chore: reorganize test files into domain-specific subdirectories

tests/api/projects/create.py

@@ -0,0 +1,57 @@
+# retoor <retoor@molodetz.nl>
+
+import io
+import re
+import uuid
+import requests
+from PIL import Image
+from tests.conftest import BASE_URL
+def _user_uploads(prefix="up"):
+    s = requests.Session()
+    name = f"{prefix}_{uuid.uuid4().hex[:10]}"
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@test.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+def _session_uploads():
+    s, _ = _user_uploads()
+    return s
+def _png_bytes_uploads():
+    buf = io.BytesIO()
+    Image.new("RGB", (4, 4), (255, 0, 0)).save(buf, "PNG")
+    return buf.getvalue()
+def _upload_uploads(s, name="a.png"):
+    r = s.post(
+        f"{BASE_URL}/uploads/upload", files={"file": (name, _png_bytes_uploads(), "image/png")}
+    )
+    assert r.status_code == 201, r.text
+    return r.json()["uid"]
+
+
+def test_project_links_multiple_attachments(app_server):
+    s = _session_uploads()
+    u1, u2 = _upload_uploads(s), _upload_uploads(s)
+    r = s.post(
+        f"{BASE_URL}/projects/create",
+        data={
+            "title": "Attach Project",
+            "description": "Project with attachments",
+            "project_type": "software",
+            "platforms": "linux",
+            "status": "In Development",
+            "attachment_uids": f"{u1},{u2}",
+        },
+        allow_redirects=True,
+    )
+    assert r.status_code == 200, r.text[:300]
+    assert "/projects/" in r.url, r.url
+    assert u1 in r.text and u2 in r.text, (
+        "both attachments must be linked and displayed on the project"
+    )

tests/api/projects/delete.py

@@ -0,0 +1,220 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+_counter_project_files = [0]
+def _signup_project_files():
+    _counter_project_files[0] += 1
+    name = f"pf{int(time.time() * 1000)}{_counter_project_files[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    key = get_table("users").find_one(username=name)["api_key"]
+    return name, key
+def _h_project_files(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_project_files(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_project_files(key),
+        data={
+            "title": title,
+            "description": "filesystem test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_project_files(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_files(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _mkdir(key, slug, path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/mkdir",
+        headers=_h_project_files(key),
+        data={"path": path},
+        allow_redirects=False,
+    )
+def _move(key, slug, from_path, to_path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/move",
+        headers=_h_project_files(key),
+        data={"from_path": from_path, "to_path": to_path},
+        allow_redirects=False,
+    )
+def _delete(key, slug, path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/delete",
+        headers=_h_project_files(key),
+        data={"path": path},
+        allow_redirects=False,
+    )
+def _list(slug, key=None):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files",
+        headers=_h_project_files(key) if key else {"Accept": "application/json"},
+    )
+def _raw_project_files(slug, path, key=None):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files/raw",
+        params={"path": path},
+        headers=_h_project_files(key) if key else {"Accept": "application/json"},
+    )
+def _paths(slug, key=None):
+    return sorted(f["path"] for f in _list(slug, key).json()["files"])
+def _make_project_ui(page, title):
+    page.goto(f"{BASE_URL}/projects", wait_until="domcontentloaded")
+    page.locator("#create-project-btn").click()
+    page.fill("#title", title)
+    page.fill("#description", "Project for filesystem UI test")
+    page.click("button:has-text('Create Project')")
+    page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
+    return page.url
+def _open_files(page, title):
+    proj_url = _make_project_ui(page, title)
+    slug = proj_url.rstrip("/").split("/")[-1]
+    page.goto(proj_url + "/files", wait_until="domcontentloaded")
+    return slug
+def _dialog_fill(page, value):
+    page.locator(".dialog-overlay.visible .dialog-input").wait_for(state="visible")
+    page.fill(".dialog-overlay.visible .dialog-input", value)
+    page.click(".dialog-overlay.visible .dialog-confirm")
+def _dialog_confirm(page):
+    page.locator(".dialog-overlay.visible .dialog-confirm").wait_for(state="visible")
+    page.click(".dialog-overlay.visible .dialog-confirm")
+def _dialog_cancel(page):
+    page.locator(".dialog-overlay.visible .dialog-cancel").wait_for(state="visible")
+    page.click(".dialog-overlay.visible .dialog-cancel")
+def _new_folder(page, name):
+    page.click("#pf-new-folder")
+    _dialog_fill(page, name)
+    page.wait_for_selector(f".pf-node-row:has-text('{name.split('/')[-1]}')")
+def _new_file(page, name):
+    page.click("#pf-new-file")
+    _dialog_fill(page, name)
+def _row(page, name):
+    return page.locator(f".pf-node-row:has-text('{name}')").first
+def _alice_key():
+    return get_table("users").find_one(username="alice_test")["api_key"]
+import pytest
+from devplacepy.utils import clear_user_cache
+from devplacepy import project_files
+from devplacepy.project_files import ProjectFileError
+from devplacepy.services.devii.actions.dispatcher import (
+    confirmation_error,
+    _is_confirmed,
+)
+_counter_project_visibility = [0]
+def _signup_project_visibility():
+    _counter_project_visibility[0] += 1
+    name = f"pv{int(time.time() * 1000)}{_counter_project_visibility[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return name, row["uid"], row["api_key"]
+def _make_admin_project_visibility():
+    name, uid, key = _signup_project_visibility()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    return name, uid, key
+def _h_project_visibility(key=None):
+    headers = {"Accept": "application/json"}
+    if key:
+        headers["X-API-KEY"] = key
+    return headers
+def _create_project_project_visibility(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "visibility test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_h_project_visibility(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _project_uid(slug):
+    return get_table("projects").find_one(slug=slug)["uid"]
+def _write_project_visibility(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_visibility(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _set_private(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/private",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _set_readonly(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/readonly",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _list_slugs(key=None, user_uid=None):
+    params = {"user_uid": user_uid} if user_uid else None
+    r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
+    return [p["slug"] for p in r.json()["projects"]]
+
+
+def test_project_delete_purges_files(app_server):
+    _, key = _signup_project_files()
+    project = _create_project_project_files(key, "FS Cascade")
+    slug, uid = project["slug"], project["uid"]
+    _write_project_files(key, slug, "src/a.py", "1")
+    _write_project_files(key, slug, "src/b.py", "2")
+    assert get_table("project_files").count(project_uid=uid) == 3
+    r = requests.post(
+        f"{BASE_URL}/projects/delete/{slug}", headers=_h_project_files(key), allow_redirects=False
+    )
+    assert r.status_code in (200, 302)
+    from devplacepy.database import refresh_snapshot
+
+    refresh_snapshot()
+    assert get_table("project_files").count(project_uid=uid, deleted_at=None) == 0
+
+
+def test_delete_project_works_when_readonly(app_server):
+    _, _, key = _signup_project_visibility()
+    project = _create_project_project_visibility(key, "Readonly Delete")
+    slug = project["slug"]
+    _write_project_visibility(key, slug, "a.txt", "one")
+    _set_readonly(key, slug, True)
+    r = requests.post(
+        f"{BASE_URL}/projects/delete/{slug}", headers=_h_project_visibility(key), allow_redirects=False
+    )
+    assert r.status_code == 200 and r.json()["ok"] is True
+    assert (
+        requests.get(f"{BASE_URL}/projects/{slug}", headers=_h_project_visibility(key)).status_code == 404
+    )

