test(auth): assert the role literal each authorization wrapper enforces

[andyne13]

Closes #725.

Tests only — no production change.

Problem

The shared ensure_partition_role helper is well covered (5 tests), but the role literal inside each wrapper is not. Every existing test of the wrappers replaces them via dependency_overrides (e.g. test_phase14_partition_routes.py:59-60), so the wrapper body never executes.

Mutation testing against the full suite:

Mutation	Failed before
Neuter the six thin wrappers	2 — both the plural require_partitions_viewer
Drop the SUPER_ADMIN_MODE conjunct (super-admin permanently on)	0
Force pending_task_count = 0 in the quota check	0

So require_partition_owner, _editor, _viewer, require_admin and require_admin_or_self could each be made allow-all with zero failures. require_admin_or_self — which guards token regeneration — had zero references in tests/.

Change

• Call each wrapper directly with a spy on ensure_partition_role, asserting the role it forwards (viewer / editor / owner, and viewer per-partition for the plural variant)
• Direct coverage for require_admin and a 4-case matrix for require_admin_or_self
• The missing SUPER_ADMIN_MODE=False, is_admin=True deny case (only the allow side was tested)
• A quota case where pending tasks alone exhaust the limit — the in-flight half that File-quota check/admit is a TOCTOU race (quota bypass under concurrent uploads) #664 / fix(quota): arbitrate the reserved file-slot release instead of leaking it #700 is about

The quota tests use the real AuthService, not a fake, so they assert production semantics rather than a stand-in's.

Verification

Each mutation from the issue, re-run against these tests:

require_partition_owner  "owner"  -> "viewer"    1 failed  (was 0)
require_partition_editor "editor" -> "viewer"    1 failed  (was 0)
SUPER_ADMIN_MODE conjunct dropped                1 failed  (was 0)
pending_task_count forced to 0                   1 failed  (was 0)
require_admin_or_self allow-all                  3 failed  (was 0)
baseline (unmutated)                            28 passed

Full suite: 1815 passed. ruff check / ruff format --check / check_layer_imports.py green.

Why this one matters

It's the only issue in the v2.0.1 batch that prevents bugs rather than fixing one. A one-word slip ("owner" → "viewer") across three byte-identical wrappers currently ships green — this makes that impossible.

Summary by CodeRabbit

• Tests
  • Expanded authentication and authorization test coverage for administrator access, self-service permissions, role requirements, and missing-user scenarios.
  • Added coverage for super-admin mode behavior, including partition access checks.
  • Added quota enforcement tests covering pending tasks and combined file and task counts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d7c0881e-60ef-4935-8a1f-8ebd48fb16fe

📥 Commits

Reviewing files that changed from the base of the PR and between da50eb4 and 46c17cc.

📒 Files selected for processing (1)

• tests/unit/api/dependencies/test_auth.py

---

📝 Walkthrough

Walkthrough

Expanded authentication dependency unit coverage for partition role forwarding, administrator authorization, super-admin mode behavior, and file quota enforcement including pending tasks.

Changes

Authentication dependency coverage

Layer / File(s)	Summary
Partition wrapper role forwarding tests/unit/api/dependencies/test_auth.py	Adds spy-based tests verifying partition wrappers and require_partitions_viewer pass the expected roles and partition values.
Admin access and super-admin mode tests/unit/api/dependencies/test_auth.py	Tests administrator, self-access, missing-user, and conditional super-admin authorization outcomes.
Pending-task quota enforcement tests/unit/api/dependencies/test_auth.py	Tests quota denial when pending tasks exhaust capacity and allowance when combined file and pending-task counts remain below the limit.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: hedhoud

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: tests verifying authorization wrapper role literals.
Linked Issues check	✅ Passed	The added tests cover wrapper role literals, require_admin_or_self, the super-admin denial case, and the pending-task quota case.
Out of Scope Changes check	✅ Passed	The changes stay within test coverage for the linked authorization and quota gaps, with no unrelated production edits.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/725-authz-role-literal-tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hedhoud]

The new tests cover the authorization decisions that were previously unprotected, including role forwarding, admin boundaries, and pending-task quota enforcement. I verified them against the latest develop branch and the full unit suite passes. Approved.