger,
+		blacklist,
+	)
+
+	// This function is a simplified placeholder that just logs
+	err := trm.revokeWithProvider("test-token", "access_token")
+	if err != nil {
+		t.Errorf("Expected no error, got: %v", err)
+	}
+
+	// Just verify it doesn't panic - mockLogger doesn't track logs
+}

internal/token/validator_test.go

@@ -0,0 +1,684 @@
+//go:build !yaegi
+
+package token
+
+import (
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+)
+
+// Mock implementations for validator tests
+type mockTokenCache struct {
+	data map[string]map[string]interface{}
+	mu   sync.RWMutex
+}
+
+func newMockTokenCache() *mockTokenCache {
+	return &mockTokenCache{
+		data: make(map[string]map[string]interface{}),
+	}
+}
+
+func (m *mockTokenCache) CacheToken(token string, claims map[string]interface{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.data[token] = claims
+}
+
+func (m *mockTokenCache) GetCachedToken(token string) (map[string]interface{}, bool) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	claims, exists := m.data[token]
+	return claims, exists
+}
+
+func (m *mockTokenCache) InvalidateToken(token string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	delete(m.data, token)
+}
+
+func (m *mockTokenCache) StartCleanup(interval time.Duration) {
+	// No-op for tests
+}
+
+func (m *mockTokenCache) StopCleanup() {
+	// No-op for tests
+}
+
+// Validator tests
+func TestNewValidator(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		Audience:       "test-audience",
+		IssuerURL:      "https://issuer.example.com",
+		JwksURL:        "https://issuer.example.com/jwks",
+		TokenCache:     newMockTokenCache(),
+		TokenBlacklist: newMockCache(),
+		TokenTypeCache: newMockCache(),
+		HTTPClient:     &http.Client{},
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	if validator == nil {
+		t.Fatal("Expected NewValidator to return non-nil")
+	}
+
+	if validator.clientID != "test-client" {
+		t.Error("Expected clientID to be set")
+	}
+
+	if validator.audience != "test-audience" {
+		t.Error("Expected audience to be set")
+	}
+
+	if validator.issuerURL != "https://issuer.example.com" {
+		t.Error("Expected issuerURL to be set")
+	}
+}
+
+func TestNewValidator_NilMetadataMu(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID: "test-client",
+		// MetadataMu is nil
+	}
+
+	validator := NewValidator(config)
+
+	if validator.metadataMu != nil {
+		t.Error("Expected metadataMu to be nil when not provided")
+	}
+}
+
+func TestValidator_VerifyToken_EmptyToken(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenCache:     newMockTokenCache(),
+		TokenBlacklist: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	err := validator.VerifyToken("")
+	if err == nil {
+		t.Error("Expected error for empty token")
+	}
+
+	if err.Error() != "invalid JWT format: token is empty" {
+		t.Errorf("Expected empty token error, got: %v", err)
+	}
+}
+
+func TestValidator_VerifyToken_InvalidFormat(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenCache:     newMockTokenCache(),
+		TokenBlacklist: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	// Token with only 2 parts (missing 3rd part)
+	err := validator.VerifyToken("header.payload")
+	if err == nil {
+		t.Error("Expected error for invalid token format")
+	}
+
+	// Token with too many parts
+	err = validator.VerifyToken("part1.part2.part3.part4")
+	if err == nil {
+		t.Error("Expected error for token with too many parts")
+	}
+}
+
+func TestValidator_VerifyToken_TooShort(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenCache:     newMockTokenCache(),
+		TokenBlacklist: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	err := validator.VerifyToken("ab.cd.ef")
+	if err == nil {
+		t.Error("Expected error for too short token")
+	}
+
+	if err.Error() != "token too short to be valid JWT" {
+		t.Errorf("Expected too short error, got: %v", err)
+	}
+}
+