tests/api/projects/edit.py

@@ -0,0 +1,117 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+from devplacepy.utils import clear_user_cache
+from devplacepy import project_files
+from devplacepy.project_files import ProjectFileError
+from devplacepy.services.devii.actions.dispatcher import (
+    confirmation_error,
+    _is_confirmed,
+)
+_counter_project_visibility = [0]
+def _signup_project_visibility():
+    _counter_project_visibility[0] += 1
+    name = f"pv{int(time.time() * 1000)}{_counter_project_visibility[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return name, row["uid"], row["api_key"]
+def _make_admin_project_visibility():
+    name, uid, key = _signup_project_visibility()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    return name, uid, key
+def _h_project_visibility(key=None):
+    headers = {"Accept": "application/json"}
+    if key:
+        headers["X-API-KEY"] = key
+    return headers
+def _create_project_project_visibility(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "visibility test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_h_project_visibility(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _project_uid(slug):
+    return get_table("projects").find_one(slug=slug)["uid"]
+def _write_project_visibility(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_visibility(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _set_private(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/private",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _set_readonly(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/readonly",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _list_slugs(key=None, user_uid=None):
+    params = {"user_uid": user_uid} if user_uid else None
+    r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
+    return [p["slug"] for p in r.json()["projects"]]
+
+
+def test_owner_can_edit_project(app_server):
+    _, _, key = _signup_project_visibility()
+    slug = _create_project_project_visibility(key, "Editable Via Api")["slug"]
+    r = requests.post(
+        f"{BASE_URL}/projects/edit/{slug}",
+        headers=_h_project_visibility(key),
+        data={
+            "title": "Edited Via Api",
+            "description": "updated description body",
+            "project_type": "website",
+            "status": "Released",
+            "platforms": "Linux,Web",
+        },
+        allow_redirects=False,
+    )
+    assert r.status_code == 200 and r.json()["ok"] is True
+    row = get_table("projects").find_one(slug=slug)
+    assert row["title"] == "Edited Via Api"
+    assert row["status"] == "Released"
+    assert row["project_type"] == "website"
+    assert row["platforms"] == "Linux,Web"
+
+
+def test_non_owner_cannot_edit_project(app_server):
+    _, _, owner_key = _signup_project_visibility()
+    slug = _create_project_project_visibility(owner_key, "Owner Edit Guard")["slug"]
+    _, _, other_key = _signup_project_visibility()
+    r = requests.post(
+        f"{BASE_URL}/projects/edit/{slug}",
+        headers=_h_project_visibility(other_key),
+        data={"title": "Hijacked", "description": "should not persist"},
+        allow_redirects=False,
+    )
+    assert r.status_code == 403
+    assert get_table("projects").find_one(slug=slug)["title"] == "Owner Edit Guard"

tests/api/projects/files/lines.py

@@ -0,0 +1,113 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import init_db, get_table
+from devplacepy import project_files as pf
+from devplacepy.project_files import ProjectFileError
+@pytest.fixture(autouse=True)
+def _init_db_project_file_lines():
+    init_db()
+    yield
+_pid = [0]
+def _project():
+    _pid[0] += 1
+    pid = f"plines-{_pid[0]}"
+    user = {"uid": f"plines-owner-{_pid[0]}"}
+    return pid, user
+_counter_project_file_lines = [0]
+def _signup_project_file_lines():
+    _counter_project_file_lines[0] += 1
+    name = f"pl{int(time.time() * 1000)}{_counter_project_file_lines[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return name, get_table("users").find_one(username=name)["api_key"]
+def _h_project_file_lines(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_project_file_lines(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_project_file_lines(key),
+        data={
+            "title": title,
+            "description": "lines test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_project_file_lines(key, slug, path, content):
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_file_lines(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+    assert r.status_code in (200, 302), r.text
+def _raw_project_file_lines(key, slug, path):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files/raw", headers=_h_project_file_lines(key), params={"path": path}
+    ).json()
+class _FakeResponse:
+    def __init__(self, status_code=200):
+        self.status_code = status_code
+class _FakeClient:
+    authenticated = True
+    username = "u"
+
+    def __init__(self):
+        self.calls = []
+
+    async def call(
+        self, method, path, params=None, data=None, file_field=None, headers=None
+    ):
+        self.calls.append((method, path))
+        return _FakeResponse()
+def _make_dispatcher():
+    import devplacepy.services.devii.actions.dispatcher as disp
+    from devplacepy.services.devii.actions.catalog import PLATFORM_CATALOG
+
+    d = disp.Dispatcher.__new__(disp.Dispatcher)
+    d._actions = PLATFORM_CATALOG.by_name()
+    d._client = _FakeClient()
+    d._read_files = set()
+    return disp, d
+
+
+def test_http_read_lines(app_server):
+    _, key = _signup_project_file_lines()
+    proj = _create_project_project_file_lines(key, "HTTP Read Lines")
+    slug = proj["slug"] or proj["uid"]
+    _write_project_file_lines(key, slug, "f.txt", "a\nb\nc\nd")
+    r = requests.get(
+        f"{BASE_URL}/projects/{slug}/files/lines",
+        headers=_h_project_file_lines(key),
+        params={"path": "f.txt", "start": 2, "end": 3},
+    )
+    assert r.status_code == 200
+    body = r.json()
+    assert body["lines"] == ["b", "c"]
+    assert body["total_lines"] == 4
+
+
+def test_http_lines_missing_file_404(app_server):
+    _, key = _signup_project_file_lines()
+    proj = _create_project_project_file_lines(key, "HTTP Lines 404")
+    slug = proj["slug"] or proj["uid"]
+    r = requests.get(
+        f"{BASE_URL}/projects/{slug}/files/lines",
+        headers=_h_project_file_lines(key),
+        params={"path": "nope.txt"},
+    )
+    assert r.status_code == 404

