[test] Add tests for difc.labels (CheckFlow, ViolationError, Clone, Union)

[github-actions]

Test Coverage Improvement: internal/difc/labels.go

Function Analyzed

• Package: internal/difc
• File: labels.go
• Previous Coverage: ~0% for the specific functions targeted
• Complexity: Medium-High (multiple type hierarchies, nil-receiver patterns, branching error messages)

Why This Function?

labels.go implements the core DIFC (Decentralized Information Flow Control) label primitives — Label, SecrecyLabel, IntegrityLabel, and ViolationError. Despite being central to the security model, several key functions had no direct test coverage:

• CheckFlow methods (used by evaluator.go but never tested in isolation)
• ViolationError.Error() — 4-way branch covering secrecy/integrity × read/write scenarios
• ViolationError.Detailed() — extends Error() with tag context
• Clone methods for both label types (nil-receiver edge cases)
• Label.Union, Label.Clone, Label.GetTags base-level operations
• NewSecrecyLabelWithTags / NewIntegrityLabelWithTags constructors

Tests Added

New file: internal/difc/labels_test.go

• ✅ TestLabel_Union — merging tags, nil other, overlapping tags, empty inputs
• ✅ TestLabel_Clone — independence from original, empty label clone
• ✅ TestLabel_GetTags — correct tag enumeration
• ✅ TestSecrecyLabel_CheckFlow — nil receiver, nil target, subset/superset, multi-tag violations
• ✅ TestIntegrityLabel_CheckFlow — nil receiver, nil target, superset/missing tag scenarios
• ✅ TestSecrecyLabel_Clone — nil receiver, nil inner Label, independence
• ✅ TestIntegrityLabel_Clone — nil receiver, nil inner Label, independence
• ✅ TestNewSecrecyLabelWithTags / TestNewIntegrityLabelWithTags — constructors with tags and nil
• ✅ TestViolationError_Error — all 4 branches (secrecy with/without extra tags; integrity write/read with/without missing tags)
• ✅ TestViolationError_Detailed — tag context, secrecy vs integrity, length check
• ✅ TestViolationError_implementsError — interface compliance
• ✅ TestSecrecyLabel_CanFlowTo_NilCases — nil receiver and nil argument edge cases
• ✅ TestIntegrityLabel_CanFlowTo_NilCases — nil receiver and nil argument edge cases

Testing Approach

All tests follow the project's table-driven test pattern with testify/assert and testify/require assertions. Nil-receiver method calls are exercised directly using typed nil pointers (safe since the implementations explicitly guard against nil receivers).

---

Generated by Test Coverage Improver

AI generated by Test Coverage Improver

[Copilot]

Pull request overview

Adds focused unit tests for the core DIFC label primitives in internal/difc/labels.go, improving confidence in secrecy/integrity flow checks and DIFC violation messaging.

Changes:

• Introduces comprehensive table-driven tests for Label, SecrecyLabel, and IntegrityLabel operations (Union/Clone/GetTags/CheckFlow/CanFlowTo).
• Adds branch coverage for ViolationError.Error() and ViolationError.Detailed(), including interface compliance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The struct field comment for other []Tag is misleading: in this table nil for other produces an empty Label (since nilOther controls whether a nil *Label is passed). Consider updating the comment and/or removing the redundant nilOther flag to avoid confusion when adding new cases.

Suggested change

	other []Tag // nil means nil *Label is passed
	nilOther bool
	other []Tag // nil means "other" is an empty label (no tags)
	nilOther bool // when true, a nil *Label is passed to Union