peter 296af2a498 test(auth): session/epoch/wallet/token security core (E1 S2, TEST-1) ...

The auth security mag had zero tests. Add a DB-lane suite over the real
auth/session stack (TestClient carries the signed cookie): password login ->
/api/me authenticated; a wrong password and an unknown email return a
byte-identical 401 (no enumeration oracle); an X-Siftlode-Account header naming
a non-wallet account falls back to the default (impersonation gate); logout-others
bumps the epoch so a second session is rejected (401 on a protected endpoint)
while the caller stays in; and password-reset/confirm is single-use (replay ->
400) and bumps the epoch so pre-reset sessions die.

2026-08-18 01:23:07 +02:00

..

conftest.py

test(infra): fail-loud DB/ffmpeg lane + client/as_user/make_user fixtures (E1 S2, TEST-4)

2026-08-18 01:23:06 +02:00

test_adapters.py

fix(downloads): netloc-scoped adapter host match (review round 2)

2026-08-13 01:18:25 +02:00

test_auth_session.py

test(auth): session/epoch/wallet/token security core (E1 S2, TEST-1)

2026-08-18 01:23:07 +02:00

test_channel_backfill.py

test(backfill): lock the per-page durability and reserve-guard properties

2026-08-16 03:02:37 +02:00

test_channel_tags.py

refactor(channels): shared tag-mutation hook + a channel_detail tag_ids test (R8 review)

2026-07-30 23:33:50 +02:00

test_db_lane.py

test(db): stand up the DB-backed pytest lane (R6 S3b)

2026-07-26 13:47:07 +02:00

test_download_errors.py

fix(downloads): stop a ReDoS title and a fatal thumbnail convert from wedging/killing downloads

2026-08-12 18:27:35 +02:00

test_download_limits.py

fix(downloads): floor max_concurrent + stable share order (R12 S5 review)

2026-08-13 02:42:41 +02:00

test_download_output.py

fix(r5): address the /code-review high round — 10 findings

2026-07-23 23:25:06 +02:00

test_downloads_finalize.py

refactor(downloads): route worker terminal writes through an atomic finalize_if_running (B-sub-1 review)

2026-08-18 00:58:13 +02:00

test_feed_cursor.py

test(feed): cover malformed-cursor 400 + from-None on the re-raise

2026-08-17 18:46:48 +02:00

test_feed_keyset.py

test(feed): keyset paging reproduces the unpaged order for every sort (E1 S2, TEST-2)

2026-08-18 01:23:07 +02:00

test_ffmpeg_callbacks.py

fix(player): give YouTube's own fullscreen a working path + round-6 findings

2026-07-24 02:16:58 +02:00

test_formats.py

refactor(downloads): introduce SourceAdapter — a thin per-source Strategy over yt-dlp

2026-08-13 00:34:42 +02:00

test_gc.py

fix(downloads): shell-safe names, refresh display_name on re-download, GC orphan sweep

2026-07-22 03:18:14 +02:00

test_links.py

feat(security): R4 S3 — abuse & leak hardening

2026-07-23 03:38:57 +02:00

test_migrations.py

test(migrations): model<->schema drift + downgrade/re-upgrade (E1 S2, TEST-3)

2026-08-18 01:23:07 +02:00

test_naming.py

fix(downloads): shell-safe names, refresh display_name on re-download, GC orphan sweep

2026-07-22 03:18:14 +02:00

test_notifications.py

fix(downloads): derive title clamp from the column + real-Postgres regression

2026-08-16 19:40:17 +02:00

test_oauth_redirect.py

refactor(auth): split app/auth.py — endpoints to app/routes/auth.py

2026-08-11 22:01:14 +02:00

test_og.py

fix(share): declare og:image dimensions so the FB card includes the image on first scrape

2026-07-28 01:54:14 +02:00

test_plex_detail.py

feat(plex): S6 backend — language-aware serving + IMDb-only rating

2026-08-17 19:07:43 +02:00

test_plex_facets.py

test(db): harden the DB lane per code-review (R6 S3)

2026-07-26 15:09:25 +02:00

test_plex_field_scoped_search.py

feat(plex): field-scoped search (S2) + instant search typeahead

2026-08-16 08:05:18 +02:00

test_plex_jsonb_normalize.py

test(db): /facets regression + S3a jsonb-null normalization (R6 S3)

2026-07-26 13:54:42 +02:00

test_plex_lang.py

fix(plex): address S6 code-review — 5 findings

2026-08-17 20:41:13 +02:00

test_plex_overlay.py

fix(plex): S5a review round 2 — dup-HU guard + tests for dup-guid & guid-keep

2026-08-16 22:38:59 +02:00

test_plex_person.py

feat(plex): S4 actor detail page — filmography endpoint + person subview

2026-08-16 21:26:58 +02:00

test_plex_query_conversion.py

fix(plex): address S1 review round-2 findings

2026-08-16 07:14:09 +02:00

test_plex_stream.py

fix(plex): give the sweep's boot-time cutoff cross-clock slack

2026-07-24 04:52:41 +02:00

test_plex_sync_txn.py

fix(plex): make cast enrichment insert conflict-safe

2026-08-09 00:09:22 +02:00

test_quota_ownership.py

test(backfill): lock the per-page durability and reserve-guard properties

2026-08-16 03:02:37 +02:00

test_request_models.py

fix(api): accept fractional progress seconds (R6 S1b code-review round 1)

2026-07-26 05:39:32 +02:00

test_run_ffmpeg.py

fix(r5): address the fifth /code-review high round — 6 findings

2026-07-24 01:50:50 +02:00

test_scheduler.py

fix(scheduler): move the single-run claim into _job (cover both paths)

2026-07-23 03:50:04 +02:00

test_smoke.py

test(backend): pure-logic pytest harness, run in an isolated test image

2026-07-21 03:29:24 +02:00

test_storage.py

fix(downloads): tighten SourceAdapter resolution + neutral nfo default (review)

2026-08-13 01:09:38 +02:00

test_sync_guards.py

fix(r5): address the eighth /code-review high round — 7 findings

2026-07-24 04:44:20 +02:00

test_thumbnail_poster.py

fix(downloads): stop a ReDoS title and a fatal thumbnail convert from wedging/killing downloads

2026-08-12 18:27:35 +02:00

test_titles.py

refactor(downloads): address /code-review on the download hotfix

2026-08-12 18:47:01 +02:00

test_userscope.py

fix(scheduler): move the single-run claim into _job (cover both paths)

2026-07-23 03:50:04 +02:00

test_utils.py

refactor(api): code-review fixes — widen iso() to date, fix import order (R6 S1a)

2026-07-26 04:25:40 +02:00

test_worker_supervisor.py

fix(downloads): revive the worker cancel branch and guard terminal writes (B-sub-1)

2026-08-18 00:21:43 +02:00