test: migrate backend suites to pytest with module coverage gate

Split backend tests into unit and integration suites, add isolated fixtures and coverage enforcement, and update CI and test documentation. Cover current authentication, content, notification, payment, media, and admin flows; fix behaviors revealed by the new tests. Validate both suites and the per-module gate against local PostgreSQL.

apps/gallery/api/schemas.py

@@ -17,9 +17,9 @@ class GallerySchema(ModelSchema):
     absolute_image_preview_url: Optional[str] = None
     absolute_image_blur_url: Optional[str] = None
 
-    class Config:
+    class Meta:
         model = Gallery
-        model_fields = ['id', 'title', 'description', 'image', 'alt_text',
+        fields = ['id', 'title', 'description', 'image', 'alt_text',
                         'width', 'height', 'is_public', 'created_at']
 
     @staticmethod

apps/gallery/api/views.py

@@ -109,14 +109,14 @@ def delete_image(request, image_id: int):
     return 200, {"message": "Image deleted successfully"}
 
 
-@gallery_router.get("/deleted/images", response=List[GallerySchema], auth=jwt_auth)
+@gallery_router.get("/deleted/images", response={200: List[GallerySchema], 403: ErrorSchema}, auth=jwt_auth)
 def list_deleted_gallery_images(request):
     """List all soft-deleted gallery images (Admin/Committee only)"""
     if not (request.auth.is_staff or request.auth.is_superuser):
         return 403, {"error": "Permission denied"}
     return Gallery.deleted_objects.all().select_related('uploaded_by')
 
-@gallery_router.post("/deleted/images/{image_id}/restore", response={200: MessageSchema, 400: ErrorSchema}, auth=jwt_auth)
+@gallery_router.post("/deleted/images/{image_id}/restore", response={200: MessageSchema, 400: ErrorSchema, 403: ErrorSchema}, auth=jwt_auth)
 def restore_gallery_image(request, image_id: int):
     """Restore a soft-deleted gallery image (Admin/Committee only)"""
     if not (request.auth.is_staff or request.auth.is_superuser):

apps/gallery/tests/integration/test_gallery.py

@@ -0,0 +1,49 @@
+import pytest
+from django.core.files.uploadedfile import SimpleUploadedFile
+
+from apps.gallery.models import Gallery
+
+
+pytestmark = [pytest.mark.integration, pytest.mark.django_db]
+
+
+def test_gallery_list_is_public_and_upload_requires_auth(client):
+    response = client.get("/api/gallery/images")
+    assert response.status_code == 200
+    assert response.json() == []
+    assert client.post("/api/gallery/images").status_code == 401
+
+
+def test_gallery_upload_visibility_update_delete_and_restore(client, user_factory, auth_headers, mocker, tmp_path, settings):
+    settings.MEDIA_ROOT = tmp_path
+    queued = mocker.patch("apps.gallery.api.views.process_uploaded_image.delay")
+    staff = user_factory(is_staff=True)
+    member = user_factory()
+    headers = auth_headers(staff)
+    denied = client.post("/api/gallery/images", {"file": SimpleUploadedFile("file.png", b"image", content_type="image/png")},
+                         **auth_headers(member))
+    assert denied.status_code == 400
+    invalid = client.post("/api/gallery/images", {"file": SimpleUploadedFile("file.txt", b"text", content_type="text/plain")}, **headers)
+    assert invalid.status_code == 400
+    uploaded = client.post("/api/gallery/images", {"file": SimpleUploadedFile("file.png", b"image", content_type="image/png")}, **headers)
+    assert uploaded.status_code == 201, uploaded.content
+    image = Gallery.objects.get(pk=uploaded.json()["id"])
+    queued.assert_called_once_with(image.pk)
+    assert client.get(f"/api/gallery/images/{image.pk}").status_code == 200
+    assert [row["id"] for row in client.get("/api/gallery/images").json()] == [image.pk]
+    assert client.put(f"/api/gallery/images/{image.pk}", data='{"title":"Blocked"}',
+                      content_type="application/json", **auth_headers(member)).status_code == 400
+    updated = client.put(f"/api/gallery/images/{image.pk}", data='{"title":"Private","is_public":false}',
+                         content_type="application/json", **headers)
+    assert updated.status_code == 200, updated.content
+    image.refresh_from_db()
+    assert image.title == "Private" and not image.is_public
+    assert client.get("/api/gallery/images").json() == []
+    assert client.get("/api/gallery/images", {"public_only": "false"}).json()[0]["id"] == image.pk
+    assert client.get(f"/api/gallery/images/{image.pk}").status_code == 404
+    assert client.delete(f"/api/gallery/images/{image.pk}", **headers).status_code == 200
+    assert Gallery.deleted_objects.filter(pk=image.pk).exists()
+    assert client.get("/api/gallery/deleted/images", **auth_headers(member)).status_code == 403
+    assert client.get("/api/gallery/deleted/images", **headers).json()[0]["id"] == image.pk
+    assert client.post(f"/api/gallery/deleted/images/{image.pk}/restore", **headers).status_code == 200
+    assert Gallery.objects.filter(pk=image.pk).exists()

