test: набор pytest-тестов под site/ (unit + интеграционные + безопасность)

tests/test_routes.py

@@ -0,0 +1,85 @@
+"""Интеграционные тесты HTTP-эндпоинтов (Flask test client)."""
+import io
+import zipfile
+
+import pytest
+
+
+@pytest.fixture
+def client(tmp_path, monkeypatch):
+    from db import connection as conn
+    monkeypatch.setattr(conn, "DB_PATH", str(tmp_path / "app.db"))
+    from app import create_app
+    app = create_app()
+    app.config["TESTING"] = True
+    yield app.test_client()
+    c = getattr(conn._local, "conn", None)
+    if c is not None:
+        try:
+            c.close()
+        except Exception:
+            pass
+        conn._local.conn = None
+
+
+class TestHealth:
+    def test_health(self, client):
+        from config import VERSION
+        r = client.get("/health")
+        assert r.status_code == 200
+        data = r.get_json()
+        assert data["ok"] is True
+        assert data["version"] == VERSION
+
+
+class TestSpecCurrent:
+    def test_missing_contract_id(self, client):
+        r = client.get("/api/spec-current")
+        assert r.status_code == 400
+
+    def test_empty(self, client):
+        r = client.get("/api/spec-current?contract_id=missing")
+        assert r.status_code == 200
+        data = r.get_json()
+        assert data["ok"] is True
+        assert data["rows"] == []
+
+
+class TestUpload:
+    def test_no_file(self, client):
+        r = client.post("/upload", data={})
+        assert r.status_code == 400
+
+    def test_unsupported_ext(self, client):
+        data = {"files": (io.BytesIO(b"x"), "test.exe")}
+        r = client.post("/upload", data=data, content_type="multipart/form-data")
+        assert r.status_code == 400
+
+    def test_docx_creates_document(self, client):
+        data = {"files": (io.BytesIO(b"not a real docx"), "test.docx")}
+        r = client.post("/upload", data=data, content_type="multipart/form-data")
+        assert r.status_code == 200
+        j = r.get_json()
+        assert j["ok"] is True
+        assert j["doc_id"]
+
+
+class TestUnzipUpload:
+    def test_unzip(self, client):
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, "w") as zf:
+            zf.writestr("a.docx", b"hello")
+            zf.writestr("b.pdf", b"world")
+        buf.seek(0)
+        data = {"files": (buf, "test.zip")}
+        r = client.post("/unzip-upload", data=data, content_type="multipart/form-data")
+        assert r.status_code == 200
+        j = r.get_json()
+        assert j["ok"] is True
+        assert len(j["files"]) == 2
+
+
+class TestGroups:
+    def test_missing_batch(self, client):
+        r = client.get("/api/groups")
+        assert r.status_code == 400