fix: merge main (v0.161.0) into classification feature branch

Resolve all 40 merge conflicts from merging origin/main into the
classification feature branch. Key resolutions:

- Auto-generated files (BUILD_DATE, VERSION, etc.): use main's version
- API tokens: take main's version (token expiry, reactivation, hard-delete)
- Auth: take main's Dropbox credential sharing + token expiry checking
- Config: take main's social_auth_dropbox_use_global_credentials option
- Files API: take main's improved duplicate handling + rate limiting
- Models: keep ClassificationRuleModel alongside main's new models
- Mobile: take main's mature implementation
- Templates/translations: take main's versions (device deletion, reactivation keys)
- Migration: renumber 038_add_classification_rules → 039_add_classification_rules
  to chain after main's 038_add_api_token_expires_at
- Requirements: take main's version (adds segno QR library)
- Tests: take main's more complete token tests, keep classification imports

tests/conftest.py

@@ -116,6 +116,7 @@ def client(db_session) -> TestClient:
 
     # Import the canonical get_db function
     from app.database import get_db
+    from app.middleware.upload_rate_limit import require_upload_rate_limit
 
     # Override the get_db dependency to use our test database
     def override_get_db():
@@ -127,6 +128,14 @@ def client(db_session) -> TestClient:
     # Override the single canonical get_db dependency
     fastapi_app.dependency_overrides[get_db] = override_get_db
 
+    # Disable per-user upload rate limiting in tests so that upload-heavy
+    # test suites are not rejected with 429 Too Many Requests.
+    async def _no_rate_limit() -> None:
+        """No-op override: skip upload rate limiting during tests."""
+        return None
+
+    fastapi_app.dependency_overrides[require_upload_rate_limit] = _no_rate_limit
+
     # Use base_url to satisfy TrustedHostMiddleware
     with TestClient(fastapi_app, base_url="http://localhost") as test_client:
         yield test_client

tests/test_allowed_types.py

@@ -83,6 +83,8 @@ class TestGotenbergCoverageDocuments:
         ".tif",
         ".webp",
         ".svg",
+        ".heic",
+        ".heif",
     }
     _html_extensions = {".html", ".htm"}
     _markdown_extensions = {".md", ".markdown"}

