Upload folder using huggingface_hub

tests/test_risk.py

@@ -31,4 +31,8 @@ def test_get_risk_internal_error(client, monkeypatch):
             "X-API-Key": "test-key"})
     assert response.status_code == 500
     data = response.json()
-    assert "test error" in data.get("detail", "")
+    # The raw exception message must NOT reach the caller -- routes_risk.py
+    # logs the real exception server-side and returns a generic detail
+    # instead (information-disclosure fix from this session's audit).
+    assert data.get("detail") == "Internal server error"
+    assert "test error" not in data.get("detail", "")

tests/test_routes_admin.py

@@ -37,7 +37,7 @@ def real_tracker(monkeypatch):
 
 def test_create_list_update_deactivate_key(client):
     create_resp = client.post(
-        "/admin/keys",
+        "/api/v1/admin/keys",
         params={"admin_key": TEST_ADMIN_KEY},
         json={"tier": "free", "org_name": "Test Org"},
     )
@@ -47,7 +47,7 @@ def test_create_list_update_deactivate_key(client):
     assert body["tier"] == "free"
     key_id = _key_id(api_key)
 
-    list_resp = client.get("/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
+    list_resp = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
     assert list_resp.status_code == 200
     keys_by_id = {row["key_id"]: row for row in list_resp.json()["keys"]}
     assert key_id in keys_by_id
@@ -55,28 +55,28 @@ def test_create_list_update_deactivate_key(client):
     assert keys_by_id[key_id]["is_active"] is True
 
     patch_resp = client.patch(
-        f"/admin/keys/{key_id}/tier",
+        f"/api/v1/admin/keys/{key_id}/tier",
         params={"admin_key": TEST_ADMIN_KEY},
         json={"tier": "pro"},
     )
     assert patch_resp.status_code == 200
 
-    list_resp2 = client.get("/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
+    list_resp2 = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
     assert list_resp2.json()["keys"][0]  # non-empty, sanity check
     keys_by_id2 = {row["key_id"]: row for row in list_resp2.json()["keys"]}
     assert keys_by_id2[key_id]["tier"] == "pro"
 
-    delete_resp = client.delete(f"/admin/keys/{key_id}", params={"admin_key": TEST_ADMIN_KEY})
+    delete_resp = client.delete(f"/api/v1/admin/keys/{key_id}", params={"admin_key": TEST_ADMIN_KEY})
     assert delete_resp.status_code == 200
 
-    list_resp3 = client.get("/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
+    list_resp3 = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
     keys_by_id3 = {row["key_id"]: row for row in list_resp3.json()["keys"]}
     assert keys_by_id3[key_id]["is_active"] is False
 
 
 def test_update_nonexistent_key_returns_404(client):
     resp = client.patch(
-        "/admin/keys/does-not-exist/tier",
+        "/api/v1/admin/keys/does-not-exist/tier",
         params={"admin_key": TEST_ADMIN_KEY},
         json={"tier": "pro"},
     )
@@ -85,7 +85,7 @@ def test_update_nonexistent_key_returns_404(client):
 
 def test_rotate_key_deactivates_old_and_creates_new_on_same_tenant(client):
     create_resp = client.post(
-        "/admin/keys",
+        "/api/v1/admin/keys",
         params={"admin_key": TEST_ADMIN_KEY},
         json={"tier": "pro", "org_name": "Rotate Test Org"},
     )
@@ -95,7 +95,7 @@ def test_rotate_key_deactivates_old_and_creates_new_on_same_tenant(client):
     tenant_id = old_body["tenant_id"]
 
     rotate_resp = client.post(
-        f"/admin/keys/{old_key_id}/rotate", params={"admin_key": TEST_ADMIN_KEY})
+        f"/api/v1/admin/keys/{old_key_id}/rotate", params={"admin_key": TEST_ADMIN_KEY})
     assert rotate_resp.status_code == 200
     rotated = rotate_resp.json()
     assert rotated["tenant_id"] == tenant_id
@@ -104,7 +104,7 @@ def test_rotate_key_deactivates_old_and_creates_new_on_same_tenant(client):
     new_key_id = _key_id(rotated["api_key"])
     assert new_key_id != old_key_id
 
-    list_resp = client.get("/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
+    list_resp = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
     keys_by_id = {row["key_id"]: row for row in list_resp.json()["keys"]}
     assert keys_by_id[old_key_id]["is_active"] is False
     assert keys_by_id[new_key_id]["is_active"] is True
@@ -113,5 +113,5 @@ def test_rotate_key_deactivates_old_and_creates_new_on_same_tenant(client):
 
 def test_rotate_nonexistent_key_returns_404(client):
     resp = client.post(
-        "/admin/keys/does-not-exist/rotate", params={"admin_key": TEST_ADMIN_KEY})
+        "/api/v1/admin/keys/does-not-exist/rotate", params={"admin_key": TEST_ADMIN_KEY})
     assert resp.status_code == 404

tests/test_routes_governance_execute.py

@@ -46,7 +46,13 @@ def _evaluate_intent(client):
                         headers={"X-Tenant-ID": TENANT_ID})
     assert resp.status_code == 200, resp.text
     data = resp.json()
-    return data["healing_intent"]["intent_id"], data["healing_intent"]
+    # data["intent_id"] (top level, set by evaluate_intent_endpoint right
+    # before returning: result["intent_id"] = deterministic_id) is what
+    # save_evaluated_intent actually persisted to IntentDB.deterministic_id.
+    # data["healing_intent"]["intent_id"] is a separate, independently
+    # generated id belonging to the HealingIntent object itself -- using it
+    # here instead was the exact bug that made every test in this file 404.
+    return data["intent_id"], data["healing_intent"]
 
 
 class _FakePendingApprovalError(Exception):
@@ -257,12 +263,12 @@ def admin_with_approval_store(monkeypatch, client):
 def test_list_pending_executions_returns_501_without_store(client, monkeypatch):
     monkeypatch.setattr(routes_admin, "ADMIN_API_KEY", TEST_ADMIN_KEY)
     client.app.state.approval_store = None
-    resp = client.get("/admin/executions/pending", params={"admin_key": TEST_ADMIN_KEY})
+    resp = client.get("/api/v1/admin/executions/pending", params={"admin_key": TEST_ADMIN_KEY})
     assert resp.status_code == 501
 
 
 def test_list_pending_executions(client, admin_with_approval_store):
-    resp = client.get("/admin/executions/pending", params={"admin_key": TEST_ADMIN_KEY})
+    resp = client.get("/api/v1/admin/executions/pending", params={"admin_key": TEST_ADMIN_KEY})
     assert resp.status_code == 200
     body = resp.json()
     assert body["total"] == 1
@@ -271,7 +277,7 @@ def test_list_pending_executions(client, admin_with_approval_store):
 
 def test_resolve_execution_approval(client, admin_with_approval_store):
     resp = client.post(
-        "/admin/executions/appr_1/resolve",
+        "/api/v1/admin/executions/appr_1/resolve",
         params={"admin_key": TEST_ADMIN_KEY},
         json={"approved": True, "note": "looks fine"},
     )
@@ -281,7 +287,7 @@ def test_resolve_execution_approval(client, admin_with_approval_store):
 
 def test_resolve_unknown_approval_returns_404(client, admin_with_approval_store):
     resp = client.post(
-        "/admin/executions/does-not-exist/resolve",
+        "/api/v1/admin/executions/does-not-exist/resolve",
         params={"admin_key": TEST_ADMIN_KEY},
         json={"approved": True},
     )