+func TestValidator_DetermineTokenType(t *testing.T) {
+	// Test ID token
+	configID := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+	validatorID := NewValidator(configID)
+
+	jwtID := &JWT{
+		Claims: map[string]interface{}{
+			"nonce": "test-nonce",
+		},
+	}
+
+	tokenType := validatorID.determineTokenType(jwtID)
+	if tokenType != TokenTypeID {
+		t.Errorf("Expected ID token type, got: %s", tokenType)
+	}
+
+	// Test access token with separate validator to avoid cache interference
+	configAccess := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+	validatorAccess := NewValidator(configAccess)
+
+	jwtAccess := &JWT{
+		Header: map[string]interface{}{
+			"typ": "at+jwt",
+		},
+		Claims: map[string]interface{}{},
+	}
+
+	tokenType = validatorAccess.determineTokenType(jwtAccess)
+	if tokenType != TokenTypeAccess {
+		t.Errorf("Expected access token type, got: %s", tokenType)
+	}
+}
+
+func TestValidator_DetectTokenType_Nonce(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"nonce": "test-nonce-123",
+		},
+	}
+
+	isIDToken := validator.detectTokenType(jwt, "test-token")
+	if !isIDToken {
+		t.Error("Expected nonce to indicate ID token")
+	}
+}
+
+func TestValidator_DetectTokenType_AtJwt(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Header: map[string]interface{}{
+			"typ": "at+jwt",
+		},
+		Claims: map[string]interface{}{},
+	}
+
+	isIDToken := validator.detectTokenType(jwt, "test-token")
+	if isIDToken {
+		t.Error("Expected at+jwt type to indicate access token")
+	}
+}
+
+func TestValidator_DetectTokenType_TokenUse(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	// ID token
+	jwtID := &JWT{
+		Claims: map[string]interface{}{
+			"token_use": "id",
+		},
+	}
+
+	if !validator.detectTokenType(jwtID, "test-token-id") {
+		t.Error("Expected token_use=id to indicate ID token")
+	}
+
+	// Access token
+	jwtAccess := &JWT{
+		Claims: map[string]interface{}{
+			"token_use": "access",
+		},
+	}
+
+	if validator.detectTokenType(jwtAccess, "test-token-access") {
+		t.Error("Expected token_use=access to indicate access token")
+	}
+}
+
+func TestValidator_DetectTokenType_Scope(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"scope": "openid profile email",
+		},
+	}
+
+	isIDToken := validator.detectTokenType(jwt, "test-token")
+	if isIDToken {
+		t.Error("Expected scope claim to indicate access token")
+	}
+}
+
+func TestValidator_DetectTokenType_AudienceMatching(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client-id",
+		TokenTypeCache: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	// Single audience matching client ID
+	jwtSingleAud := &JWT{
+		Claims: map[string]interface{}{
+			"aud": "test-client-id",
+		},
+	}
+
+	if !validator.detectTokenType(jwtSingleAud, "test-token-1") {
+		t.Error("Expected matching audience to indicate ID token")
+	}
+
+	// Array audience with matching client ID
+	jwtArrayAud := &JWT{
+		Claims: map[string]interface{}{
+			"aud": []interface{}{"test-client-id"},
+		},
+	}
+
+	if !validator.detectTokenType(jwtArrayAud, "test-token-2") {
+		t.Error("Expected matching audience array to indicate ID token")
+	}
+
+	// Non-matching audience
+	jwtNoMatch := &JWT{
+		Claims: map[string]interface{}{
+			"aud": "different-audience",
+		},
+	}
+
+	if validator.detectTokenType(jwtNoMatch, "test-token-3") {
+		t.Error("Expected non-matching audience to indicate access token")
+	}
+}
+
+func TestValidator_DetectTokenType_Caching(t *testing.T) {
+	cache := newMockCache()
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: cache,
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	token := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.test"
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"nonce": "test",
+		},
+	}
+
+	// First call - should cache
+	isIDToken := validator.detectTokenType(jwt, token)
+	if !isIDToken {
+		t.Error("Expected ID token")
+	}
+
+	// Verify cache was populated
