phase: 91_admin_theme_tab

All verification is complete — this pass needed no code changes. Final report: **Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)** - Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired. - No defects found; zero changes made — working tree left exactly as the task executors left it. - Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation. - Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings. - Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules. - Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted. - Next pending phase: **none** — 91 is the last phase in `todo/`.
2026-09-09 17:22:24 -04:00
parent 3095c4c577
commit d22d260b8b
74 changed files with 4448 additions and 675 deletions
@@ -0,0 +1,182 @@
+"""Integration: the admin UI-settings gate + the /api/config effective
+strings (phase 91, task 01).
+
+The auth + public-contract half of task 01, driven through the real app
+(TestClient keeps the cookie jar — the house ``test_auth_api`` /
+``test_tokens_api`` admin-login pattern):
+
+* the admin gate — ``GET /api/ui-settings`` and ``PUT`` are 403
+  ``admin only`` for anonymous callers AND for a signed-in token USER
+  (role ``"user"`` — the router-wide ``require_admin`` closes the
+  surface on every method, the phase-79 token matrix contract), 200 for
+  the admin on both;
+* ``/api/config`` effective strings (B1: DB-over-env) — an env-only
+  deployment (no ``ui_settings`` row) returns the env strings; after an
+  admin PUT, the ANONYMOUS ``/api/config`` returns the DB strings;
+* the five-key /api/config contract: the retired CSS-file theming's
+  ``theme`` key is GONE (task 03) — the app metadata, the docs flag,
+  and the two effective strings are the entire response.
+
+Real Postgres (``podman compose up -d db``); no LLM involved.
+
+Requires:  podman compose up -d db
+"""
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import text
+from sqlalchemy.orm import Session
+
+from app.config import get_settings
+from app.core import theming
+from app.main import app as fastapi_app
+from tests.conftest import ADMIN_PASSWORD
+
+
+@pytest.fixture(autouse=True)
+def clean_state(db: Session) -> Iterator[None]:
+    """Both touched tables are global state: the single ui_settings row
+    and the api_tokens the token-user test creates (the house
+    TRUNCATE/DELETE reset pattern)."""
+    db.execute(text("DELETE FROM ui_settings"))
+    db.execute(text("TRUNCATE api_tokens"))
+    db.commit()
+    yield
+    db.execute(text("DELETE FROM ui_settings"))
+    db.execute(text("TRUNCATE api_tokens"))
+    db.commit()
+
+
+def _admin_client() -> TestClient:
+    """A fresh client signed in as the admin (the ``_admin_client``
+    pattern from test_auth_api.py)."""
+    c = TestClient(fastapi_app)
+    r = c.post("/api/login", json={"password": ADMIN_PASSWORD})
+    assert r.status_code == 204, f"admin login failed: {r.status_code} {r.text}"
+    return c
+
+
+def test_anonymous_get_and_put_403(client: TestClient) -> None:
+    """Router-level ``require_admin``: both routes are 403 ``admin only``
+    for the unsigned-in caller (one fixed detail — no enumeration)."""
+    r = client.get("/api/ui-settings")
+    assert r.status_code == 403
+    assert r.json() == {"detail": "admin only"}
+    r = client.put("/api/ui-settings", json={"app_name": "nope"})
+    assert r.status_code == 403
+    assert r.json() == {"detail": "admin only"}
+
+
+def test_token_user_get_and_put_403(client: TestClient) -> None:
+    """A signed-in token USER (role ``"user"``) is NOT the admin: the
+    Theme tab's surface is closed to them on both methods (the
+    phase-79 token matrix contract — only the admin themes the
+    deployment)."""
+    admin = _admin_client()
+    r = admin.post("/api/tokens", json={"label": "alice"})
+    assert r.status_code == 201, r.text
+    token = r.json()["token"]
+    assert client.post("/api/token-auth", json={"token": token}).status_code == 204
+    assert client.get("/api/whoami").json() == {"authenticated": True, "role": "user"}
+
+    r = client.get("/api/ui-settings")
+    assert r.status_code == 403
+    assert r.json() == {"detail": "admin only"}
+    r = client.put("/api/ui-settings", json={"brand": "#123456"})
+    assert r.status_code == 403
+    assert r.json() == {"detail": "admin only"}
+
+
+def test_admin_get_and_put_200(client: TestClient, db: Session) -> None:
+    """The admin passes the gate on both methods: GET reports the
+    effective defaults (row missing), PUT persists + reports the new
+    effective values, and a follow-up GET reads them back."""