tests/api/projects/files/raw.py

@@ -0,0 +1,116 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+from devplacepy.utils import clear_user_cache
+from devplacepy import project_files
+from devplacepy.project_files import ProjectFileError
+from devplacepy.services.devii.actions.dispatcher import (
+    confirmation_error,
+    _is_confirmed,
+)
+_counter_project_visibility = [0]
+def _signup_project_visibility():
+    _counter_project_visibility[0] += 1
+    name = f"pv{int(time.time() * 1000)}{_counter_project_visibility[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return name, row["uid"], row["api_key"]
+def _make_admin_project_visibility():
+    name, uid, key = _signup_project_visibility()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    return name, uid, key
+def _h_project_visibility(key=None):
+    headers = {"Accept": "application/json"}
+    if key:
+        headers["X-API-KEY"] = key
+    return headers
+def _create_project_project_visibility(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "visibility test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_h_project_visibility(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _project_uid(slug):
+    return get_table("projects").find_one(slug=slug)["uid"]
+def _write_project_visibility(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_visibility(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _set_private(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/private",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _set_readonly(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/readonly",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _list_slugs(key=None, user_uid=None):
+    params = {"user_uid": user_uid} if user_uid else None
+    r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
+    return [p["slug"] for p in r.json()["projects"]]
+
+
+def test_private_files_hidden_from_guest(app_server):
+    _, _, key = _signup_project_visibility()
+    slug = _create_project_project_visibility(key, "Private Files", is_private=True)["slug"]
+    _write_project_visibility(key, slug, "secret.txt", "classified")
+    assert (
+        requests.get(f"{BASE_URL}/projects/{slug}/files", headers=_h_project_visibility()).status_code
+        == 404
+    )
+    assert (
+        requests.get(
+            f"{BASE_URL}/projects/{slug}/files/raw",
+            params={"path": "secret.txt"},
+            headers=_h_project_visibility(),
+        ).status_code
+        == 404
+    )
+    assert (
+        requests.get(f"{BASE_URL}/projects/{slug}/files", headers=_h_project_visibility(key)).status_code
+        == 200
+    )
+
+
+def test_readonly_unchanged_content(app_server):
+    _, _, key = _signup_project_visibility()
+    slug = _create_project_project_visibility(key, "Readonly Content")["slug"]
+    _write_project_visibility(key, slug, "a.txt", "original")
+    _set_readonly(key, slug, True)
+    _write_project_visibility(key, slug, "a.txt", "tampered")
+    body = requests.get(
+        f"{BASE_URL}/projects/{slug}/files/raw",
+        params={"path": "a.txt"},
+        headers=_h_project_visibility(key),
+    ).json()
+    assert body["content"] == "original"

tests/api/projects/files/replacelines.py

@@ -0,0 +1,272 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import init_db, get_table
+from devplacepy import project_files as pf
+from devplacepy.project_files import ProjectFileError
+@pytest.fixture(autouse=True)
+def _init_db_project_file_lines():
+    init_db()
+    yield
+_pid = [0]
+def _project():
+    _pid[0] += 1
+    pid = f"plines-{_pid[0]}"
+    user = {"uid": f"plines-owner-{_pid[0]}"}
+    return pid, user
+_counter_project_file_lines = [0]
+def _signup_project_file_lines():
+    _counter_project_file_lines[0] += 1
+    name = f"pl{int(time.time() * 1000)}{_counter_project_file_lines[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return name, get_table("users").find_one(username=name)["api_key"]
+def _h_project_file_lines(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_project_file_lines(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_project_file_lines(key),
+        data={
+            "title": title,
+            "description": "lines test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_project_file_lines(key, slug, path, content):
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_file_lines(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+    assert r.status_code in (200, 302), r.text
+def _raw_project_file_lines(key, slug, path):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files/raw", headers=_h_project_file_lines(key), params={"path": path}
+    ).json()
+class _FakeResponse:
+    def __init__(self, status_code=200):
+        self.status_code = status_code
+class _FakeClient:
+    authenticated = True
+    username = "u"
+
+    def __init__(self):
+        self.calls = []
+
+    async def call(
+        self, method, path, params=None, data=None, file_field=None, headers=None
+    ):
+        self.calls.append((method, path))
+        return _FakeResponse()
+def _make_dispatcher():
+    import devplacepy.services.devii.actions.dispatcher as disp
+    from devplacepy.services.devii.actions.catalog import PLATFORM_CATALOG
+
+    d = disp.Dispatcher.__new__(disp.Dispatcher)
+    d._actions = PLATFORM_CATALOG.by_name()
+    d._client = _FakeClient()
+    d._read_files = set()
+    return disp, d
+from devplacepy.database import get_table
+from devplacepy.utils import clear_user_cache
+from devplacepy import project_files
+from devplacepy.services.devii.actions.dispatcher import (
+    confirmation_error,
+    _is_confirmed,
+)
+_counter_project_visibility = [0]
+def _signup_project_visibility():
+    _counter_project_visibility[0] += 1
+    name = f"pv{int(time.time() * 1000)}{_counter_project_visibility[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return name, row["uid"], row["api_key"]
+def _make_admin_project_visibility():
+    name, uid, key = _signup_project_visibility()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    return name, uid, key
+def _h_project_visibility(key=None):
+    headers = {"Accept": "application/json"}
+    if key:
+        headers["X-API-KEY"] = key
+    return headers
+def _create_project_project_visibility(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "visibility test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_h_project_visibility(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _project_uid(slug):
+    return get_table("projects").find_one(slug=slug)["uid"]
+def _write_project_visibility(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_visibility(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _set_private(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/private",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _set_readonly(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/readonly",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _list_slugs(key=None, user_uid=None):
+    params = {"user_uid": user_uid} if user_uid else None
+    r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
+    return [p["slug"] for p in r.json()["projects"]]
+
+
+def test_http_replace_insert_delete_append_roundtrip(app_server):
+    _, key = _signup_project_file_lines()
+    proj = _create_project_project_file_lines(key, "HTTP Edit Roundtrip")
+    slug = proj["slug"] or proj["uid"]
+    _write_project_file_lines(key, slug, "f.txt", "a\nb\nc\nd")
+    requests.post(
+        f"{BASE_URL}/projects/{slug}/files/replace-lines",
+        headers=_h_project_file_lines(key),
+        data={"path": "f.txt", "start": 2, "end": 3, "content": "X\nY"},
+        allow_redirects=False,
+    )
+    assert _raw_project_file_lines(key, slug, "f.txt")["content"] == "a\nX\nY\nd"
+    requests.post(
+        f"{BASE_URL}/projects/{slug}/files/insert-lines",
+        headers=_h_project_file_lines(key),
+        data={"path": "f.txt", "at": 1, "content": "TOP"},
+        allow_redirects=False,
+    )
+    assert _raw_project_file_lines(key, slug, "f.txt")["content"] == "TOP\na\nX\nY\nd"
+    requests.post(
+        f"{BASE_URL}/projects/{slug}/files/delete-lines",
+        headers=_h_project_file_lines(key),
+        data={"path": "f.txt", "start": 1, "end": 1},
+        allow_redirects=False,
+    )
+    assert _raw_project_file_lines(key, slug, "f.txt")["content"] == "a\nX\nY\nd"
+    requests.post(
+        f"{BASE_URL}/projects/{slug}/files/append",
+        headers=_h_project_file_lines(key),
+        data={"path": "f.txt", "content": "END"},
+        allow_redirects=False,
+    )
+    assert _raw_project_file_lines(key, slug, "f.txt")["content"] == "a\nX\nY\nd\nEND"
+
+
+def test_http_replace_lines_non_owner_denied(app_server):
+    _, owner_key = _signup_project_file_lines()
+    _, other_key = _signup_project_file_lines()
+    proj = _create_project_project_file_lines(owner_key, "HTTP Owner Guard")
+    slug = proj["slug"] or proj["uid"]
+    _write_project_file_lines(owner_key, slug, "f.txt", "a\nb")
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/replace-lines",
+        headers=_h_project_file_lines(other_key),
+        data={"path": "f.txt", "start": 1, "end": 1, "content": "x"},
+        allow_redirects=False,
+    )
+    assert r.status_code == 403
+
+
+def test_readonly_blocks_every_mutation(app_server):
+    _, _, key = _signup_project_visibility()
+    slug = _create_project_project_visibility(key, "Readonly Block")["slug"]
+    _write_project_visibility(key, slug, "main.py", "print(1)\n")
+    assert _set_readonly(key, slug, True).status_code == 200
+
+    assert _write_project_visibility(key, slug, "main.py", "print(2)\n").status_code == 400
+    assert _write_project_visibility(key, slug, "new.py", "print(3)\n").status_code == 400
+    assert (
+        requests.post(
+            f"{BASE_URL}/projects/{slug}/files/mkdir",
+            headers=_h_project_visibility(key),
+            data={"path": "docs"},
+            allow_redirects=False,
+        ).status_code
+        == 400
+    )
+    assert (
+        requests.post(
+            f"{BASE_URL}/projects/{slug}/files/append",
+            headers=_h_project_visibility(key),
+            data={"path": "main.py", "content": "x"},
+            allow_redirects=False,
+        ).status_code
+        == 400
+    )
+    assert (
+        requests.post(
+            f"{BASE_URL}/projects/{slug}/files/replace-lines",
+            headers=_h_project_visibility(key),
+            data={"path": "main.py", "start": 1, "end": 1, "content": "z"},
+            allow_redirects=False,
+        ).status_code
+        == 400
+    )
+    assert (
+        requests.post(
+            f"{BASE_URL}/projects/{slug}/files/move",
+            headers=_h_project_visibility(key),
+            data={"from_path": "main.py", "to_path": "renamed.py"},
+            allow_redirects=False,
+        ).status_code
+        == 400
+    )
+    assert (
+        requests.post(
+            f"{BASE_URL}/projects/{slug}/files/delete",
+            headers=_h_project_visibility(key),
+            data={"path": "main.py"},
+            allow_redirects=False,
+        ).status_code
+        == 400
+    )
+    assert (
+        requests.post(
+            f"{BASE_URL}/projects/{slug}/files/upload",
+            headers=_h_project_visibility(key),
+            files={"file": ("u.py", b"x=1\n")},
+            data={"path": ""},
+        ).status_code
+        == 400
+    )