tests/test_api_dropbox.py

@@ -416,3 +416,110 @@ class TestSaveDropboxSettings:
         # .env write is best-effort; endpoint should still succeed via DB write
         assert response.status_code == 200
         assert response.json()["status"] == "success"
+
+
+@pytest.mark.unit
+class TestBuildDropboxRedirectUri:
+    """Tests for the _build_dropbox_redirect_uri helper."""
+
+    def test_uses_public_base_url_when_set(self):
+        """When PUBLIC_BASE_URL is configured, redirect URI should use it."""
+        from unittest.mock import MagicMock
+
+        with patch("app.api.dropbox.settings") as mock_settings:
+            mock_settings.public_base_url = "https://myapp.example.com"
+            from app.api.dropbox import _build_dropbox_redirect_uri
+
+            mock_request = MagicMock()
+            result = _build_dropbox_redirect_uri(mock_request)
+
+        assert result == "https://myapp.example.com/dropbox-callback"
+
+    def test_uses_public_base_url_strips_trailing_slash(self):
+        """PUBLIC_BASE_URL with trailing slash should be handled correctly."""
+        from unittest.mock import MagicMock
+
+        with patch("app.api.dropbox.settings") as mock_settings:
+            mock_settings.public_base_url = "https://myapp.example.com/"
+            from app.api.dropbox import _build_dropbox_redirect_uri
+
+            mock_request = MagicMock()
+            result = _build_dropbox_redirect_uri(mock_request)
+
+        assert result == "https://myapp.example.com/dropbox-callback"
+
+    def test_falls_back_to_request_when_public_base_url_not_set(self):
+        """When PUBLIC_BASE_URL is not set, use request scheme and netloc."""
+        from unittest.mock import MagicMock
+
+        with patch("app.api.dropbox.settings") as mock_settings:
+            mock_settings.public_base_url = None
+            from app.api.dropbox import _build_dropbox_redirect_uri
+
+            mock_request = MagicMock()
+            mock_request.url.scheme = "https"
+            mock_request.url.netloc = "other.example.com"
+            result = _build_dropbox_redirect_uri(mock_request)
+
+        assert result == "https://other.example.com/dropbox-callback"
+
+
+@pytest.mark.unit
+class TestGlobalAuthorizeUrl:
+    """Tests for GET /api/dropbox/global-authorize-url endpoint."""
+
+    @patch("app.api.dropbox.settings")
+    def test_returns_authorize_url(self, mock_settings, client):
+        """Test that a valid authorize URL is returned when global creds are configured."""
+        mock_settings.dropbox_allow_global_credentials_for_integrations = True
+        mock_settings.dropbox_app_key = "test-app-key"
+        mock_settings.dropbox_app_secret = "test-app-secret"
+        mock_settings.public_base_url = "https://example.com"
+
+        response = client.get("/api/dropbox/global-authorize-url")
+
+        assert response.status_code == 200
+        data = response.json()
+        assert "authorize_url" in data
+        assert "https://www.dropbox.com/oauth2/authorize" in data["authorize_url"]
+        assert "client_id=test-app-key" in data["authorize_url"]
+        # redirect_uri should be URL-encoded
+        assert "redirect_uri=" in data["authorize_url"]
+        assert "https%3A%2F%2Fexample.com%2Fdropbox-callback" in data["authorize_url"]
+
+    @patch("app.api.dropbox.settings")
+    def test_returns_403_when_global_creds_disabled(self, mock_settings, client):
+        """Test 403 when global credentials for integrations are disabled."""
+        mock_settings.dropbox_allow_global_credentials_for_integrations = False
+        mock_settings.dropbox_app_key = "test-app-key"
+        mock_settings.dropbox_app_secret = "test-app-secret"
+
+        response = client.get("/api/dropbox/global-authorize-url")
+
+        assert response.status_code == 403
+
+    @patch("app.api.dropbox.settings")
+    def test_returns_503_when_creds_not_configured(self, mock_settings, client):
+        """Test 503 when global Dropbox credentials are not configured."""
+        mock_settings.dropbox_allow_global_credentials_for_integrations = True
+        mock_settings.dropbox_app_key = None
+        mock_settings.dropbox_app_secret = None
+
+        response = client.get("/api/dropbox/global-authorize-url")
+
+        assert response.status_code == 503
+
+    @patch("app.api.dropbox.settings")
+    def test_redirect_uri_uses_public_base_url(self, mock_settings, client):
+        """Redirect URI in authorize URL must use PUBLIC_BASE_URL when configured."""
+        mock_settings.dropbox_allow_global_credentials_for_integrations = True
+        mock_settings.dropbox_app_key = "my-key"
+        mock_settings.dropbox_app_secret = "my-secret"
+        mock_settings.public_base_url = "https://prod.example.com"
+
+        response = client.get("/api/dropbox/global-authorize-url")
+
+        assert response.status_code == 200
+        authorize_url = response.json()["authorize_url"]
+        # The redirect_uri must be URL-encoded and contain the public base URL
+        assert "https%3A%2F%2Fprod.example.com%2Fdropbox-callback" in authorize_url

tests/test_api_integrations.py

@@ -887,9 +887,9 @@ class TestConnectionTestEndpoint:
     def test_test_unsupported_type(self, int_client):
         """Unsupported integration types return a helpful non-error message."""
         payload = {
-            "integration_type": "DROPBOX",
+            "integration_type": "FTP",
             "config": {},
-            "credentials": {"token": "abc"},
+            "credentials": {"username": "user", "password": "pass"},
         }
         resp = int_client.post("/api/integrations/test", json=payload)
         assert resp.status_code == 200
@@ -897,6 +897,83 @@ class TestConnectionTestEndpoint:
         assert data["success"] is False
         assert "not yet supported" in data["message"]
 
