feat: add test suites for backup schedules, service config, auth token, bookmarks, content permissions, devii adopt, and devrant auth

Add comprehensive test coverage for seven new API areas:
- Backup schedules CRUD operations in admin panel
- Service configuration saving and retrieval for news AI model
- Token authentication with email/username and JSON body support
- Bookmarking for project and news targets with invalid type validation
- Content permissions testing with member and admin session fixtures
- Devii adopt endpoint redirect behavior and session cookie handling
- Devrant authentication flow with user registration and token retrieval

tests/api/tools/deepsearch/control.py

@@ -0,0 +1,98 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import (
+    create_deepsearch_session,
+    get_table,
+    refresh_snapshot,
+    set_setting,
+)
+from devplacepy.services.jobs import queue
+
+JSON = {"Accept": "application/json"}
+_counter_ds = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _settings(app_server):
+    set_setting("rate_limit_per_minute", "1000000")
+    set_setting("registration_open", "1")
+    yield
+
+
+def _user():
+    _counter_ds[0] += 1
+    name = f"dsc{int(time.time() * 1000)}{_counter_ds[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    return user["uid"], user["api_key"]
+
+
+def _seed_session(owner_id, with_session=True):
+    uid = queue.enqueue(
+        "deepsearch",
+        {"query": "q", "depth": 1, "max_pages": 5},
+        "user",
+        owner_id,
+        "DeepSearch",
+    )
+    if with_session:
+        create_deepsearch_session(
+            uid, "user", owner_id, "q", 1, 5, f"ds_{uid.replace('-', '')}"
+        )
+    refresh_snapshot()
+    return uid
+
+
+def test_pause_resume_cancel_owner(app_server):
+    uid_owner, key = _user()
+    uid = _seed_session(uid_owner)
+    h = {"X-API-KEY": key, **JSON}
+    for action, state in (("pause", "paused"), ("resume", "running"), ("cancel", "cancelled")):
+        r = requests.post(f"{BASE_URL}/tools/deepsearch/{uid}/{action}", headers=h)
+        assert r.status_code == 200, f"{action}: {r.text[:200]}"
+        assert r.json()["ok"] is True
+        assert r.json()["state"] == state
+
+
+def test_control_non_owner_forbidden(app_server):
+    owner_uid, _ = _user()
+    _, other_key = _user()
+    uid = _seed_session(owner_uid)
+    r = requests.post(
+        f"{BASE_URL}/tools/deepsearch/{uid}/pause",
+        headers={"X-API-KEY": other_key, **JSON},
+    )
+    assert r.status_code == 403
+
+
+def test_control_unknown_uid_404(app_server):
+    _, key = _user()
+    r = requests.post(
+        f"{BASE_URL}/tools/deepsearch/no-such-uid/pause",
+        headers={"X-API-KEY": key, **JSON},
+    )
+    assert r.status_code == 404
+
+
+def test_control_job_without_session_404(app_server):
+    owner_uid, key = _user()
+    uid = _seed_session(owner_uid, with_session=False)
+    r = requests.post(
+        f"{BASE_URL}/tools/deepsearch/{uid}/pause",
+        headers={"X-API-KEY": key, **JSON},
+    )
+    assert r.status_code == 404

tests/api/tools/deepsearch/export.py

@@ -0,0 +1,72 @@
+# retoor <retoor@molodetz.nl>
+
+import json
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import create_deepsearch_session, get_table, refresh_snapshot, set_setting
+from devplacepy.services.jobs import queue
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _settings(app_server):
+    set_setting("rate_limit_per_minute", "1000000")
+    yield
+
+
+def _weasyprint_available() -> bool:
+    try:
+        import weasyprint
+
+        weasyprint.HTML(string="<p>x</p>").write_pdf()
+        return True
+    except Exception:
+        return False
+
+
+def _seed_done(owner_id="ds-export-owner"):
+    uid = queue.enqueue(
+        "deepsearch", {"query": "q", "depth": 1, "max_pages": 5}, "user", owner_id, "DeepSearch"
+    )
+    create_deepsearch_session(uid, "user", owner_id, "q", 1, 5, f"ds_{uid.replace('-', '')}")
+    report = {
+        "query": "q",
+        "summary": "A grounded summary.",
+        "findings": [{"title": "F1", "detail": "d", "confidence": 0.8, "citations": [1]}],
+        "gaps": ["gap"],
+        "sources": [{"url": "https://example.com", "title": "Example", "source": "httpx"}],
+        "score": 70,
+        "confidence": 0.7,
+        "source_diversity": 0.5,
+        "page_count": 3,
+        "chunk_count": 12,
+    }
+    get_table("jobs").update(
+        {"uid": uid, "status": queue.DONE, "result": json.dumps({"report": report})}, ["uid"]
+    )
+    refresh_snapshot()
+    return uid
+
+
+def test_export_pdf_when_ready(app_server):
+    if not _weasyprint_available():
+        pytest.skip("weasyprint native deps (libpango) not installed in this environment")
+    uid = _seed_done()
+    r = requests.get(f"{BASE_URL}/tools/deepsearch/{uid}/export.pdf")
+    assert r.status_code == 200, r.text[:200]
+    assert "application/pdf" in r.headers.get("content-type", "")
+    assert r.content[:5] == b"%PDF-"
+
+
+def test_export_pdf_not_ready_404(app_server):
+    uid = queue.enqueue(
+        "deepsearch", {"query": "q"}, "user", "ds-export-pending", "DeepSearch"
+    )
+    refresh_snapshot()
+    r = requests.get(f"{BASE_URL}/tools/deepsearch/{uid}/export.pdf")
+    assert r.status_code == 404
+
+
+def test_export_pdf_unknown_404(app_server):
+    r = requests.get(f"{BASE_URL}/tools/deepsearch/nope-uid/export.pdf")
+    assert r.status_code == 404