docs: clarify Polygon auth and API contracts

tests/test_route_regressions.py

@@ -30,6 +30,8 @@ def test_swagger_does_not_embed_mock_auth_token():
     assert response.status_code == 200
     assert b"test-token-123" not in response.data
     assert b"auth_token" not in response.data
+    assert b"MOCK_AUTH_TOKEN" in response.data
+    assert b"X-Mock-Auth" in response.data
 
 
 def test_openapi_schema_and_auth_match_runtime_contract():
@@ -49,6 +51,9 @@ def test_openapi_schema_and_auth_match_runtime_contract():
         if "/_mock/" in path:
             operation = path_item.get("get") or path_item.get("post")
             assert operation["security"] == [{"mockAuth": []}, {}]
+    set_param_responses = paths["/api/v1/svc/instanceOperationCfsParams"]["post"]["responses"]
+    assert set_param_responses["200"]["content"]["application/json"]["schema"]["type"] == "object"
+    assert set_param_responses["409"]["description"] == "Операция уже завершена"
 
 
 def test_homepage_documents_real_operation_routes():
@@ -59,6 +64,7 @@ def test_homepage_documents_real_operation_routes():
     assert b"/api/v1/svc/instanceOperationCfsParams" in response.data
     assert b"/api/v1/svc/openapi.json" in response.data
     assert b"/api/v1/svc/instanceOperations/<uid>/status" not in response.data
+    assert "вставьте токен".encode() in response.data
 
 
 @pytest.mark.parametrize("seconds", ["nan", "inf", "-inf"])
@@ -88,6 +94,16 @@ def test_operation_routes_reject_non_object_json():
     assert param_response.status_code == 400
 
 
+@pytest.mark.parametrize("body", [[], "", 0, False, None])
+def test_create_instance_rejects_non_object_json(body):
+    response = polygon_app.app.test_client().post(
+        "/api/v1/svc/instances", json=body
+    )
+
+    assert response.status_code == 400
+    assert response.get_json()["error"] == "request body must be a JSON object"
+
+
 def test_create_instance_rejects_non_string_display_name():
     service_id = next(iter(config.get_services(config.DEFAULT_STAND)))
 
@@ -128,6 +144,43 @@ def test_create_operation_rejects_foreign_service_operation():
     assert response.status_code == 404
 
 
+def test_create_operation_rejects_mismatched_operation_name():
+    stand_id = config.DEFAULT_STAND
+    services = config.get_services(stand_id)
+    service_id, service = next(
+        (service_id, definition)
+        for service_id, definition in services.items()
+        if len(definition.get("operations", [])) > 1
+    )
+    target_op, other_op = service["operations"][:2]
+    instance_uid = mock_state.get_state(stand_id).create_instance(
+        service_id, "route-test", service
+    )
+
+    response = polygon_app.app.test_client().post(
+        "/api/v1/svc/instanceOperations",
+        json={
+            "instanceUid": instance_uid,
+            "operation": other_op["operation"],
+            "svcOperationId": target_op["svcOperationId"],
+        },
+    )
+
+    assert response.status_code == 400
+    assert mock_state.get_state(stand_id).operations == {}
+
+
+@pytest.mark.parametrize("stand_id", config.list_stands())
+def test_homepage_swagger_link_keeps_current_stand(stand_id):
+    if len(config.list_stands()) <= 1:
+        pytest.skip("stand-specific Swagger link is needed only for multiple stands")
+
+    response = polygon_app.app.test_client().get(f"/{stand_id}/")
+
+    assert response.status_code == 200
+    assert f'href="/{stand_id}/swagger"'.encode() in response.data
+
+
 @pytest.mark.parametrize("page_size", [0, -5])
 def test_instances_page_size_is_clamped_to_one(page_size):
     response = polygon_app.app.test_client().get(