tests/api/projects/files/upload.py

@@ -0,0 +1,147 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+_counter_project_files = [0]
+def _signup_project_files():
+    _counter_project_files[0] += 1
+    name = f"pf{int(time.time() * 1000)}{_counter_project_files[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    key = get_table("users").find_one(username=name)["api_key"]
+    return name, key
+def _h_project_files(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_project_files(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_project_files(key),
+        data={
+            "title": title,
+            "description": "filesystem test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_project_files(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_files(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _mkdir(key, slug, path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/mkdir",
+        headers=_h_project_files(key),
+        data={"path": path},
+        allow_redirects=False,
+    )
+def _move(key, slug, from_path, to_path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/move",
+        headers=_h_project_files(key),
+        data={"from_path": from_path, "to_path": to_path},
+        allow_redirects=False,
+    )
+def _delete(key, slug, path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/delete",
+        headers=_h_project_files(key),
+        data={"path": path},
+        allow_redirects=False,
+    )
+def _list(slug, key=None):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files",
+        headers=_h_project_files(key) if key else {"Accept": "application/json"},
+    )
+def _raw_project_files(slug, path, key=None):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files/raw",
+        params={"path": path},
+        headers=_h_project_files(key) if key else {"Accept": "application/json"},
+    )
+def _paths(slug, key=None):
+    return sorted(f["path"] for f in _list(slug, key).json()["files"])
+def _make_project_ui(page, title):
+    page.goto(f"{BASE_URL}/projects", wait_until="domcontentloaded")
+    page.locator("#create-project-btn").click()
+    page.fill("#title", title)
+    page.fill("#description", "Project for filesystem UI test")
+    page.click("button:has-text('Create Project')")
+    page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
+    return page.url
+def _open_files(page, title):
+    proj_url = _make_project_ui(page, title)
+    slug = proj_url.rstrip("/").split("/")[-1]
+    page.goto(proj_url + "/files", wait_until="domcontentloaded")
+    return slug
+def _dialog_fill(page, value):
+    page.locator(".dialog-overlay.visible .dialog-input").wait_for(state="visible")
+    page.fill(".dialog-overlay.visible .dialog-input", value)
+    page.click(".dialog-overlay.visible .dialog-confirm")
+def _dialog_confirm(page):
+    page.locator(".dialog-overlay.visible .dialog-confirm").wait_for(state="visible")
+    page.click(".dialog-overlay.visible .dialog-confirm")
+def _dialog_cancel(page):
+    page.locator(".dialog-overlay.visible .dialog-cancel").wait_for(state="visible")
+    page.click(".dialog-overlay.visible .dialog-cancel")
+def _new_folder(page, name):
+    page.click("#pf-new-folder")
+    _dialog_fill(page, name)
+    page.wait_for_selector(f".pf-node-row:has-text('{name.split('/')[-1]}')")
+def _new_file(page, name):
+    page.click("#pf-new-file")
+    _dialog_fill(page, name)
+def _row(page, name):
+    return page.locator(f".pf-node-row:has-text('{name}')").first
+def _alice_key():
+    return get_table("users").find_one(username="alice_test")["api_key"]
+
+
+def test_upload_text_is_editable(app_server):
+    _, key = _signup_project_files()
+    slug = _create_project_project_files(key, "FS UploadText")["slug"]
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/upload",
+        headers=_h_project_files(key),
+        files={"file": ("util.py", b"x = 1\n")},
+        data={"path": "src"},
+    )
+    assert r.status_code == 200
+    node = _raw_project_files(slug, "src/util.py", key).json()
+    assert node["is_binary"] is False and node["content"] == "x = 1\n"
+
+
+def test_upload_binary_is_served(app_server):
+    _, key = _signup_project_files()
+    slug = _create_project_project_files(key, "FS UploadBinary")["slug"]
+    blob = bytes(range(256))
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/upload",
+        headers=_h_project_files(key),
+        files={"file": ("logo.bin", blob)},
+        data={"path": "assets"},
+    )
+    assert r.status_code == 200
+    node = _raw_project_files(slug, "assets/logo.bin", key).json()
+    assert node["is_binary"] is True and node["url"].startswith(
+        "/static/uploads/project_files/"
+    )
+    served = requests.get(BASE_URL + node["url"])
+    assert served.status_code == 200 and served.content == blob

