Integrate Obfuscator file picker into Contracts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/test_routes.py

@@ -46,3 +46,51 @@ class TestGroups:
     def test_missing_batch(self, client):
         r = client.get("/api/groups")
         assert r.status_code == 400
+
+
+class TestSync:
+    def test_requires_batch_id(self, client):
+        response = client.post("/api/sync", json={"keep_ids": []})
+        assert response.status_code == 400
+        assert response.get_json()["error"] == "batch_id required"
+
+    def test_only_deletes_documents_in_requested_batch(self, client):
+        from db import documents
+        from db.connection import execute, query
+
+        doc_a = documents.insert("a.pdf", "application/pdf", "", batch_id="batch-a")
+        doc_b = documents.insert("b.pdf", "application/pdf", "", batch_id="batch-b")
+        execute(
+            "INSERT INTO prompts (id, role, name, body) VALUES (%s, %s, %s, %s)",
+            ("prompt-1", "classify", "custom", "keep me"),
+        )
+
+        response = client.post(
+            "/api/sync",
+            json={"batch_id": "batch-a", "keep_ids": []},
+        )
+
+        assert response.status_code == 200
+        assert response.get_json()["deleted"] == 1
+        assert documents.get(doc_a["id"]) is None
+        assert documents.get(doc_b["id"]) is not None
+        assert query("SELECT body FROM prompts WHERE id = %s", ("prompt-1",)) == [
+            {"body": "keep me"}
+        ]
+
+    def test_cleanup_endpoint_is_not_exposed(self, client):
+        response = client.post("/api/cleanup")
+        assert response.status_code == 404
+
+    def test_file_picker_bundle_is_served(self, client):
+        response = client.get("/file-picker/file-picker.iife.js")
+        assert response.status_code == 200
+        assert b"initFilePicker" in response.data
+
+    def test_application_startup_preserves_database(self, client):
+        from app import create_app
+        from db import documents
+
+        doc = documents.insert("keep.pdf", "application/pdf", "", batch_id="batch-a")
+        create_app()
+        assert documents.get(doc["id"]) is not None

tests/test_upload_refs.py

@@ -0,0 +1,69 @@
+import os
+import sys
+
+from flask import Flask
+
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+
+def test_sink_receives_contract_metadata_without_creating_session(monkeypatch):
+    from upload.backend.upload_refs import blueprint
+
+    calls = []
+
+    class FakeHttpClient:
+        def __init__(self, **_kwargs):
+            pass
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return False
+
+        def delete(self, _url):
+            return None
+
+    def sink(name, content, **metadata):
+        calls.append((name, content, metadata))
+        return {"ok": True, "doc_id": "doc-1"}
+
+    def unexpected_create_session():
+        raise AssertionError("sink mode must not create a session")
+
+    monkeypatch.setattr(blueprint.httpx, "Client", FakeHttpClient)
+    monkeypatch.setattr(blueprint, "pull_file", lambda *_args, **_kwargs: b"document")
+    monkeypatch.setattr(blueprint, "create_session", unexpected_create_session)
+
+    app = Flask(__name__)
+    app.register_blueprint(blueprint.create_upload_refs_blueprint(
+        {"apiPrefix": "/api", "vmUploadPrefix": "https://vm.example/uploads/"},
+        sink=sink,
+    ))
+
+    response = app.test_client().post("/api/upload_refs", json={
+        "batch_id": "batch-1",
+        "contract_id": "contract-1",
+        "zip_source": "folder/archive.zip",
+        "files": [{
+            "name": "agreement.pdf",
+            "size": 8,
+            "url": "https://vm.example/uploads/token",
+        }],
+    })
+
+    assert response.status_code == 200
+    assert response.get_json()["results"] == [
+        {"name": "agreement.pdf", "ok": True, "doc_id": "doc-1"}
+    ]
+    assert calls == [(
+        "agreement.pdf",
+        b"document",
+        {
+            "batch_id": "batch-1",
+            "contract_id": "contract-1",
+            "zip_source": "folder/archive.zip",
+        },
+    )]