test: comprehensive test expansion — 330+ to 525+ tests, close M11b coverage gaps

Add 195+ new tests across service, handler, connector, and integration layers:
- Service tests: team (23), owner (21), agent_group (25), issuer (18), issuer_adapter (6)
- Handler tests: teams (26), owners (21)
- NGINX target connector tests (13): config validation, deployment, reload
- Integration tests: 19 M11b endpoint subtests (teams, owners, agent groups CRUD)
- CI pipeline: add ./internal/connector/target/... to test coverage path
- Docs: update test counts to 525+ across README, architecture, CLAUDE.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/api/handler/owner_handler_test.go

@@ -0,0 +1,558 @@
+package handler
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// MockOwnerService is a mock implementation of OwnerService interface.
+type MockOwnerService struct {
+	ListOwnersFn  func(page, perPage int) ([]domain.Owner, int64, error)
+	GetOwnerFn    func(id string) (*domain.Owner, error)
+	CreateOwnerFn func(owner domain.Owner) (*domain.Owner, error)
+	UpdateOwnerFn func(id string, owner domain.Owner) (*domain.Owner, error)
+	DeleteOwnerFn func(id string) error
+}
+
+func (m *MockOwnerService) ListOwners(page, perPage int) ([]domain.Owner, int64, error) {
+	if m.ListOwnersFn != nil {
+		return m.ListOwnersFn(page, perPage)
+	}
+	return nil, 0, nil
+}
+
+func (m *MockOwnerService) GetOwner(id string) (*domain.Owner, error) {
+	if m.GetOwnerFn != nil {
+		return m.GetOwnerFn(id)
+	}
+	return nil, nil
+}
+
+func (m *MockOwnerService) CreateOwner(owner domain.Owner) (*domain.Owner, error) {
+	if m.CreateOwnerFn != nil {
+		return m.CreateOwnerFn(owner)
+	}
+	return nil, nil
+}
+
+func (m *MockOwnerService) UpdateOwner(id string, owner domain.Owner) (*domain.Owner, error) {
+	if m.UpdateOwnerFn != nil {
+		return m.UpdateOwnerFn(id, owner)
+	}
+	return nil, nil
+}
+
+func (m *MockOwnerService) DeleteOwner(id string) error {
+	if m.DeleteOwnerFn != nil {
+		return m.DeleteOwnerFn(id)
+	}
+	return nil
+}
+
+// TestListOwners_Success lists owners with pagination, verify data fields.
+func TestListOwners_Success(t *testing.T) {
+	now := time.Now()
+	o1 := domain.Owner{
+		ID:        "o-alice",
+		Name:      "Alice",
+		Email:     "alice@example.com",
+		TeamID:    "t-platform",
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+	o2 := domain.Owner{
+		ID:        "o-bob",
+		Name:      "Bob",
+		Email:     "bob@example.com",
+		TeamID:    "t-ops",
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+
+	mock := &MockOwnerService{
+		ListOwnersFn: func(page, perPage int) ([]domain.Owner, int64, error) {
+			return []domain.Owner{o1, o2}, 2, nil
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListOwners(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var resp PagedResponse
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if resp.Total != 2 {
+		t.Errorf("expected total 2, got %d", resp.Total)
+	}
+}
+
+// TestListOwners_Pagination verifies pagination parameters are passed to service.
+func TestListOwners_Pagination(t *testing.T) {
+	var capturedPage, capturedPerPage int
+	mock := &MockOwnerService{
+		ListOwnersFn: func(page, perPage int) ([]domain.Owner, int64, error) {
+			capturedPage = page
+			capturedPerPage = perPage
+			return []domain.Owner{}, 0, nil
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners?page=3&per_page=25", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListOwners(w, req)
+
+	if capturedPage != 3 {
+		t.Errorf("expected page 3, got %d", capturedPage)
+	}
+	if capturedPerPage != 25 {
+		t.Errorf("expected per_page 25, got %d", capturedPerPage)
+	}
+}
+
+// TestListOwners_ServiceError returns 500 on service error.
