The test tree is split by concern so it is easy to find the relevant scenarios. Each folder owns its own helpers while all reusable mocks live in support/mocks.rs.

tests/
├── README.md                 # This file
├── support/                  # Shared tooling (stun builders, TLS utils, mocks)
│   ├── mocks.rs              # mockall definitions grouped by domain
│   ├── mod.rs                # re-exports used by integration crates
│   ├── stun_builders.rs
│   └── tls.rs
├── udp_turn.rs               # Legacy UDP end-to-end happy-path integration
├── tls_turn.rs               # Legacy TLS allocate/refresh integration
├── auth/
│   ├── helpers.rs            # Realm/nonce utilities + TURN bootstrapping
│   ├── unit.rs               # Realm mismatch + unknown user unit tests
│   ├── integration_udp.rs    # UDP auth failures (unknown user)
│   └── integration_tls.rs    # TLS auth failure path (bad credentials)
├── alloc/
│   ├── helpers.rs            # Lifetime/nonce helpers and UDP harness
│   ├── unit.rs               # Lifetime clamp + zero release
│   └── integration_udp.rs    # Refresh request clamping (server path)
├── channel/
│   ├── helpers.rs            # Channel/peer fixtures + harness
│   ├── unit.rs               # ChannelData parsing coverage
│   ├── integration_udp.rs    # ChannelBind without allocation → 437
│   └── integration_tls.rs    # TLS ChannelBind mismatch handling
├── config/
│   ├── helpers.rs            # JSON builders + temp-file writer
│   ├── unit.rs               # Minimal/malformed parse tests
│   └── integration.rs        # Config::from_file → AuthManager wiring
└── errors/
  ├── helpers.rs            # Malformed frame + harness
  ├── unit.rs               # Frame stream mock + parse errors
  ├── integration_udp.rs    # Malformed packet dropped silently
  └── integration_tls.rs    # TLS reader ignores garbage frames

Mocks

support/mocks.rs centralises every mockall mock. Sections are grouped by domain (Auth, Allocation, Channel, Config, Error) so it is obvious which tests should use which mock.
Tests import mocks via #[path = "../support/mod.rs"] mod support; and reach the relevant mock at support::mocks::MockFoo.
Additional domain-specific helper traits can be added to mocks.rs without touching the main crate.

Helper Policy

Each folder keeps tiny helpers.rs files for fixtures that are only meaningful within that domain (e.g. auth peers, config JSON blobs). This keeps intent local and avoids a mega helper file.
When scenarios need runtime bootstrapping they should add small helper modules in their folder rather than extending tests/support.

Domain Coverage Highlights

Auth: Validates realm mismatch and unknown users at unit level plus UDP/TLS rejection flows.
Allocation: Exercises lifetime clamping in isolation and via refresh STUN requests.
Channel: Covers ChannelData parsing plus UDP/TLS ChannelBind error paths when allocations are missing.
Config: Confirms JSON defaults, malformed detection, and Config::from_file wiring into an AuthManager via a temp file.
Errors: Ensures malformed frames trigger parser errors and are ignored by UDP/TLS loops without producing responses.
End-to-end baselines: udp_turn.rs and tls_turn.rs remain as the canonical happy-path integration tests for Allocate/Refresh/Permission flows over both transports.

Running Tests

Full suite: cargo test (runs unit + integration crates, TLS fixtures included).
Per-domain focus: cargo test --test auth_integration_udp, cargo test --test channel_unit, etc.
Include ignored tests: none remain; every scenario runs as part of the default suite.