+	cacheKey := token[:32]
+	cached, exists := cache.Get(cacheKey)
+	if !exists {
+		t.Error("Expected token type to be cached")
+	}
+
+	if isID, ok := cached["is_id_token"].(bool); !ok || !isID {
+		t.Error("Expected cached value to be true for ID token")
+	}
+
+	// Modify JWT but use cached value
+	jwt.Claims = map[string]interface{}{
+		"scope": "openid", // Would indicate access token
+	}
+
+	// Should still return cached ID token result
+	isIDToken = validator.detectTokenType(jwt, token)
+	if !isIDToken {
+		t.Error("Expected cached ID token result")
+	}
+}
+
+func TestValidator_CheckJTIBlacklist_Disabled(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:               "test-client",
+		DisableReplayDetection: true,
+		TokenBlacklist:         newMockCache(),
+		MetadataMu:             &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"jti": "blacklisted-jti",
+		},
+	}
+
+	// Should not check blacklist when disabled
+	err := validator.checkJTIBlacklist(jwt, "test-token")
+	if err != nil {
+		t.Errorf("Expected no error when replay detection disabled, got: %v", err)
+	}
+}
+
+func TestValidator_CheckJTIBlacklist_NoJTI(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenBlacklist: newMockCache(),
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			// No JTI claim
+		},
+	}
+
+	err := validator.checkJTIBlacklist(jwt, "test-token")
+	if err != nil {
+		t.Errorf("Expected no error when JTI missing, got: %v", err)
+	}
+}
+
+func TestValidator_AddJTIToBlacklist(t *testing.T) {
+	blacklist := newMockCache()
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenBlacklist: blacklist,
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"jti": "test-jti-123",
+		},
+	}
+
+	validator.addJTIToBlacklist(jwt)
+
+	// Verify JTI was blacklisted
+	data, exists := blacklist.Get("test-jti-123")
+	if !exists {
+		t.Error("Expected JTI to be blacklisted")
+	}
+
+	if reason, ok := data["reason"].(string); !ok || reason != "jti_replay_prevention" {
+		t.Error("Expected JTI blacklist reason to be jti_replay_prevention")
+	}
+}
+
+func TestValidator_AddJTIToBlacklist_Disabled(t *testing.T) {
+	blacklist := newMockCache()
+	config := ValidatorConfig{
+		ClientID:               "test-client",
+		DisableReplayDetection: true,
+		TokenBlacklist:         blacklist,
+		MetadataMu:             &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"jti": "test-jti",
+		},
+	}
+
+	validator.addJTIToBlacklist(jwt)
+
+	// Should not blacklist when disabled
+	_, exists := blacklist.Get("test-jti")
+	if exists {
+		t.Error("Expected JTI not to be blacklisted when replay detection disabled")
+	}
+}
+
+func TestValidator_AddJTIToBlacklist_NoJTI(t *testing.T) {
+	blacklist := newMockCache()
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenBlacklist: blacklist,
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			// No JTI
+		},
+	}
+
+	validator.addJTIToBlacklist(jwt)
+
+	// Should handle gracefully
+	if len(blacklist.data) != 0 {
+		t.Error("Expected no entries in blacklist when JTI missing")
+	}
+}
+
+func TestValidator_CacheTokenType(t *testing.T) {
+	cache := newMockCache()
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: cache,
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	validator.cacheTokenType("cache-key-123", true)
+
+	data, exists := cache.Get("cache-key-123")
+	if !exists {
+		t.Error("Expected token type to be cached")
+	}
+
+	if isID, ok := data["is_id_token"].(bool); !ok || !isID {
+		t.Error("Expected is_id_token to be true")
+	}
+
+	if _, ok := data["cached_at"].(int64); !ok {
+		t.Error("Expected cached_at timestamp")
+	}
+}
+
+func TestValidator_CacheVerifiedToken(t *testing.T) {
+	tokenCache := newMockTokenCache()
+	config := ValidatorConfig{
+		ClientID:   "test-client",
+		TokenCache: tokenCache,
+		MetadataMu: &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	claims := map[string]interface{}{