+    def test_test_dropbox_missing_refresh_token(self, int_client):
+        """Dropbox test with missing refresh_token returns failure."""
+        payload = {
+            "integration_type": "DROPBOX",
+            "config": {},
+            "credentials": {"app_key": "key", "app_secret": "secret"},
+        }
+        resp = int_client.post("/api/integrations/test", json=payload)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "refresh_token" in data["message"].lower()
+
+    def test_test_dropbox_missing_app_key(self, int_client):
+        """Dropbox test with missing app_key/app_secret returns failure."""
+        payload = {
+            "integration_type": "DROPBOX",
+            "config": {},
+            "credentials": {"refresh_token": "rtoken"},
+        }
+        resp = int_client.post("/api/integrations/test", json=payload)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "app_key" in data["message"].lower()
+
+    def test_test_dropbox_invalid_credentials(self, int_client):
+        """Dropbox test with bad credentials returns an auth failure."""
+        from unittest.mock import MagicMock, patch
+
+        import dropbox.exceptions as dbx_exc
+
+        with patch("app.api.integrations.dbx_lib") as mock_dbx:
+            mock_instance = MagicMock()
+            mock_dbx.Dropbox.return_value = mock_instance
+            mock_instance.users_get_current_account.side_effect = dbx_exc.AuthError("req_id", MagicMock())
+            payload = {
+                "integration_type": "DROPBOX",
+                "config": {},
+                "credentials": {
+                    "app_key": "bad_key",
+                    "app_secret": "bad_secret",
+                    "refresh_token": "bad_token",
+                },
+            }
+            resp = int_client.post("/api/integrations/test", json=payload)
+            assert resp.status_code == 200
+            data = resp.json()
+            assert data["success"] is False
+            assert "authentication failed" in data["message"].lower()
+
+    def test_test_dropbox_success(self, int_client):
+        """Dropbox test with valid (mocked) credentials returns success."""
+        from unittest.mock import MagicMock, patch
+
+        with patch("app.api.integrations.dbx_lib") as mock_dbx:
+            mock_instance = MagicMock()
+            mock_dbx.Dropbox.return_value = mock_instance
+            mock_account = MagicMock()
+            mock_account.name.display_name = "Test User"
+            mock_instance.users_get_current_account.return_value = mock_account
+
+            payload = {
+                "integration_type": "DROPBOX",
+                "config": {},
+                "credentials": {
+                    "app_key": "valid_key",
+                    "app_secret": "valid_secret",
+                    "refresh_token": "valid_token",
+                },
+            }
+            resp = int_client.post("/api/integrations/test", json=payload)
+            assert resp.status_code == 200
+            data = resp.json()
+            assert data["success"] is True
+            assert "dropbox connection successful" in data["message"].lower()
+
     def test_test_invalid_type_returns_400(self, int_client):
         """Invalid integration_type returns 400."""
         payload = {

tests/test_api_mobile.py

@@ -329,7 +329,7 @@ class TestDeactivateDevice:
     """Tests for DELETE /api/mobile/devices/{device_id}."""
 
     def test_deactivate_own_device(self, mob_engine, mob_session):
-        """Deactivating a device sets is_active to False."""
+        """Deactivating an active device sets is_active to False (soft-delete, returns 200)."""
         from app.main import app
 
         device = MobileDevice(
@@ -346,7 +346,8 @@ class TestDeactivateDevice:
         client = _make_client(mob_engine)
         try:
             resp = client.delete(f"/api/mobile/devices/{device_id}")
-            assert resp.status_code == 204
+            assert resp.status_code == 200
+            assert resp.json()["detail"] == "Device deactivated"
 
             mob_session.expire_all()
             updated = mob_session.get(MobileDevice, device_id)
@@ -355,6 +356,33 @@ class TestDeactivateDevice:
         finally:
             _cleanup(app)
 