+func TestListOwners_ServiceError(t *testing.T) {
+	mock := &MockOwnerService{
+		ListOwnersFn: func(page, perPage int) ([]domain.Owner, int64, error) {
+			return nil, 0, ErrMockServiceFailed
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListOwners(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestListOwners_MethodNotAllowed returns 405 for non-GET methods.
+func TestListOwners_MethodNotAllowed(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners", nil)
+	w := httptest.NewRecorder()
+
+	handler.ListOwners(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestGetOwner_Success returns owner with email and team_id.
+func TestGetOwner_Success(t *testing.T) {
+	now := time.Now()
+	mock := &MockOwnerService{
+		GetOwnerFn: func(id string) (*domain.Owner, error) {
+			return &domain.Owner{
+				ID:        id,
+				Name:      "Alice",
+				Email:     "alice@example.com",
+				TeamID:    "t-platform",
+				CreatedAt: now,
+				UpdatedAt: now,
+			}, nil
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners/o-alice", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.GetOwner(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var owner domain.Owner
+	if err := json.NewDecoder(w.Body).Decode(&owner); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if owner.Email != "alice@example.com" {
+		t.Errorf("expected email 'alice@example.com', got '%s'", owner.Email)
+	}
+	if owner.TeamID != "t-platform" {
+		t.Errorf("expected team_id 't-platform', got '%s'", owner.TeamID)
+	}
+}
+
+// TestGetOwner_NotFound returns 404 when owner not found.
+func TestGetOwner_NotFound(t *testing.T) {
+	mock := &MockOwnerService{
+		GetOwnerFn: func(id string) (*domain.Owner, error) {
+			return nil, ErrMockNotFound
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners/nonexistent", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.GetOwner(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected status 404, got %d", w.Code)
+	}
+}
+
+// TestGetOwner_EmptyID returns 400 for empty ID.
+func TestGetOwner_EmptyID(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners/", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.GetOwner(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestGetOwner_MethodNotAllowed returns 405 for non-GET methods.
+func TestGetOwner_MethodNotAllowed(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners/o-alice", nil)
+	w := httptest.NewRecorder()
+
+	handler.GetOwner(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestCreateOwner_Success returns 201 with email and team_id.
+func TestCreateOwner_Success(t *testing.T) {
+	now := time.Now()
+	mock := &MockOwnerService{
+		CreateOwnerFn: func(owner domain.Owner) (*domain.Owner, error) {
+			owner.ID = "o-new"
+			owner.CreatedAt = now
+			owner.UpdatedAt = now
+			return &owner, nil
+		},
+	}
+
+	body := domain.Owner{
+		Name:   "Alice",
+		Email:  "alice@example.com",
+		TeamID: "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateOwner(w, req)
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected status 201, got %d", w.Code)
+	}
+
+	var owner domain.Owner
+	if err := json.NewDecoder(w.Body).Decode(&owner); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if owner.Email != "alice@example.com" {
+		t.Errorf("expected email 'alice@example.com', got '%s'", owner.Email)
+	}
+	if owner.TeamID != "t-platform" {
+		t.Errorf("expected team_id 't-platform', got '%s'", owner.TeamID)
+	}
+}
+
+// TestCreateOwner_InvalidJSON returns 400 for malformed JSON.
+func TestCreateOwner_InvalidJSON(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners", bytes.NewReader([]byte("not json")))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateOwner(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestCreateOwner_MissingName returns 400 when name is required.
+func TestCreateOwner_MissingName(t *testing.T) {
+	body := map[string]interface{}{
+		"email":   "alice@example.com",
+		"team_id": "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateOwner(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestCreateOwner_NameTooLong returns 400 for name exceeding 255 chars.
+func TestCreateOwner_NameTooLong(t *testing.T) {
+	longName := ""
+	for i := 0; i < 256; i++ {
+		longName += "x"
+	}
+	body := domain.Owner{
+		Name:   longName,
+		Email:  "alice@example.com",
+		TeamID: "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateOwner(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestCreateOwner_ServiceError returns 500 on service error.