+		"sub": "user123",
+		"exp": time.Now().Add(1 * time.Hour).Unix(),
+	}
+
+	validator.cacheVerifiedToken("test-token", claims)
+
+	cached, exists := tokenCache.GetCachedToken("test-token")
+	if !exists {
+		t.Error("Expected token to be cached")
+	}
+
+	if cached["sub"] != "user123" {
+		t.Error("Expected cached claims to match")
+	}
+}
+
+func TestValidator_CheckRateLimit(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:   "test-client",
+		MetadataMu: &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	// Default implementation returns true
+	if !validator.checkRateLimit() {
+		t.Error("Expected checkRateLimit to return true by default")
+	}
+}
+
+func TestValidator_FindMatchingKey(t *testing.T) {
+	config := ValidatorConfig{
+		ClientID:   "test-client",
+		MetadataMu: &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	jwks := &JWKS{
+		Keys: []JWK{
+			{Kid: "key-1", Kty: "RSA"},
+			{Kid: "key-2", Kty: "RSA"},
+			{Kid: "key-3", Kty: "RSA"},
+		},
+	}
+
+	key := validator.findMatchingKey(jwks, "key-2")
+	if key == nil {
+		t.Fatal("Expected to find matching key")
+	}
+
+	if key.Kid != "key-2" {
+		t.Errorf("Expected kid 'key-2', got '%s'", key.Kid)
+	}
+
+	// Test non-existent key
+	key = validator.findMatchingKey(jwks, "key-999")
+	if key != nil {
+		t.Error("Expected nil for non-existent key")
+	}
+
+	// Test nil JWKS
+	key = validator.findMatchingKey(nil, "key-1")
+	if key != nil {
+		t.Error("Expected nil for nil JWKS")
+	}
+}
+
+// Race condition tests
+func TestValidator_ConcurrentTokenTypeDetection(t *testing.T) {
+	cache := newMockCache()
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenTypeCache: cache,
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	var wg sync.WaitGroup
+	token := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.test-concurrent"
+
+	jwt := &JWT{
+		Claims: map[string]interface{}{
+			"nonce": "test",
+		},
+	}
+
+	// Concurrent token type detection
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = validator.detectTokenType(jwt, token)
+		}()
+	}
+
+	wg.Wait()
+
+	// Should have cached the result
+	cacheKey := token[:32]
+	if _, exists := cache.Get(cacheKey); !exists {
+		t.Error("Expected token type to be cached after concurrent access")
+	}
+}
+
+func TestValidator_ConcurrentJTIBlacklisting(t *testing.T) {
+	blacklist := newMockCache()
+	config := ValidatorConfig{
+		ClientID:       "test-client",
+		TokenBlacklist: blacklist,
+		MetadataMu:     &sync.RWMutex{},
+	}
+
+	validator := NewValidator(config)
+
+	var wg sync.WaitGroup
+
+	// Concurrent JTI blacklisting
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			jwt := &JWT{
+				Claims: map[string]interface{}{
+					"jti": string(rune('A' + idx%26)),
+				},
+			}
+			validator.addJTIToBlacklist(jwt)
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Should have multiple JTIs blacklisted
+	if len(blacklist.data) == 0 {
+		t.Error("Expected JTIs to be blacklisted")
+	}
+}

internal/utils/utils_test.go

@@ -553,3 +553,164 @@ func TestIsTestModeYaegiCompiler(t *testing.T) {
 		t.Error("Expected true when GO_TEST=1 is set")
 	}
 }
+
+// ============================================================================
+// LOGGER WRAPPER TESTS
+// ============================================================================
+
+// mockLogger is a simple mock implementation for testing
+type mockLogger struct {
+	infoCalls  int
+	debugCalls int
+	errorCalls int
+	lastFormat string
+	lastArgs   []interface{}
+}
+
+func (m *mockLogger) Infof(format string, args ...interface{}) {
+	m.infoCalls++
+	m.lastFormat = format
+	m.lastArgs = args
+}
+
+func (m *mockLogger) Debugf(format string, args ...interface{}) {
+	m.debugCalls++
+	m.lastFormat = format
+	m.lastArgs = args
+}
+
+func (m *mockLogger) Errorf(format string, args ...interface{}) {
+	m.errorCalls++
+	m.lastFormat = format
+	m.lastArgs = args
+}
+
