feat: add test suites for backup schedules, service config, auth token, bookmarks, content permissions, devii adopt, and devrant auth

Add comprehensive test coverage for seven new API areas:
- Backup schedules CRUD operations in admin panel
- Service configuration saving and retrieval for news AI model
- Token authentication with email/username and JSON body support
- Bookmarking for project and news targets with invalid type validation
- Content permissions testing with member and admin session fixtures
- Devii adopt endpoint redirect behavior and session cookie handling
- Devrant authentication flow with user registration and token retrieval

tests/api/xmlrpc/index.py

@@ -0,0 +1,164 @@
+# retoor <retoor@molodetz.nl>
+
+import os
+import sys
+import time
+import socket
+import subprocess
+import xmlrpc.client
+
+import pytest
+import requests
+from tests.conftest import BASE_URL, PROJECT_ROOT
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+BRIDGE_PORT = 10566
+_counter_rpc = [0]
+
+
+def _port_open(port):
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.settimeout(0.5)
+        return sock.connect_ex(("127.0.0.1", port)) == 0
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _rpc_settings(app_server):
+    set_setting("rate_limit_per_minute", "1000000")
+    set_setting("registration_open", "1")
+    yield
+
+
+@pytest.fixture(scope="module")
+def bridge(app_server):
+    """Run the XML-RPC bridge against the test server on a dedicated free port.
+
+    The proxy route (``/xmlrpc``) targets the default bridge port (10550), which a
+    locally-running dev server may already occupy and forward to its own DB. Driving
+    a dedicated bridge directly keeps this test hermetic: the bridge still forwards to
+    the live test REST server, so method dispatch, auth and faults are exercised end
+    to end regardless of the host environment.
+    """
+    env = os.environ.copy()
+    env["DEVPLACE_INTERNAL_BASE_URL"] = BASE_URL
+    env["DEVPLACE_XMLRPC_BIND"] = "127.0.0.1"
+    env["DEVPLACE_XMLRPC_PORT"] = str(BRIDGE_PORT)
+    env["PYTHONUNBUFFERED"] = "1"
+    proc = subprocess.Popen(
+        [sys.executable, "-m", "devplacepy.services.xmlrpc.server"],
+        cwd=str(PROJECT_ROOT),
+        env=env,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.STDOUT,
+    )
+    deadline = time.time() + 20
+    while time.time() < deadline:
+        if _port_open(BRIDGE_PORT):
+            break
+        if proc.poll() is not None:
+            raise RuntimeError("XML-RPC bridge process died during startup")
+        time.sleep(0.3)
+    else:
+        proc.terminate()
+        raise RuntimeError("XML-RPC bridge did not start")
+    yield proc
+    proc.terminate()
+    try:
+        proc.wait(timeout=5)
+    except Exception:
+        proc.kill()
+
+
+def _proxy():
+    return xmlrpc.client.ServerProxy(
+        f"http://127.0.0.1:{BRIDGE_PORT}/", allow_none=True
+    )
+
+
+def _api_key():
+    _counter_rpc[0] += 1
+    name = f"rpc{int(time.time() * 1000)}{_counter_rpc[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    return name, user["uid"], user["api_key"]
+
+
+def test_get_usage_text(app_server):
+    r = requests.get(f"{BASE_URL}/xmlrpc")
+    assert r.status_code == 200
+    assert "system.listMethods" in r.text
+    assert "XML-RPC" in r.text
+
+
+def test_get_usage_on_subpath(app_server):
+    r = requests.get(f"{BASE_URL}/xmlrpc/anything")
+    assert r.status_code == 200
+    assert "system.listMethods" in r.text
+
+
+def test_list_methods(bridge):
+    methods = _proxy().system.listMethods()
+    assert isinstance(methods, list)
+    assert "system.listMethods" in methods
+    assert "posts.create" in methods
+    assert "feed.list" in methods
+
+
+def test_method_help_introspection(bridge):
+    help_text = _proxy().system.methodHelp("posts.create")
+    assert isinstance(help_text, str) and help_text
+
+
+def test_read_method_forwarded(bridge):
+    result = _proxy().feed.list({})
+    assert result is not None
+
+
+def test_authenticated_write_creates_post(bridge):
+    name, uid, key = _api_key()
+    _proxy().posts.create(
+        {
+            "title": "rpc title",
+            "content": "created via the xml-rpc bridge end to end",
+            "topic": "devlog",
+            "api_key": key,
+        }
+    )
+    refresh_snapshot()
+    assert get_table("posts").count(user_uid=uid, deleted_at=None) == 1
+
+
+def test_unauthenticated_write_creates_nothing(bridge):
+    name, uid, key = _api_key()
+    try:
+        _proxy().posts.create(
+            {"title": "no auth", "content": "no api key supplied here", "topic": "devlog"}
+        )
+    except xmlrpc.client.Fault:
+        pass
+    refresh_snapshot()
+    assert get_table("posts").count(user_uid=uid, deleted_at=None) == 0
+
+
+def test_missing_required_param_raises_fault(bridge):
+    with pytest.raises(xmlrpc.client.Fault):
+        _proxy().posts.create({})
+
+
+def test_multicall(bridge):
+    multi = xmlrpc.client.MultiCall(_proxy())
+    multi.system.listMethods()
+    multi.system.listMethods()
+    results = list(multi())
+    assert len(results) == 2
+    assert "system.listMethods" in results[0]