+    def test_delete_inactive_device(self, mob_engine, mob_session):
+        """Deleting an already-inactive device permanently removes it (hard-delete, returns 200)."""
+        from app.main import app
+
+        device = MobileDevice(
+            owner_id=_OWNER,
+            push_token=_EXPO_TOKEN,
+            platform="ios",
+            is_active=False,
+        )
+        mob_session.add(device)
+        mob_session.commit()
+        mob_session.refresh(device)
+        device_id = device.id
+
+        client = _make_client(mob_engine)
+        try:
+            resp = client.delete(f"/api/mobile/devices/{device_id}")
+            assert resp.status_code == 200
+            assert resp.json()["detail"] == "Device deleted"
+
+            mob_session.expire_all()
+            deleted = mob_session.get(MobileDevice, device_id)
+            assert deleted is None
+        finally:
+            _cleanup(app)
+
     def test_deactivate_other_users_device_returns_404(self, mob_engine, mob_session):
         """Attempting to deactivate another user's device returns 404."""
         from app.main import app
@@ -439,6 +467,42 @@ class TestWhoAmI:
             assert data["email"] == _OWNER
             assert data["avatar_url"] is not None  # Gravatar URL
             assert data["is_admin"] is False
+            assert data["preferred_language"] is None  # not set yet
+        finally:
+            _cleanup(app)
+
+    def test_whoami_returns_preferred_language(self, mob_engine, mob_session):
+        """preferred_language from UserProfile is included in the whoami response."""
+        from app.main import app
+        from app.models import UserProfile
+
+        profile = UserProfile(
+            user_id=_OWNER,
+            display_name="Bob Test",
+            preferred_language="de",
+        )
+        mob_session.add(profile)
+        mob_session.commit()
+
+        client = _make_client(mob_engine)
+        try:
+            resp = client.get("/api/mobile/whoami")
+            assert resp.status_code == 200
+            data = resp.json()
+            assert data["preferred_language"] == "de"
+        finally:
+            _cleanup(app)
+
+    def test_whoami_no_profile_preferred_language_is_null(self, mob_engine):
+        """preferred_language is null when no UserProfile exists."""
+        from app.main import app
+
+        client = _make_client(mob_engine)
+        try:
+            resp = client.get("/api/mobile/whoami")
+            assert resp.status_code == 200
+            data = resp.json()
+            assert data["preferred_language"] is None
         finally:
             _cleanup(app)
 

tests/test_api_tokens.py

@@ -314,8 +314,8 @@ class TestTokenRevoke:
             _cleanup(app)
 
     @pytest.mark.unit
-    def test_revoke_already_revoked_token(self, tok_engine):
-        """Revoking an already-revoked token should return 400."""
+    def test_delete_already_revoked_token(self, tok_engine):
+        """Deleting an already-revoked token should permanently remove it (hard-delete, 200)."""
         from app.main import app
 
         client = _make_client(tok_engine)
@@ -324,9 +324,15 @@ class TestTokenRevoke:
             token_id = create_resp.json()["id"]
             client.delete(f"/api/api-tokens/{token_id}")
 
+            # Second DELETE should hard-delete the revoked token.
             resp = client.delete(f"/api/api-tokens/{token_id}")
-            assert resp.status_code == 400
-            assert resp.json()["detail"] == "Token is already revoked"
+            assert resp.status_code == 200
+            assert resp.json()["detail"] == "Token deleted"
+
+            # Token must no longer appear in the list.
+            list_resp = client.get("/api/api-tokens/")
+            ids = [t["id"] for t in list_resp.json()]
+            assert token_id not in ids
         finally:
             _cleanup(app)
 