tests/api/projects/files/write.py

@@ -0,0 +1,126 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+_counter_project_files = [0]
+def _signup_project_files():
+    _counter_project_files[0] += 1
+    name = f"pf{int(time.time() * 1000)}{_counter_project_files[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    key = get_table("users").find_one(username=name)["api_key"]
+    return name, key
+def _h_project_files(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_project_files(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_project_files(key),
+        data={
+            "title": title,
+            "description": "filesystem test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_project_files(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_files(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _mkdir(key, slug, path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/mkdir",
+        headers=_h_project_files(key),
+        data={"path": path},
+        allow_redirects=False,
+    )
+def _move(key, slug, from_path, to_path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/move",
+        headers=_h_project_files(key),
+        data={"from_path": from_path, "to_path": to_path},
+        allow_redirects=False,
+    )
+def _delete(key, slug, path):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/delete",
+        headers=_h_project_files(key),
+        data={"path": path},
+        allow_redirects=False,
+    )
+def _list(slug, key=None):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files",
+        headers=_h_project_files(key) if key else {"Accept": "application/json"},
+    )
+def _raw_project_files(slug, path, key=None):
+    return requests.get(
+        f"{BASE_URL}/projects/{slug}/files/raw",
+        params={"path": path},
+        headers=_h_project_files(key) if key else {"Accept": "application/json"},
+    )
+def _paths(slug, key=None):
+    return sorted(f["path"] for f in _list(slug, key).json()["files"])
+def _make_project_ui(page, title):
+    page.goto(f"{BASE_URL}/projects", wait_until="domcontentloaded")
+    page.locator("#create-project-btn").click()
+    page.fill("#title", title)
+    page.fill("#description", "Project for filesystem UI test")
+    page.click("button:has-text('Create Project')")
+    page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
+    return page.url
+def _open_files(page, title):
+    proj_url = _make_project_ui(page, title)
+    slug = proj_url.rstrip("/").split("/")[-1]
+    page.goto(proj_url + "/files", wait_until="domcontentloaded")
+    return slug
+def _dialog_fill(page, value):
+    page.locator(".dialog-overlay.visible .dialog-input").wait_for(state="visible")
+    page.fill(".dialog-overlay.visible .dialog-input", value)
+    page.click(".dialog-overlay.visible .dialog-confirm")
+def _dialog_confirm(page):
+    page.locator(".dialog-overlay.visible .dialog-confirm").wait_for(state="visible")
+    page.click(".dialog-overlay.visible .dialog-confirm")
+def _dialog_cancel(page):
+    page.locator(".dialog-overlay.visible .dialog-cancel").wait_for(state="visible")
+    page.click(".dialog-overlay.visible .dialog-cancel")
+def _new_folder(page, name):
+    page.click("#pf-new-folder")
+    _dialog_fill(page, name)
+    page.wait_for_selector(f".pf-node-row:has-text('{name.split('/')[-1]}')")
+def _new_file(page, name):
+    page.click("#pf-new-file")
+    _dialog_fill(page, name)
+def _row(page, name):
+    return page.locator(f".pf-node-row:has-text('{name}')").first
+def _alice_key():
+    return get_table("users").find_one(username="alice_test")["api_key"]
+
+
+def test_guest_write_blocked(app_server):
+    _, key = _signup_project_files()
+    slug = _create_project_project_files(key, "FS Guest")["slug"]
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        data={"path": "x.py", "content": "1"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (303, 401)
+    assert _paths(slug, key) == []

tests/api/projects/files/zip.py

@@ -0,0 +1,143 @@
+# retoor <retoor@molodetz.nl>
+
+import asyncio
+import io
+import json
+import time
+import zipfile
+from pathlib import Path
+import requests
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot
+from devplacepy.services.jobs import queue
+from devplacepy.services.jobs.zip_service import ZipService
+from tests.conftest import run_async
+_counter_zip_download = [0]
+def _signup_zip_download():
+    _counter_zip_download[0] += 1
+    name = f"zd{int(time.time() * 1000)}{_counter_zip_download[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    key = get_table("users").find_one(username=name)["api_key"]
+    return name, key
+def _h_zip_download(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_zip_download(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_zip_download(key),
+        data={
+            "title": title,
+            "description": "zip download test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_zip_download(key, slug, path, content):
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_zip_download(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+    assert r.status_code in (200, 302), r.text
+def _process_uid(uid):
+    async def drive():
+        svc = ZipService()
+        for _ in range(400):
+            await svc.run_once()
+            refresh_snapshot()
+            job = queue.get_job(uid)
+            if job and job["status"] in ("done", "failed"):
+                return
+            await asyncio.sleep(0.05)
+
+    run_async(drive())
+def _drain_pending():
+    async def drive():
+        svc = ZipService()
+        appeared = False
+        for _ in range(600):
+            refresh_snapshot()
+            pending = [
+                r
+                for r in get_table("jobs").find(kind="zip")
+                if r["status"] in ("pending", "running")
+            ]
+            if pending:
+                appeared = True
+            await svc.run_once()
+            refresh_snapshot()
+            pending = [
+                r
+                for r in get_table("jobs").find(kind="zip")
+                if r["status"] in ("pending", "running")
+            ]
+            if appeared and not pending and not svc._inflight:
+                return
+            await asyncio.sleep(0.05)
+
+    run_async(drive())
+def _cleanup_archives():
+    refresh_snapshot()
+    jobs = get_table("jobs")
+    for row in list(jobs.find(kind="zip")):
+        result = json.loads(row.get("result") or "{}")
+        local_path = result.get("local_path")
+        if local_path:
+            Path(local_path).unlink(missing_ok=True)
+        jobs.delete(uid=row["uid"])
+def _login_zip_download(page, name):
+    page.goto(f"{BASE_URL}/auth/login", wait_until="domcontentloaded")
+    page.fill("#email", f"{name}@t.dev")
+    page.fill("#password", "secret123")
+    page.click("button:has-text('Sign in')")
+    page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
+
+
+def test_files_zip_subtree_download(app_server):
+    try:
+        _, key = _signup_zip_download()
+        proj = _create_project_zip_download(key, "Subtree Flow")
+        slug = proj["slug"] or proj["uid"]
+        _write_zip_download(key, slug, "src/app.py", "print(1)\n")
+        _write_zip_download(key, slug, "docs/readme.md", "x")
+        uid = requests.post(
+            f"{BASE_URL}/projects/{slug}/files/zip",
+            headers=_h_zip_download(key),
+            params={"path": "src"},
+        ).json()["uid"]
+        _process_uid(uid)
+        done = requests.get(
+            f"{BASE_URL}/zips/{uid}", headers={"Accept": "application/json"}
+        ).json()
+        dl = requests.get(f"{BASE_URL}{done['download_url']}")
+        names = sorted(zipfile.ZipFile(io.BytesIO(dl.content)).namelist())
+        assert names == ["src/", "src/app.py"]
+    finally:
+        _cleanup_archives()
+
+
+def test_files_zip_rejects_traversal(app_server):
+    _, key = _signup_zip_download()
+    proj = _create_project_zip_download(key, "Traversal Guard")
+    slug = proj["slug"] or proj["uid"]
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/zip",
+        headers=_h_zip_download(key),
+        params={"path": "../../etc/passwd"},
+    )
+    assert r.status_code == 400, r.text