+func TestCreateOwner_ServiceError(t *testing.T) {
+	mock := &MockOwnerService{
+		CreateOwnerFn: func(owner domain.Owner) (*domain.Owner, error) {
+			return nil, ErrMockServiceFailed
+		},
+	}
+
+	body := domain.Owner{
+		Name:   "Alice",
+		Email:  "alice@example.com",
+		TeamID: "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/owners", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateOwner(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestCreateOwner_MethodNotAllowed returns 405 for non-POST methods.
+func TestCreateOwner_MethodNotAllowed(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners", nil)
+	w := httptest.NewRecorder()
+
+	handler.CreateOwner(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestUpdateOwner_Success returns 200 with updated data.
+func TestUpdateOwner_Success(t *testing.T) {
+	now := time.Now()
+	mock := &MockOwnerService{
+		UpdateOwnerFn: func(id string, owner domain.Owner) (*domain.Owner, error) {
+			return &domain.Owner{
+				ID:        id,
+				Name:      owner.Name,
+				Email:     owner.Email,
+				TeamID:    owner.TeamID,
+				CreatedAt: now,
+				UpdatedAt: now,
+			}, nil
+		},
+	}
+
+	body := domain.Owner{
+		Name:   "Alice Updated",
+		Email:  "alice.updated@example.com",
+		TeamID: "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/owners/o-alice", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateOwner(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var owner domain.Owner
+	if err := json.NewDecoder(w.Body).Decode(&owner); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if owner.Name != "Alice Updated" {
+		t.Errorf("expected name 'Alice Updated', got '%s'", owner.Name)
+	}
+}
+
+// TestUpdateOwner_ServiceError returns 500 on service error.
+func TestUpdateOwner_ServiceError(t *testing.T) {
+	mock := &MockOwnerService{
+		UpdateOwnerFn: func(id string, owner domain.Owner) (*domain.Owner, error) {
+			return nil, ErrMockServiceFailed
+		},
+	}
+
+	body := domain.Owner{
+		Name:   "Alice Updated",
+		Email:  "alice.updated@example.com",
+		TeamID: "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/owners/o-alice", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateOwner(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestUpdateOwner_EmptyID returns 400 for empty ID.
+func TestUpdateOwner_EmptyID(t *testing.T) {
+	body := domain.Owner{
+		Name:   "Alice",
+		Email:  "alice@example.com",
+		TeamID: "t-platform",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/owners/", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateOwner(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestDeleteOwner_Success returns 204 No Content.
+func TestDeleteOwner_Success(t *testing.T) {
+	var deletedID string
+	mock := &MockOwnerService{
+		DeleteOwnerFn: func(id string) error {
+			deletedID = id
+			return nil
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/owners/o-alice", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.DeleteOwner(w, req)
+
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("expected status 204, got %d", w.Code)
+	}
+	if deletedID != "o-alice" {
+		t.Errorf("expected deleted ID 'o-alice', got '%s'", deletedID)
+	}
+}
+
+// TestDeleteOwner_ServiceError returns 500 on service error.
+func TestDeleteOwner_ServiceError(t *testing.T) {
+	mock := &MockOwnerService{
+		DeleteOwnerFn: func(id string) error {
+			return ErrMockServiceFailed
+		},
+	}
+
+	handler := NewOwnerHandler(mock)
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/owners/o-alice", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.DeleteOwner(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestDeleteOwner_EmptyID returns 400 for empty ID.
+func TestDeleteOwner_EmptyID(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/owners/", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.DeleteOwner(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestDeleteOwner_MethodNotAllowed returns 405 for non-DELETE methods.
+func TestDeleteOwner_MethodNotAllowed(t *testing.T) {
+	handler := NewOwnerHandler(&MockOwnerService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/owners/o-alice", nil)
+	w := httptest.NewRecorder()
+
+	handler.DeleteOwner(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// contextWithRequestID returns a context with a test request ID for use in tests.
+func contextWithRequestID() context.Context {
+	return context.WithValue(context.Background(), middleware.RequestIDKey{}, "test-request-id-123")
+}

internal/api/handler/team_handler_test.go

@@ -0,0 +1,631 @@
+package handler
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/shankar0123/certctl/internal/api/middleware"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// MockTeamService is a mock implementation of TeamService interface.