@@ -677,3 +683,216 @@ class TestTokenUtils:
         token = "de_test_token_value"
         expected_hash = "9b89d9adf2f390c75bf2fd0ff2bb5622ef5a9dce438354cce6e39f2f5401129e"
         assert hash_token(token) == expected_hash
+
+
+# ---------------------------------------------------------------------------
+# Tests – Token reactivation
+# ---------------------------------------------------------------------------
+
+
+class TestTokenReactivate:
+    """Tests for POST /api/api-tokens/{id}/reactivate."""
+
+    @pytest.mark.unit
+    def test_reactivate_revoked_token(self, tok_engine):
+        """Reactivating a revoked token should set is_active=True and clear revoked_at."""
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            create_resp = client.post("/api/api-tokens/", json={"name": "Reactivate Me"})
+            token_id = create_resp.json()["id"]
+            client.delete(f"/api/api-tokens/{token_id}")
+
+            resp = client.post(f"/api/api-tokens/{token_id}/reactivate")
+            assert resp.status_code == 200
+            data = resp.json()
+            assert data["is_active"] is True
+            assert data["revoked_at"] is None
+        finally:
+            _cleanup(app)
+
+    @pytest.mark.unit
+    def test_reactivate_active_token_returns_400(self, tok_engine):
+        """Reactivating an already-active token should return 400."""
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            create_resp = client.post("/api/api-tokens/", json={"name": "Already Active"})
+            token_id = create_resp.json()["id"]
+
+            resp = client.post(f"/api/api-tokens/{token_id}/reactivate")
+            assert resp.status_code == 400
+            assert resp.json()["detail"] == "Token is already active"
+        finally:
+            _cleanup(app)
+
+    @pytest.mark.unit
+    def test_reactivate_nonexistent_token(self, tok_engine):
+        """Reactivating a non-existent token should return 404."""
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            resp = client.post("/api/api-tokens/99999/reactivate")
+            assert resp.status_code == 404
+        finally:
+            _cleanup(app)
+
+    @pytest.mark.unit
+    def test_reactivate_other_users_token(self, tok_engine):
+        """A user cannot reactivate another user's token."""
+        from app.main import app
+
+        client_a = _make_client(tok_engine, _OWNER)
+        try:
+            create_resp = client_a.post("/api/api-tokens/", json={"name": "A Token"})
+            token_id = create_resp.json()["id"]
+            client_a.delete(f"/api/api-tokens/{token_id}")
+        finally:
+            _cleanup(app)
+
+        client_b = _make_client(tok_engine, _OTHER_OWNER)
+        try:
+            resp = client_b.post(f"/api/api-tokens/{token_id}/reactivate")
+            assert resp.status_code == 404
+        finally:
+            _cleanup(app)
+
+
+# ---------------------------------------------------------------------------
+# Tests – Token lifetime (expires_at)
+# ---------------------------------------------------------------------------
+
+
+class TestTokenExpiry:
+    """Tests for token creation with optional lifetime and expiry enforcement."""
+
+    @pytest.mark.unit
+    def test_create_token_without_expiry(self, tok_engine):
+        """Creating a token without expires_in_days should leave expires_at as None."""
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            resp = client.post("/api/api-tokens/", json={"name": "No Expiry"})
+            assert resp.status_code == 201
+            data = resp.json()
+            assert data["expires_at"] is None
+        finally:
+            _cleanup(app)
+
+    @pytest.mark.unit
+    def test_create_token_with_expiry(self, tok_engine, tok_session):
+        """Creating a token with expires_in_days should set expires_at in the future."""
+        from datetime import datetime, timezone
+
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            resp = client.post("/api/api-tokens/", json={"name": "With Expiry", "expires_in_days": 30})