+// TestWrapLoggerForRecovery tests the recovery logger wrapper
+func TestWrapLoggerForRecovery(t *testing.T) {
+	mock := &mockLogger{}
+	wrapper := WrapLoggerForRecovery(mock)
+
+	if wrapper == nil {
+		t.Fatal("WrapLoggerForRecovery should not return nil")
+	}
+
+	// Test Logf
+	wrapper.Logf("test info: %s", "value")
+	if mock.infoCalls != 1 {
+		t.Errorf("Expected 1 info call, got %d", mock.infoCalls)
+	}
+	if mock.lastFormat != "test info: %s" {
+		t.Errorf("Expected format 'test info: %%s', got '%s'", mock.lastFormat)
+	}
+
+	// Test ErrorLogf
+	wrapper.ErrorLogf("test error: %d", 123)
+	if mock.errorCalls != 1 {
+		t.Errorf("Expected 1 error call, got %d", mock.errorCalls)
+	}
+	if mock.lastFormat != "test error: %d" {
+		t.Errorf("Expected format 'test error: %%d', got '%s'", mock.lastFormat)
+	}
+
+	// Test DebugLogf
+	wrapper.DebugLogf("test debug: %v", true)
+	if mock.debugCalls != 1 {
+		t.Errorf("Expected 1 debug call, got %d", mock.debugCalls)
+	}
+	if mock.lastFormat != "test debug: %v" {
+		t.Errorf("Expected format 'test debug: %%v', got '%s'", mock.lastFormat)
+	}
+}
+
+// TestWrapLoggerForRecovery_NilLogger tests recovery wrapper with nil logger
+func TestWrapLoggerForRecovery_NilLogger(t *testing.T) {
+	wrapper := WrapLoggerForRecovery(nil)
+
+	if wrapper == nil {
+		t.Fatal("WrapLoggerForRecovery should not return nil even with nil logger")
+	}
+
+	// These should not panic
+	wrapper.Logf("test")
+	wrapper.ErrorLogf("test")
+	wrapper.DebugLogf("test")
+}
+
+// TestWrapLoggerForCleanup tests the cleanup logger wrapper
+func TestWrapLoggerForCleanup(t *testing.T) {
+	mock := &mockLogger{}
+	wrapper := WrapLoggerForCleanup(mock)
+
+	if wrapper == nil {
+		t.Fatal("WrapLoggerForCleanup should not return nil")
+	}
+
+	// Test Logf
+	wrapper.Logf("cleanup info: %s", "value")
+	if mock.infoCalls != 1 {
+		t.Errorf("Expected 1 info call, got %d", mock.infoCalls)
+	}
+	if mock.lastFormat != "cleanup info: %s" {
+		t.Errorf("Expected format 'cleanup info: %%s', got '%s'", mock.lastFormat)
+	}
+
+	// Test ErrorLogf
+	wrapper.ErrorLogf("cleanup error: %d", 456)
+	if mock.errorCalls != 1 {
+		t.Errorf("Expected 1 error call, got %d", mock.errorCalls)
+	}
+	if mock.lastFormat != "cleanup error: %d" {
+		t.Errorf("Expected format 'cleanup error: %%d', got '%s'", mock.lastFormat)
+	}
+
+	// Test DebugLogf
+	wrapper.DebugLogf("cleanup debug: %v", false)
+	if mock.debugCalls != 1 {
+		t.Errorf("Expected 1 debug call, got %d", mock.debugCalls)
+	}
+	if mock.lastFormat != "cleanup debug: %v" {
+		t.Errorf("Expected format 'cleanup debug: %%v', got '%s'", mock.lastFormat)
+	}
+}
+
+// TestWrapLoggerForCleanup_NilLogger tests cleanup wrapper with nil logger
+func TestWrapLoggerForCleanup_NilLogger(t *testing.T) {
+	wrapper := WrapLoggerForCleanup(nil)
+
+	if wrapper == nil {
+		t.Fatal("WrapLoggerForCleanup should not return nil even with nil logger")
+	}
+
+	// These should not panic
+	wrapper.Logf("test")
+	wrapper.ErrorLogf("test")
+	wrapper.DebugLogf("test")
+}
+
+// TestLoggerWrappers_MultipleArgs tests wrappers with multiple arguments
+func TestLoggerWrappers_MultipleArgs(t *testing.T) {
+	mock := &mockLogger{}
+
+	// Test recovery wrapper with multiple args
+	recoveryWrapper := WrapLoggerForRecovery(mock)
+	recoveryWrapper.Logf("format: %s %d %v", "str", 123, true)
+	if mock.infoCalls != 1 {
+		t.Errorf("Expected 1 info call, got %d", mock.infoCalls)
+	}
+	if len(mock.lastArgs) != 3 {
+		t.Errorf("Expected 3 args, got %d", len(mock.lastArgs))
+	}
+
+	// Reset mock
+	mock = &mockLogger{}
+
+	// Test cleanup wrapper with multiple args
+	cleanupWrapper := WrapLoggerForCleanup(mock)
+	cleanupWrapper.ErrorLogf("error: %s %d %v", "err", 456, false)
+	if mock.errorCalls != 1 {
+		t.Errorf("Expected 1 error call, got %d", mock.errorCalls)
+	}
+	if len(mock.lastArgs) != 3 {
+		t.Errorf("Expected 3 args, got %d", len(mock.lastArgs))
+	}
+}