+type MockTeamService struct {
+	ListTeamsFn  func(page, perPage int) ([]domain.Team, int64, error)
+	GetTeamFn    func(id string) (*domain.Team, error)
+	CreateTeamFn func(team domain.Team) (*domain.Team, error)
+	UpdateTeamFn func(id string, team domain.Team) (*domain.Team, error)
+	DeleteTeamFn func(id string) error
+}
+
+func (m *MockTeamService) ListTeams(page, perPage int) ([]domain.Team, int64, error) {
+	if m.ListTeamsFn != nil {
+		return m.ListTeamsFn(page, perPage)
+	}
+	return nil, 0, nil
+}
+
+func (m *MockTeamService) GetTeam(id string) (*domain.Team, error) {
+	if m.GetTeamFn != nil {
+		return m.GetTeamFn(id)
+	}
+	return nil, nil
+}
+
+func (m *MockTeamService) CreateTeam(team domain.Team) (*domain.Team, error) {
+	if m.CreateTeamFn != nil {
+		return m.CreateTeamFn(team)
+	}
+	return nil, nil
+}
+
+func (m *MockTeamService) UpdateTeam(id string, team domain.Team) (*domain.Team, error) {
+	if m.UpdateTeamFn != nil {
+		return m.UpdateTeamFn(id, team)
+	}
+	return nil, nil
+}
+
+func (m *MockTeamService) DeleteTeam(id string) error {
+	if m.DeleteTeamFn != nil {
+		return m.DeleteTeamFn(id)
+	}
+	return nil
+}
+
+// TestListTeams_Success tests listing teams with default pagination.
+func TestListTeams_Success(t *testing.T) {
+	now := time.Now()
+	t1 := domain.Team{
+		ID:          "t-platform",
+		Name:        "Platform Team",
+		Description: "Infrastructure team",
+		CreatedAt:   now,
+		UpdatedAt:   now,
+	}
+	t2 := domain.Team{
+		ID:          "t-security",
+		Name:        "Security Team",
+		Description: "Security operations",
+		CreatedAt:   now,
+		UpdatedAt:   now,
+	}
+
+	mock := &MockTeamService{
+		ListTeamsFn: func(page, perPage int) ([]domain.Team, int64, error) {
+			return []domain.Team{t1, t2}, 2, nil
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListTeams(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var resp PagedResponse
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if resp.Total != 2 {
+		t.Errorf("expected total 2, got %d", resp.Total)
+	}
+	if resp.Page != 1 {
+		t.Errorf("expected page 1, got %d", resp.Page)
+	}
+	if resp.PerPage != 50 {
+		t.Errorf("expected per_page 50, got %d", resp.PerPage)
+	}
+}
+
+// TestListTeams_WithQueryParams tests listing with custom pagination parameters.
+func TestListTeams_WithQueryParams(t *testing.T) {
+	var capturedPage, capturedPerPage int
+	mock := &MockTeamService{
+		ListTeamsFn: func(page, perPage int) ([]domain.Team, int64, error) {
+			capturedPage = page
+			capturedPerPage = perPage
+			return []domain.Team{}, 0, nil
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams?page=3&per_page=25", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListTeams(w, req)
+
+	if capturedPage != 3 {
+		t.Errorf("expected page 3, got %d", capturedPage)
+	}
+	if capturedPerPage != 25 {
+		t.Errorf("expected per_page 25, got %d", capturedPerPage)
+	}
+}
+
+// TestListTeams_PerPageMaxLimit tests that per_page is capped at 500.
+func TestListTeams_PerPageMaxLimit(t *testing.T) {
+	var capturedPerPage int
+	mock := &MockTeamService{
+		ListTeamsFn: func(page, perPage int) ([]domain.Team, int64, error) {
+			capturedPerPage = perPage
+			return []domain.Team{}, 0, nil
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams?per_page=1000", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListTeams(w, req)
+
+	if capturedPerPage != 500 {
+		t.Errorf("expected per_page capped at 500, got %d", capturedPerPage)
+	}
+}
+
+// TestListTeams_ServiceError tests error handling when service fails.
+func TestListTeams_ServiceError(t *testing.T) {
+	mock := &MockTeamService{
+		ListTeamsFn: func(page, perPage int) ([]domain.Team, int64, error) {
+			return nil, 0, ErrMockServiceFailed
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListTeams(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestListTeams_MethodNotAllowed tests that non-GET requests are rejected.