tests/api/projects/index.py

@@ -0,0 +1,416 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+from datetime import datetime, timezone
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+from devplacepy.utils import generate_uid, make_combined_slug
+JSON_audit_log = {"Accept": "application/json"}
+_counter_audit_log = [0]
+@pytest.fixture(scope="module", autouse=True)
+def _audit_test_settings(app_server):
+    # On a fresh DB init_db skips seeding the operational/upload settings (its
+    # `tables` snapshot predates site_settings creation), so those rows are
+    # absent and the admin settings form would INSERT them as "" - which both
+    # closes registration and makes consumers that do int("") crash. Seed sane
+    # values here so the form's empty submissions are skipped (existing key), and
+    # lift the per-IP rate limit since this file fires many mutating requests.
+    for key, value in {
+        "rate_limit_per_minute": "1000000",
+        "rate_limit_window_seconds": "60",
+        "registration_open": "1",
+        "maintenance_mode": "0",
+        "max_upload_size_mb": "10",
+        "allowed_file_types": "",
+        "max_attachments_per_resource": "10",
+        "session_max_age_days": "7",
+        "session_remember_days": "30",
+        "news_service_interval": "3600",
+        "news_grade_threshold": "7",
+    }.items():
+        set_setting(key, value)
+    yield
+def _db_user(name):
+    # the user is created by the server subprocess; refresh the test-process
+    # SQLite snapshot before reading it back across the process boundary.
+    refresh_snapshot()
+    return get_table("users").find_one(username=name)
+def _unique(prefix="au"):
+    _counter_audit_log[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter_audit_log[0]}"
+def _member():
+    name = _unique("aumem")
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+def _member_key():
+    _, name = _member()
+    return _db_user(name)["api_key"]
+def _admin(seeded_db):
+    # authenticate via the seeded admin's API key (header auth) rather than a
+    # login POST - GET reads are exempt from the rate limiter, so reusing this
+    # across the file's many tests never counts against the per-IP write budget.
+    key = _db_user("alice_test")["api_key"]
+    s = requests.Session()
+    s.headers.update({"X-API-KEY": key})
+    return s
+def _audit(admin, **params):
+    r = admin.get(f"{BASE_URL}/admin/audit-log", headers=JSON_audit_log, params=params)
+    assert r.status_code == 200, r.text[:300]
+    return r.json()
+def _find(admin, event_key, predicate):
+    data = _audit(admin, event_key=event_key)
+    for entry in data["entries"]:
+        if predicate(entry):
+            return entry
+    return None
+def _new_post(session, body="audited post body here"):
+    return session.post(
+        f"{BASE_URL}/posts/create",
+        headers=JSON_audit_log,
+        data={"title": _unique("aup"), "content": body, "topic": "devlog"},
+    ).json()["data"]
+def _new_project(session):
+    return session.post(
+        f"{BASE_URL}/projects/create",
+        headers=JSON_audit_log,
+        data={
+            "title": _unique("aupr"),
+            "description": "audited project description text",
+            "project_type": "software",
+            "status": "In Development",
+            "platforms": "",
+        },
+    ).json()["data"]
+def _seed_news_audit_log():
+    uid = generate_uid()
+    title = _unique("aunews")
+    get_table("news").insert(
+        {
+            "uid": uid,
+            "slug": make_combined_slug(title, uid),
+            "title": title,
+            "external_id": uid,
+            "status": "draft",
+            "featured": 0,
+            "show_on_landing": 0,
+            "grade": 5,
+            "source_name": "AuditTest",
+            "synced_at": datetime.now(timezone.utc).isoformat(),
+            "description": "audited news article",
+        }
+    )
+    refresh_snapshot()
+    return uid
+from devplacepy.database import get_table
+from devplacepy.utils import clear_user_cache
+from devplacepy import project_files
+from devplacepy.project_files import ProjectFileError
+from devplacepy.services.devii.actions.dispatcher import (
+    confirmation_error,
+    _is_confirmed,
+)
+_counter_project_visibility = [0]
+def _signup_project_visibility():
+    _counter_project_visibility[0] += 1
+    name = f"pv{int(time.time() * 1000)}{_counter_project_visibility[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return name, row["uid"], row["api_key"]
+def _make_admin_project_visibility():
+    name, uid, key = _signup_project_visibility()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    return name, uid, key
+def _h_project_visibility(key=None):
+    headers = {"Accept": "application/json"}
+    if key:
+        headers["X-API-KEY"] = key
+    return headers
+def _create_project_project_visibility(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "visibility test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_h_project_visibility(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _project_uid(slug):
+    return get_table("projects").find_one(slug=slug)["uid"]
+def _write_project_visibility(key, slug, path, content):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_project_visibility(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+def _set_private(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/private",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _set_readonly(key, slug, value):
+    return requests.post(
+        f"{BASE_URL}/projects/{slug}/readonly",
+        headers=_h_project_visibility(key),
+        data={"value": 1 if value else 0},
+        allow_redirects=False,
+    )
+def _list_slugs(key=None, user_uid=None):
+    params = {"user_uid": user_uid} if user_uid else None
+    r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
+    return [p["slug"] for p in r.json()["projects"]]
+def _seed_news_seo():
+    from datetime import datetime, timezone
+    from devplacepy.database import get_table
+    from devplacepy.utils import generate_uid, make_combined_slug
+
+    uid = generate_uid()
+    title = f"SEO Test News Article {uid.split('-')[-1]}"
+    slug = make_combined_slug(title, uid)
+    get_table("news").insert(
+        {
+            "uid": uid,
+            "slug": slug,
+            "title": title,
+            "description": "A seeded news article for SEO tests.",
+            "content": "Body content for the seeded article.",
+            "url": "https://example.com/article",
+            "source_name": "ExampleSource",
+            "status": "published",
+            "synced_at": datetime.now(timezone.utc).isoformat(),
+            "show_on_landing": 0,
+            "grade": 8,
+        }
+    )
+    return slug, uid
+def _seed_owner():
+    from datetime import datetime, timezone
+    from uuid import uuid4
+    from devplacepy.database import get_table
+
+    uid = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": uid,