+    client.post("/api/login", json={"password": ADMIN_PASSWORD})
+
+    r = client.get("/api/ui-settings")
+    assert r.status_code == 200
+    body = r.json()
+    assert set(body) == set(theming.STRING_FIELDS) | set(theming.COLOR_FIELDS)
+    assert body["app_name"] == get_settings().app_name
+    assert {k: body[k] for k in theming.COLOR_FIELDS} == theming.BUILTIN_COLORS
+
+    r = client.put(
+        "/api/ui-settings",
+        json={"app_name": "Reese Brain", "brand": "#818cf8"},
+    )
+    assert r.status_code == 200, r.text
+    assert r.json()["app_name"] == "Reese Brain"
+    assert r.json()["brand"] == "#818cf8"
+
+    r = client.get("/api/ui-settings")
+    assert r.status_code == 200
+    assert r.json()["app_name"] == "Reese Brain"
+    assert r.json()["brand"] == "#818cf8"
+    # Untouched fields stay at their defaults (DB-over-env / -built-in).
+    assert r.json()["footer_text"] == get_settings().footer_text
+    assert r.json()["bg"] == theming.BUILTIN_COLORS["bg"]
+
+
+def _config_keys() -> set[str]:
+    """The /api/config key set after task 03: the five phase-39/59/62
+    keys — the retired CSS-file theming's ``theme`` key is gone."""
+    return {"app_name", "version", "docs_repo_configured",
+            "input_placeholder", "footer_text"}
+
+
+def test_api_config_env_only_deployment_returns_env_strings(client: TestClient) -> None:
+    """B1 with an empty ui_settings table: /api/config serves the ENV
+    strings (the code defaults — conftest pins them) and the key set is
+    the five-key contract (the retired theming's ``theme`` key is gone
+    — task 03)."""
+    r = client.get("/api/config")
+    assert r.status_code == 200
+    body = r.json()
+    assert set(body) == _config_keys()
+    assert body["app_name"] == get_settings().app_name
+    assert body["input_placeholder"] == get_settings().input_placeholder
+    assert body["footer_text"] == get_settings().footer_text
+
+
+def test_api_config_carries_no_theme_key(client: TestClient) -> None:
+    """Phase 91 (task 03): the retired CSS-file theming left NO trace
+    in the endpoint — the response has no ``theme`` key at all (an
+    env-only deployment and a themed one answer with the same keys; the
+    colors are injected pre-paint, they never ride this fetch)."""
+    r = client.get("/api/config")
+    assert r.status_code == 200
+    assert "theme" not in r.json()
+
+
+def test_api_config_returns_db_strings_after_admin_put(
+    client: TestClient, db: Session
+) -> None:
+    """B1 with a set row: after an admin PUT, the ANONYMOUS /api/config
+    (the frontend's boot fetch — no admin needed) serves the DB strings
+    over the env values; the untouched fields keep the env values; the
+    five-key set is unchanged (the retired ``theme`` key is absent)."""
+    admin = _admin_client()
+    r = admin.put(
+        "/api/ui-settings",
+        json={
+            "app_name": "Brain of Testy",
+            "input_placeholder": "Ask the vault…",
+            "footer_text": "Powered by my own models",
+        },
+    )
+    assert r.status_code == 200, r.text
+
+    r = client.get("/api/config")
+    assert r.status_code == 200  # /api/config stays PUBLIC (no gate)
+    body = r.json()
+    assert set(body) == _config_keys()
+    assert body["app_name"] == "Brain of Testy"
+    assert body["input_placeholder"] == "Ask the vault…"
+    assert body["footer_text"] == "Powered by my own models"
+    # The colors never ride /api/config (the pre-paint injection is
+    # task 02; brand.js's surface is the five keys).
+    assert "theme" not in body
+    assert body["version"] == get_settings().app_version