Audit: 5-reviewer sweep — 19 fixes across every stage, +24 tests

Correctness: review vetoes persist via a dedupe_veto column (resolve re-runs no longer overturn humans); diff emits second copies whose confident version matches no owned copy (spec: pairs own only on both ids) and fetches the live collection with refresh; resolve pairs titles.json entries to rows by title so a reshoot photo updates provenance instead of duplicating rows; version lookups survive empty /thing results; publisher tie-break now honors the mixed base/expansion veto and refuses multi-candidate picks; empty-normalized (non-Latin) titles never count as exact. Upload: LoginError aborts a run instead of logging N bogus failures (and 3 identical consecutive failures abort as systemic); Cloudflare interstitials are detected; added-without-version gets its own logged status that verify understands; same-game updates run one per pass so the name-targeted row edit can't overwrite a fresh version; absent diff outputs fail loudly; pagination clicks are paced. Web review: a lock serializes freshen/decide (threadpool race dropped decisions); failed saves roll memory back and always alert the browser (non-JSON 500s included); session warnings reach the page instead of a StringIO; state-load failures and dead servers show banners instead of a blank page; duplicate (title, photos) rows are addressable by ordinal. Consistency: shared CONFIDENT_VERSION_STATUSES, client_for(), Config paths for every artifact, one review-port constant, named matching thresholds, strict collection-id parsing, error-doc responses never cached, unknown config keys warn, extract reports dropped vision entries, fixture generators share escaping + marker text. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-02 14:10:57 -04:00
parent abf7181475
commit 38e20f2c30
26 changed files with 1003 additions and 249 deletions
@@ -131,3 +131,54 @@ def test_401_raises_actionable_auth_error(tmp_path, monkeypatch):
    client, _, _ = make_client(tmp_path, [(401, "Unauthorized")])
    with pytest.raises(BGGAuthError, match="BGG_API_TOKEN"):
        client.get_xml("search", {"query": "catan"})
+
+
+# -- audit-fix regressions ----------------------------------------------
+
+
+def test_http_200_error_document_raises_and_is_never_cached(tmp_path):
+    # BGG serves some errors as HTTP 200 <errors> XML; caching one would
+    # poison every future run for that query
+    from bggpipe.models import BGGResponseError
+
+    errors_xml = "<errors><error><message>Invalid username</message></error></errors>"
+    client, _, _ = make_client(tmp_path, [(200, errors_xml)])
+    with pytest.raises(BGGResponseError):
+        client.get_xml("collection", {"username": "nobody", "own": "1"})
+    assert list((tmp_path / "cache").glob("*.xml")) == []
+
+
+def test_collection_full_merges_and_dedupes_by_collid(tmp_path):
+    base_xml = (
+        '<items totalitems="2">'
+        '<item objectid="13" collid="100" subtype="boardgame">'
+        '<name>Catan</name><status own="1"/></item>'
+        '<item objectid="177" collid="101" subtype="boardgame">'
+        '<name>Advanced Civilization</name><status own="1"/></item>'
+        "</items>"
+    )
+    expansion_xml = (
+        '<items totalitems="1">'
+        '<item objectid="177" collid="101" subtype="boardgameexpansion">'
+        '<name>Advanced Civilization</name><status own="1"/></item>'
+        "</items>"
+    )
+    client, _, _ = make_client(tmp_path, [(200, base_xml), (200, expansion_xml)])
+    items = client.collection_full("eric")
+    assert len(items) == 2  # collid 101 appears in both responses: one copy
+    assert {i.coll_id for i in items} == {100, 101}
+
+
+def test_collection_item_missing_collid_refuses_to_parse(tmp_path):
+    # a truncated response must fail loudly, not coerce ids to 0 and let
+    # the dedupe silently drop owned games
+    from bggpipe.models import BGGResponseError, parse_collection
+
+    bad_xml = (
+        '<items totalitems="1">'
+        '<item objectid="13" subtype="boardgame">'
+        '<name>Catan</name><status own="1"/></item>'
+        "</items>"
+    )
+    with pytest.raises(BGGResponseError):
+        parse_collection(bad_xml)