+            "username": f"seo_{uid[:8]}",
+            "email": f"{uid[:8]}@seo.test",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return uid
+def _seed_post_seo(image=None):
+    from datetime import datetime, timezone
+    from uuid import uuid4
+    from devplacepy.database import get_table
+    from devplacepy.utils import make_combined_slug
+
+    owner = _seed_owner()
+    uid = str(uuid4())
+    slug = make_combined_slug("SEO Detail Post", uid)
+    get_table("posts").insert(
+        {
+            "uid": uid,
+            "user_uid": owner,
+            "slug": slug,
+            "title": "SEO Detail Post",
+            "content": "Body text for the SEO detail post.",
+            "topic": "general",
+            "project_uid": None,
+            "image": image,
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return slug, uid
+def _seed_gist():
+    from datetime import datetime, timezone
+    from uuid import uuid4
+    from devplacepy.database import get_table
+    from devplacepy.utils import make_combined_slug
+
+    owner = _seed_owner()
+    uid = str(uuid4())
+    slug = make_combined_slug("SEO Detail Gist", uid)
+    get_table("gists").insert(
+        {
+            "uid": uid,
+            "user_uid": owner,
+            "slug": slug,
+            "title": "SEO Detail Gist",
+            "description": "Gist description for SEO tests.",
+            "source_code": "print('seo')",
+            "language": "python",
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return slug, uid
+def _seed_project():
+    from datetime import datetime, timezone
+    from uuid import uuid4
+    from devplacepy.database import get_table
+    from devplacepy.utils import make_combined_slug
+
+    owner = _seed_owner()
+    uid = str(uuid4())
+    slug = make_combined_slug("SEO Detail Project", uid)
+    get_table("projects").insert(
+        {
+            "uid": uid,
+            "user_uid": owner,
+            "slug": slug,
+            "title": "SEO Detail Project",
+            "description": "Project description for SEO tests.",
+            "project_type": "software",
+            "platforms": "Linux",
+            "status": "Released",
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return slug, uid
+def _seed_news_image(news_uid):
+    from devplacepy.database import get_table
+
+    get_table("news_images").insert(
+        {
+            "news_uid": news_uid,
+            "url": "https://example.com/seo-news-image.jpg",
+        }
+    )
+def _seed_feed_posts(count):
+    from datetime import datetime, timezone, timedelta
+    from uuid import uuid4
+    from devplacepy.database import get_table
+    from devplacepy.utils import make_combined_slug
+
+    owner = _seed_owner()
+    topic = f"seopag{owner[:8]}"
+    base = datetime(2026, 1, 1, tzinfo=timezone.utc)
+    posts = get_table("posts")
+    for i in range(count):
+        uid = str(uuid4())
+        posts.insert(
+            {
+                "uid": uid,
+                "user_uid": owner,
+                "slug": make_combined_slug(f"seo pag {i}", uid),
+                "title": None,
+                "content": f"seo pag post {i}",
+                "topic": topic,
+                "project_uid": None,
+                "image": None,
+                "stars": 0,
+                "created_at": (base - timedelta(seconds=i)).isoformat(),
+            }
+        )
+    return topic
+
+
+def test_project_create_visibility_readonly_recorded(seeded_db):
+    s, _ = _member()
+    proj = _new_project(s)
+    admin = _admin(seeded_db)
+    assert _find(admin, "project.create", lambda e: e.get("target_uid") == proj["uid"]) is not None
+    s.post(f"{BASE_URL}/projects/{proj['slug']}/private", headers=JSON_audit_log, data={"value": "true"}, allow_redirects=False)
+    assert _find(admin, "project.visibility.private", lambda e: e.get("target_uid") == proj["uid"]) is not None
+    s.post(f"{BASE_URL}/projects/{proj['slug']}/readonly", headers=JSON_audit_log, data={"value": "true"}, allow_redirects=False)
+    assert _find(admin, "project.readonly.enable", lambda e: e.get("target_uid") == proj["uid"]) is not None
+
+
+def test_project_fork_and_zip_request_recorded(seeded_db):
+    s, _ = _member()
+    proj = _new_project(s)
+    s.post(f"{BASE_URL}/projects/{proj['slug']}/fork", headers=JSON_audit_log, data={"title": _unique("aufork")}, allow_redirects=False)
+    s.post(f"{BASE_URL}/projects/{proj['slug']}/zip", headers=JSON_audit_log, allow_redirects=False)
+    admin = _admin(seeded_db)
+    assert _find(admin, "project.fork.request", lambda e: e.get("target_uid") == proj["uid"]) is not None
+    assert _find(admin, "project.zip.request", lambda e: e.get("target_uid") == proj["uid"]) is not None
+
+
+def test_project_file_write_and_readonly_denied_recorded(seeded_db):
+    s, _ = _member()
+    proj = _new_project(s)
+    s.post(
+        f"{BASE_URL}/projects/{proj['slug']}/files/write",
+        headers=JSON_audit_log,
+        data={"path": "audit_a.txt", "content": "hello world"},
+        allow_redirects=False,
+    )
+    admin = _admin(seeded_db)
+    assert _find(
+        admin, "file.write.create", lambda e: e.get("target_uid") == f"{proj['uid']}:audit_a.txt"
+    ) is not None
+    # turn the project read-only, then a write must be recorded as denied
+    s.post(f"{BASE_URL}/projects/{proj['slug']}/readonly", headers=JSON_audit_log, data={"value": "true"}, allow_redirects=False)
+    s.post(
+        f"{BASE_URL}/projects/{proj['slug']}/files/write",
+        headers=JSON_audit_log,
+        data={"path": "audit_b.txt", "content": "blocked"},
+        allow_redirects=False,
+    )
+    denied = _find(
+        admin,
+        "file.write.create",
+        lambda e: e.get("target_uid") == f"{proj['uid']}:audit_b.txt" and e.get("result") == "denied",
+    )
+    assert denied is not None
+
+
+def test_private_detail_404_for_guest_200_for_owner(app_server):
+    _, _, key = _signup_project_visibility()
+    slug = _create_project_project_visibility(key, "Private Detail", is_private=True)["slug"]
+    assert requests.get(f"{BASE_URL}/projects/{slug}", headers=_h_project_visibility()).status_code == 404
+    assert (
+        requests.get(f"{BASE_URL}/projects/{slug}", headers=_h_project_visibility(key)).status_code == 200
+    )
+
+
+def test_private_detail_visible_to_admin(app_server):
+    _, _, owner_key = _signup_project_visibility()
+    _, _, admin_key = _make_admin_project_visibility()
+    slug = _create_project_project_visibility(owner_key, "Private AdminDetail", is_private=True)["slug"]
+    assert (
+        requests.get(f"{BASE_URL}/projects/{slug}", headers=_h_project_visibility(admin_key)).status_code
+        == 200
+    )
+
+
+def test_project_uid_redirects_to_canonical_slug(app_server):
+    slug, uid = _seed_project()
+    r = requests.get(f"{BASE_URL}/projects/{uid}", allow_redirects=False)
+    assert r.status_code == 301
+    assert r.headers["location"].endswith(f"/projects/{slug}"), r.headers.get(
+        "location"
+    )