+            assert resp.status_code == 201
+            data = resp.json()
+            assert data["expires_at"] is not None
+            # Parse the returned datetime; handle both tz-aware and tz-naive serialisations
+            expires_str = data["expires_at"].replace("Z", "+00:00")
+            expires_at = datetime.fromisoformat(expires_str)
+            if expires_at.tzinfo is None:
+                expires_at = expires_at.replace(tzinfo=timezone.utc)
+            now = datetime.now(timezone.utc)
+            delta_days = (expires_at - now).days
+            assert 28 <= delta_days <= 30
+        finally:
+            _cleanup(app)
+
+    @pytest.mark.unit
+    def test_expired_token_not_resolved(self, tok_engine, tok_session):
+        """A token past its expires_at should not authenticate."""
+        from datetime import datetime, timedelta, timezone
+        from unittest.mock import MagicMock
+
+        from app.api.api_tokens import generate_api_token, hash_token
+        from app.auth import _resolve_bearer_user
+
+        plaintext = generate_api_token()
+        token_hash = hash_token(plaintext)
+
+        db_token = ApiToken(
+            owner_id=_OWNER,
+            name="Expired Token",
+            token_hash=token_hash,
+            token_prefix=plaintext[:12],
+            is_active=True,
+            expires_at=datetime.now(timezone.utc) - timedelta(days=1),  # expired yesterday
+        )
+        tok_session.add(db_token)
+        tok_session.commit()
+
+        mock_request = MagicMock()
+        mock_request.headers = {"authorization": f"Bearer {plaintext}"}
+        mock_request.client.host = "127.0.0.1"
+
+        user = _resolve_bearer_user(mock_request, tok_session)
+        assert user is None
+
+    @pytest.mark.unit
+    def test_non_expired_token_resolves(self, tok_engine, tok_session):
+        """A token before its expires_at should authenticate normally."""
+        from datetime import datetime, timedelta, timezone
+        from unittest.mock import MagicMock
+
+        from app.api.api_tokens import generate_api_token, hash_token
+        from app.auth import _resolve_bearer_user
+
+        plaintext = generate_api_token()
+        token_hash = hash_token(plaintext)
+
+        db_token = ApiToken(
+            owner_id=_OWNER,
+            name="Valid Token",
+            token_hash=token_hash,
+            token_prefix=plaintext[:12],
+            is_active=True,
+            expires_at=datetime.now(timezone.utc) + timedelta(days=30),  # expires in 30 days
+        )
+        tok_session.add(db_token)
+        tok_session.commit()
+
+        mock_request = MagicMock()
+        mock_request.headers = {"authorization": f"Bearer {plaintext}"}
+        mock_request.client.host = "127.0.0.1"
+
+        user = _resolve_bearer_user(mock_request, tok_session)
+        assert user is not None
+        assert user["preferred_username"] == _OWNER
+
+    @pytest.mark.unit
+    def test_create_token_expires_in_days_zero_rejected(self, tok_engine):
+        """expires_in_days=0 should be rejected with 422 (ge=1)."""
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            resp = client.post("/api/api-tokens/", json={"name": "Bad Expiry", "expires_in_days": 0})
+            assert resp.status_code == 422
+        finally:
+            _cleanup(app)
+
+    @pytest.mark.unit
+    def test_expires_at_included_in_list_response(self, tok_engine):
+        """List endpoint should include expires_at field."""
+        from app.main import app
+
+        client = _make_client(tok_engine)
+        try:
+            client.post("/api/api-tokens/", json={"name": "Listed", "expires_in_days": 7})
+            resp = client.get("/api/api-tokens/")
+            assert resp.status_code == 200
+            tokens = resp.json()
+            assert len(tokens) == 1
+            assert "expires_at" in tokens[0]
+            assert tokens[0]["expires_at"] is not None
+        finally:
+            _cleanup(app)