+func TestListTeams_MethodNotAllowed(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", nil)
+	w := httptest.NewRecorder()
+
+	handler.ListTeams(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestGetTeam_Success tests retrieving a team by ID.
+func TestGetTeam_Success(t *testing.T) {
+	now := time.Now()
+	mock := &MockTeamService{
+		GetTeamFn: func(id string) (*domain.Team, error) {
+			return &domain.Team{
+				ID:          id,
+				Name:        "Platform Team",
+				Description: "Infrastructure team",
+				CreatedAt:   now,
+				UpdatedAt:   now,
+			}, nil
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams/t-platform", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.GetTeam(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var team domain.Team
+	if err := json.NewDecoder(w.Body).Decode(&team); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if team.ID != "t-platform" {
+		t.Errorf("expected ID t-platform, got %s", team.ID)
+	}
+}
+
+// TestGetTeam_NotFound tests 404 response when team does not exist.
+func TestGetTeam_NotFound(t *testing.T) {
+	mock := &MockTeamService{
+		GetTeamFn: func(id string) (*domain.Team, error) {
+			return nil, ErrMockNotFound
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams/nonexistent", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.GetTeam(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected status 404, got %d", w.Code)
+	}
+}
+
+// TestGetTeam_EmptyID tests 400 response when team ID is empty.
+func TestGetTeam_EmptyID(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams/", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.GetTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestGetTeam_MethodNotAllowed tests that non-GET requests are rejected.
+func TestGetTeam_MethodNotAllowed(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/teams/t-platform", nil)
+	w := httptest.NewRecorder()
+
+	handler.GetTeam(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestCreateTeam_Success tests successful team creation.
+func TestCreateTeam_Success(t *testing.T) {
+	now := time.Now()
+	mock := &MockTeamService{
+		CreateTeamFn: func(team domain.Team) (*domain.Team, error) {
+			team.ID = "t-new"
+			team.CreatedAt = now
+			team.UpdatedAt = now
+			return &team, nil
+		},
+	}
+
+	body := map[string]interface{}{
+		"name":        "New Team",
+		"description": "A new team",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected status 201, got %d", w.Code)
+	}
+
+	var team domain.Team
+	if err := json.NewDecoder(w.Body).Decode(&team); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if team.ID != "t-new" {
+		t.Errorf("expected ID t-new, got %s", team.ID)
+	}
+	if team.Name != "New Team" {
+		t.Errorf("expected name 'New Team', got %s", team.Name)
+	}
+}
+
+// TestCreateTeam_InvalidJSON tests 400 response for malformed JSON.
+func TestCreateTeam_InvalidJSON(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", bytes.NewReader([]byte("not json")))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestCreateTeam_MissingName tests 400 response when name is required but missing.
+func TestCreateTeam_MissingName(t *testing.T) {
+	body := map[string]interface{}{
+		"description": "Team without name",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestCreateTeam_NameTooLong tests 400 response when name exceeds max length.
+func TestCreateTeam_NameTooLong(t *testing.T) {
+	longName := ""
+	for i := 0; i < 256; i++ {
+		longName += "x"
+	}
+	body := map[string]interface{}{
+		"name": longName,
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestCreateTeam_ServiceError tests error handling when service fails.
+func TestCreateTeam_ServiceError(t *testing.T) {
+	mock := &MockTeamService{
+		CreateTeamFn: func(team domain.Team) (*domain.Team, error) {
+			return nil, ErrMockServiceFailed
+		},
+	}
+
+	body := map[string]interface{}{
+		"name": "New Team",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestCreateTeam_MethodNotAllowed tests that non-POST requests are rejected.
+func TestCreateTeam_MethodNotAllowed(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams", nil)
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestUpdateTeam_Success tests successful team update.