tests/api/projects/zip.py

@@ -0,0 +1,159 @@
+# retoor <retoor@molodetz.nl>
+
+import asyncio
+import io
+import json
+import time
+import zipfile
+from pathlib import Path
+import requests
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot
+from devplacepy.services.jobs import queue
+from devplacepy.services.jobs.zip_service import ZipService
+from tests.conftest import run_async
+_counter_zip_download = [0]
+def _signup_zip_download():
+    _counter_zip_download[0] += 1
+    name = f"zd{int(time.time() * 1000)}{_counter_zip_download[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    key = get_table("users").find_one(username=name)["api_key"]
+    return name, key
+def _h_zip_download(key):
+    return {"X-API-KEY": key, "Accept": "application/json"}
+def _create_project_zip_download(key, title):
+    r = requests.post(
+        f"{BASE_URL}/projects/create",
+        headers=_h_zip_download(key),
+        data={
+            "title": title,
+            "description": "zip download test",
+            "project_type": "software",
+            "status": "In Development",
+        },
+    )
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+def _write_zip_download(key, slug, path, content):
+    r = requests.post(
+        f"{BASE_URL}/projects/{slug}/files/write",
+        headers=_h_zip_download(key),
+        data={"path": path, "content": content},
+        allow_redirects=False,
+    )
+    assert r.status_code in (200, 302), r.text
+def _process_uid(uid):
+    async def drive():
+        svc = ZipService()
+        for _ in range(400):
+            await svc.run_once()
+            refresh_snapshot()
+            job = queue.get_job(uid)
+            if job and job["status"] in ("done", "failed"):
+                return
+            await asyncio.sleep(0.05)
+
+    run_async(drive())
+def _drain_pending():
+    async def drive():
+        svc = ZipService()
+        appeared = False
+        for _ in range(600):
+            refresh_snapshot()
+            pending = [
+                r
+                for r in get_table("jobs").find(kind="zip")
+                if r["status"] in ("pending", "running")
+            ]
+            if pending:
+                appeared = True
+            await svc.run_once()
+            refresh_snapshot()
+            pending = [
+                r
+                for r in get_table("jobs").find(kind="zip")
+                if r["status"] in ("pending", "running")
+            ]
+            if appeared and not pending and not svc._inflight:
+                return
+            await asyncio.sleep(0.05)
+
+    run_async(drive())
+def _cleanup_archives():
+    refresh_snapshot()
+    jobs = get_table("jobs")
+    for row in list(jobs.find(kind="zip")):
+        result = json.loads(row.get("result") or "{}")
+        local_path = result.get("local_path")
+        if local_path:
+            Path(local_path).unlink(missing_ok=True)
+        jobs.delete(uid=row["uid"])
+def _login_zip_download(page, name):
+    page.goto(f"{BASE_URL}/auth/login", wait_until="domcontentloaded")
+    page.fill("#email", f"{name}@t.dev")
+    page.fill("#password", "secret123")
+    page.click("button:has-text('Sign in')")
+    page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
+
+
+def test_enqueue_project_zip_returns_uid(app_server):
+    try:
+        _, key = _signup_zip_download()
+        proj = _create_project_zip_download(key, "Enqueue Returns Uid")
+        slug = proj["slug"] or proj["uid"]
+        r = requests.post(f"{BASE_URL}/projects/{slug}/zip", headers=_h_zip_download(key))
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert body["uid"]
+        assert body["status_url"] == f"/zips/{body['uid']}"
+    finally:
+        _cleanup_archives()
+
+
+def test_status_pending_then_done_then_download(app_server):
+    try:
+        _, key = _signup_zip_download()
+        proj = _create_project_zip_download(key, "Full Flow")
+        slug = proj["slug"] or proj["uid"]
+        _write_zip_download(key, slug, "README.md", "# hello")
+        _write_zip_download(key, slug, "src/app.py", "print(1)\n")
+        uid = requests.post(f"{BASE_URL}/projects/{slug}/zip", headers=_h_zip_download(key)).json()[
+            "uid"
+        ]
+
+        pending = requests.get(
+            f"{BASE_URL}/zips/{uid}", headers={"Accept": "application/json"}
+        ).json()
+        assert pending["status"] in ("pending", "running")
+        assert pending["download_url"] is None
+
+        _process_uid(uid)
+
+        done = requests.get(
+            f"{BASE_URL}/zips/{uid}", headers={"Accept": "application/json"}
+        ).json()
+        assert done["status"] == "done", done
+        assert done["download_url"] == f"/zips/{uid}/download"
+        assert done["file_count"] == 2 and done["dir_count"] == 1
+
+        dl = requests.get(f"{BASE_URL}{done['download_url']}")
+        assert dl.status_code == 200
+        assert dl.headers["content-type"] == "application/zip"
+        assert "attachment" in dl.headers.get("content-disposition", "")
+        assert ".zip" in dl.headers.get("content-disposition", "")
+        names = sorted(zipfile.ZipFile(io.BytesIO(dl.content)).namelist())
+        assert names == ["README.md", "src/", "src/app.py"]
+    finally:
+        _cleanup_archives()