apps/gallery/tests/integration/test_tasks.py

@@ -0,0 +1,28 @@
+import pytest
+from django.core.files.base import ContentFile
+
+from apps.gallery.models import Gallery
+from apps.gallery.tasks import process_uploaded_image
+
+
+pytestmark = [pytest.mark.integration, pytest.mark.django_db]
+
+
+def test_gallery_processing_updates_metadata(user_factory, tmp_path, settings, mocker):
+    settings.MEDIA_ROOT = str(tmp_path)
+    gallery = Gallery(title="Photo", uploaded_by=user_factory())
+    gallery._defer_image_processing = True
+    gallery.image.save("gallery/photo.jpg", ContentFile(b"image data"))
+    result = mocker.Mock(file_size=10, width=20, height=30)
+    process = mocker.patch("apps.gallery.tasks.safe_process_public_image", return_value=result)
+    assert process_uploaded_image.run(gallery.pk) == "Processed image: Photo"
+    gallery.refresh_from_db()
+    assert (gallery.file_size, gallery.width, gallery.height) == (10, 20, 30)
+    process.assert_called_once()
+
+
+def test_gallery_processing_missing_image_and_id(user_factory):
+    empty = Gallery.objects.create(title="Empty", uploaded_by=user_factory())
+    assert process_uploaded_image.run(empty.pk) is None
+    with pytest.raises(Gallery.DoesNotExist):
+        process_uploaded_image.run(999999)

apps/gallery/tests/unit/test_admin.py

@@ -0,0 +1,41 @@
+from types import SimpleNamespace
+
+import pytest
+
+from apps.gallery.admin import GalleryAdmin
+
+
+pytestmark = pytest.mark.unit
+
+
+def test_gallery_admin_metadata_and_previews():
+    admin = GalleryAdmin.__new__(GalleryAdmin)
+    empty = SimpleNamespace(image=None, file_size=0, width=0, height=0)
+    assert admin.image_preview(empty) == "No Image"
+    assert admin.image_preview_large(empty) == "No Image"
+    assert admin.file_size_display(empty) == "Unknown"
+    assert admin.dimensions(empty) == "Unknown"
+    image = SimpleNamespace(image=SimpleNamespace(url="/image.png"), file_size=1048576,
+                            file_size_mb=1, width=100, height=80)
+    assert "/image.png" in admin.image_preview(image)
+    assert "/image.png" in admin.image_preview_large(image)
+    assert admin.file_size_display(image) == "1 MB"
+    assert admin.dimensions(image) == "100 × 80"
+
+
+def test_gallery_admin_bulk_actions(mocker):
+    admin = GalleryAdmin.__new__(GalleryAdmin)
+    message = mocker.patch.object(admin, "message_user")
+    queryset = mocker.Mock()
+    queryset.count.return_value = 2
+    admin.make_public(None, queryset)
+    queryset.update.assert_called_with(is_public=True)
+    admin.make_private(None, queryset)
+    queryset.update.assert_called_with(is_public=False)
+    first = mocker.Mock()
+    second = mocker.Mock()
+    queryset.__iter__ = mocker.Mock(return_value=iter([first, second]))
+    admin.restore_images(None, queryset)
+    first.restore.assert_called_once()
+    second.restore.assert_called_once()
+    assert message.call_count == 3

apps/gallery/tests/unit/test_schemas.py

@@ -0,0 +1,17 @@
+from types import SimpleNamespace
+
+import pytest
+
+from apps.gallery.api.schemas import GalleryCreateSchema, GallerySchema
+
+
+pytestmark = pytest.mark.unit
+
+
+def test_gallery_create_defaults_to_public():
+    assert GalleryCreateSchema(title="Photo").is_public
+
+
+def test_gallery_image_resolver_handles_missing_image():
+    request = SimpleNamespace(build_absolute_uri=lambda url: f"https://example.test{url}")
+    assert GallerySchema.resolve_absolute_image_url(SimpleNamespace(image=None), {"request": request}) is None