test: migrate backend suites to pytest with module coverage gate

Split backend tests into unit and integration suites, add isolated fixtures and coverage enforcement, and update CI and test documentation. Cover current authentication, content, notification, payment, media, and admin flows; fix behaviors revealed by the new tests. Validate both suites and the per-module gate against local PostgreSQL.

apps/notifications/tests/unit/test_store.py

@@ -0,0 +1,64 @@
+import pytest
+import json
+from types import SimpleNamespace
+from django.contrib import admin
+from django.test import RequestFactory
+from apps.notifications.api.views import get_notification, list_notifications
+from apps.notifications.services import RedisNotificationStore
+from apps.notifications.tasks import send_manual_notification
+from apps.users.admin import ManualNotificationForm, UserAdmin
+from apps.users.models import User
+from core.authentication import create_jwt_token
+
+@pytest.mark.unit
+class TestNotificationStoreTests:
+
+    def test_summary_hides_full_body_and_advertises_it(self):
+        notification = RedisNotificationStore._normalize_notification({'id': 'one', 'title': 'Title', 'message': 'Digest', 'body_markdown': '# Full body'})
+        summary = RedisNotificationStore.summary(notification)
+        assert summary['has_body']
+        assert 'body_markdown' not in summary
+        assert notification['body_markdown'] == '# Full body'
+
+    def test_read_filter_applies_before_pagination(self, mocker):
+        redis_client = mocker.patch('apps.notifications.services.redis_client')
+        redis_client.zrevrange.return_value = ['one', 'two', 'three']
+        redis_client.pipeline.return_value.execute.return_value = [json.dumps({'id': 'one', 'is_seen': False}), json.dumps({'id': 'two', 'is_seen': True}), json.dumps({'id': 'three', 'is_seen': False})]
+        unread, count = RedisNotificationStore.list('user', limit=1, offset=1, read_filter='unread')
+        assert count == 2
+        assert [item['id'] for item in unread] == ['three']
+        read, count = RedisNotificationStore.list('user', read_filter='read')
+        assert count == 1
+        assert read[0]['id'] == 'two'
+
+    def test_detail_is_scoped_to_authenticated_recipient(self, mocker):
+        store = mocker.patch('apps.notifications.api.views.RedisNotificationStore')
+        store.get.side_effect = lambda user_id, _: {'id': 'one', 'body_markdown': '# Secret'} if user_id == '1' else None
+        owner = SimpleNamespace(auth=SimpleNamespace(id=1))
+        other = SimpleNamespace(auth=SimpleNamespace(id=2))
+        assert get_notification(owner, 'one')[0] == 200
+        assert get_notification(other, 'one')[0] == 404
+        store.get.assert_any_call('2', 'one')
+
+    def test_list_returns_summaries_and_rejects_unknown_status(self, mocker):
+        store = mocker.patch('apps.notifications.api.views.RedisNotificationStore')
+        request = SimpleNamespace(auth=SimpleNamespace(id=1))
+        store.list.return_value = ([{'id': 'one', 'body_markdown': '# Secret'}], 1)
+        store.summary.side_effect = RedisNotificationStore.summary
+        store.unread_count.return_value = 1
+        result = list_notifications(request, status='unread')
+        assert 'body_markdown' not in result['notifications'][0]
+        assert store.list.call_args.kwargs['read_filter'] == 'unread'
+        assert list_notifications(request, status='invalid').status_code == 400
+
+    def test_marking_old_ephemeral_notification_read_keeps_it_visible(self, mocker):
+        redis_client = mocker.patch('apps.notifications.services.redis_client')
+        get = mocker.patch.object(RedisNotificationStore, 'get')
+        _count = mocker.patch.object(RedisNotificationStore, 'unread_count', return_value=0)
+        _publish = mocker.patch.object(RedisNotificationStore, '_publish_event')
+        get.return_value = {'id': 'one', 'is_seen': False, 'delete_on_seen': True, 'body_markdown': '# Body'}
+        result = RedisNotificationStore.mark_seen('user', 'one')
+        assert not result['deleted']
+        assert result['notification']['is_seen']
+        redis_client.hset.assert_called_once()
+        redis_client.pipeline.assert_not_called()

apps/notifications/tests/unit/test_stream.py

@@ -0,0 +1,28 @@
+import json
+
+import pytest
+
+from apps.notifications.api.views import NotificationStreamView
+from apps.notifications.services import RedisNotificationStore
+
+
+pytestmark = pytest.mark.unit
+
+
+def test_sse_stream_sends_snapshot_update_and_closes_pubsub(mocker, settings):
+    settings.NOTIFICATION_SSE_HEARTBEAT_SECONDS = 60
+    pubsub = mocker.Mock()
+    pubsub.get_message.side_effect = [{"type": "message", "data": json.dumps({"event": "notification", "data": {"id": "one"}})}]
+    mocker.patch("apps.notifications.api.views.RedisNotificationStore.get_pubsub", return_value=pubsub)
+    mocker.patch("apps.notifications.api.views.RedisNotificationStore.list", return_value=([{"id": "one"}], 1))
+    mocker.patch("apps.notifications.api.views.RedisNotificationStore.unread_count", return_value=1)
+    mocker.patch("apps.notifications.api.views.RedisNotificationStore.summary", return_value={"id": "one"})
+    stream = NotificationStreamView()._build_stream("42")
+    assert next(stream).startswith("retry:")
+    assert "connected" in next(stream)
+    assert "unread_count" in next(stream)
+    assert '"id": "one"' in next(stream)
+    stream.close()
+    pubsub.subscribe.assert_called_once_with(RedisNotificationStore._channel_key("42"))
+    pubsub.unsubscribe.assert_called_once()
+    pubsub.close.assert_called_once()

apps/notifications/tests/unit/test_stream_token.py

@@ -0,0 +1,22 @@
+import pytest
+from django.core import signing
+
+from apps.notifications.api.views import _format_sse_event, _issue_stream_token_for_user, _safe_int, _validate_stream_token
+
+
+pytestmark = pytest.mark.unit
+
+
+def test_stream_token_round_trip_and_invalid_token():
+    token = _issue_stream_token_for_user("42")
+    assert _validate_stream_token(token) == "42"
+    with pytest.raises(signing.BadSignature):
+        _validate_stream_token("wrong")
+    with pytest.raises(signing.BadSignature):
+        _validate_stream_token(None)
+
+
+def test_sse_formatter_and_safe_integer_limits():
+    assert _safe_int("-5", 10) == 0
+    assert _safe_int("oops", 10) == 10
+    assert 'event: connected\ndata: {"ready": true}\n\n' == _format_sse_event("connected", {"ready": True})