+func TestUpdateTeam_Success(t *testing.T) {
+	now := time.Now()
+	mock := &MockTeamService{
+		UpdateTeamFn: func(id string, team domain.Team) (*domain.Team, error) {
+			return &domain.Team{
+				ID:          id,
+				Name:        team.Name,
+				Description: team.Description,
+				CreatedAt:   now,
+				UpdatedAt:   now,
+			}, nil
+		},
+	}
+
+	body := map[string]interface{}{
+		"name":        "Updated Team",
+		"description": "Updated description",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/teams/t-platform", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateTeam(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var team domain.Team
+	if err := json.NewDecoder(w.Body).Decode(&team); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if team.Name != "Updated Team" {
+		t.Errorf("expected name 'Updated Team', got %s", team.Name)
+	}
+}
+
+// TestUpdateTeam_InvalidJSON tests 400 response for malformed JSON.
+func TestUpdateTeam_InvalidJSON(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/teams/t-platform", bytes.NewReader([]byte("bad json")))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestUpdateTeam_EmptyID tests 400 response when team ID is empty.
+func TestUpdateTeam_EmptyID(t *testing.T) {
+	body := map[string]interface{}{
+		"name": "Updated Team",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/teams/", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestUpdateTeam_ServiceError tests error handling when service fails.
+func TestUpdateTeam_ServiceError(t *testing.T) {
+	mock := &MockTeamService{
+		UpdateTeamFn: func(id string, team domain.Team) (*domain.Team, error) {
+			return nil, ErrMockServiceFailed
+		},
+	}
+
+	body := map[string]interface{}{
+		"name": "Updated Team",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/teams/t-platform", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.UpdateTeam(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestUpdateTeam_MethodNotAllowed tests that non-PUT requests are rejected.
+func TestUpdateTeam_MethodNotAllowed(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams/t-platform", nil)
+	w := httptest.NewRecorder()
+
+	handler.UpdateTeam(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestDeleteTeam_Success tests successful team deletion.
+func TestDeleteTeam_Success(t *testing.T) {
+	mock := &MockTeamService{
+		DeleteTeamFn: func(id string) error {
+			return nil
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/teams/t-platform", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.DeleteTeam(w, req)
+
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("expected status 204, got %d", w.Code)
+	}
+}
+
+// TestDeleteTeam_EmptyID tests 400 response when team ID is empty.
+func TestDeleteTeam_EmptyID(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/teams/", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.DeleteTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestDeleteTeam_ServiceError tests error handling when service fails.
+func TestDeleteTeam_ServiceError(t *testing.T) {
+	mock := &MockTeamService{
+		DeleteTeamFn: func(id string) error {
+			return ErrMockServiceFailed
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/teams/t-platform", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.DeleteTeam(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status 500, got %d", w.Code)
+	}
+}
+
+// TestDeleteTeam_MethodNotAllowed tests that non-DELETE requests are rejected.
+func TestDeleteTeam_MethodNotAllowed(t *testing.T) {
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams/t-platform", nil)
+	w := httptest.NewRecorder()
+
+	handler.DeleteTeam(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}
+
+// TestCreateTeam_EmptyNameString tests 400 response when name is empty string.
+func TestCreateTeam_EmptyNameString(t *testing.T) {
+	body := map[string]interface{}{
+		"name": "",
+	}
+	bodyBytes, _ := json.Marshal(body)
+
+	handler := NewTeamHandler(&MockTeamService{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/teams", bytes.NewReader(bodyBytes))
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.CreateTeam(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected status 400, got %d", w.Code)
+	}
+}
+
+// TestListTeams_InvalidPagination tests handling of invalid pagination parameters.
+func TestListTeams_InvalidPagination(t *testing.T) {
+	var capturedPage, capturedPerPage int
+	mock := &MockTeamService{
+		ListTeamsFn: func(page, perPage int) ([]domain.Team, int64, error) {
+			capturedPage = page
+			capturedPerPage = perPage
+			return []domain.Team{}, 0, nil
+		},
+	}
+
+	handler := NewTeamHandler(mock)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/teams?page=invalid&per_page=bad", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.ListTeams(w, req)
+
+	// Should use defaults when parsing fails
+	if capturedPage != 1 {
+		t.Errorf("expected default page 1, got %d", capturedPage)
+	}
+	if capturedPerPage != 50 {
+		t.Errorf("expected default per_page 50, got %d", capturedPerPage)
+	}
+}