tests/test_csrf.py

@@ -337,6 +337,27 @@ class TestCSRFMiddlewareDispatch:
 
         call_next.assert_called_once_with(request)
 
+    @pytest.mark.asyncio
+    async def test_qr_auth_claim_is_exempt(self):
+        """QR auth claim path is exempt from CSRF validation.
+
+        The mobile app calls this endpoint without a browser session and
+        therefore without a CSRF token.  The cryptographically-random,
+        single-use challenge token provides equivalent protection.
+        """
+        middleware = self._make_middleware()
+        request = self._make_request(
+            method="POST",
+            path="/api/qr-auth/claim",
+            session={},
+        )
+        call_next = AsyncMock(return_value=MagicMock())
+
+        with patch.object(CSRFMiddleware, "_get_submitted_token", new=AsyncMock(return_value=None)):
+            result = await middleware.dispatch(request, call_next)
+
+        call_next.assert_called_once_with(request)
+
 
 # ---------------------------------------------------------------------------
 # Integration tests – via TestClient
@@ -362,6 +383,7 @@ class TestCSRFIntegration:
         assert "PATCH" in CSRF_PROTECTED_METHODS
         assert "GET" not in CSRF_PROTECTED_METHODS
         assert "/oauth-callback" in CSRF_EXEMPT_PATHS
+        assert "/api/qr-auth/claim" in CSRF_EXEMPT_PATHS
 
     def test_csrf_middleware_noop_when_auth_disabled(self):
         """When AUTH_ENABLED=False the middleware dispatch is a no-op (no validation)."""

tests/test_database.py

@@ -998,3 +998,49 @@ class TestAlembicUpgrade:
         # Verify head is reachable
         heads = script.get_heads()
         assert len(heads) == 1  # Should be a single linear chain
+
+
+@pytest.mark.unit
+class TestEnginePoolConfiguration:
+    """Tests for database engine pool configuration (pool class and options)."""
+
+    def test_sqlite_engine_uses_null_pool(self):
+        """SQLite engines must use NullPool to prevent QueuePool exhaustion."""
+        from sqlalchemy.pool import NullPool
+
+        from app.database import engine
+
+        # The test environment uses SQLite, so NullPool should be in effect.
+        assert isinstance(engine.pool, NullPool)
+
+    def test_create_engine_sqlite_null_pool(self):
+        """Explicitly create a SQLite engine to confirm NullPool is applied."""
+        from sqlalchemy import create_engine
+        from sqlalchemy.pool import NullPool
+
+        test_engine = create_engine(
+            "sqlite:///:memory:",
+            connect_args={"check_same_thread": False},
+            poolclass=NullPool,
+        )
+        assert isinstance(test_engine.pool, NullPool)
+        test_engine.dispose()
+
+    def test_pool_settings_exist_in_config(self):
+        """Verify that pool tuning settings are exposed through config."""
+        from app.config import settings
+
+        assert hasattr(settings, "db_pool_size")
+        assert hasattr(settings, "db_max_overflow")
+        assert hasattr(settings, "db_pool_timeout")
+        assert hasattr(settings, "db_pool_recycle")
+
+    def test_pool_settings_have_sensible_defaults(self):
+        """Default pool settings should be larger than SQLAlchemy's built-in defaults."""
+        from app.config import settings
+
+        # SQLAlchemy defaults: pool_size=5, max_overflow=10
+        assert settings.db_pool_size >= 10
+        assert settings.db_max_overflow >= 20
+        assert settings.db_pool_timeout >= 30
+        assert settings.db_pool_recycle >= 1800

tests/test_diagnostic.py

@@ -5,6 +5,86 @@ from unittest.mock import MagicMock, patch
 import pytest
 
 
+@pytest.mark.unit
+class TestLivenessProbe:
+    """Tests for GET /api/diagnostic/healthz/live (unauthenticated)."""
+
+    def test_liveness_returns_200(self, client):
+        """Liveness probe always returns 200 OK."""
+        response = client.get("/api/diagnostic/healthz/live")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["status"] == "ok"
+
+
+@pytest.mark.unit
+class TestReadinessProbe:
+    """Tests for GET /api/diagnostic/healthz/ready (unauthenticated)."""
+
+    def test_readiness_returns_200_when_all_ok(self, client):
+        """Readiness probe returns 200 when database and Redis are reachable."""
+        with (
+            patch("app.api.diagnostic.engine") as mock_engine,
+            patch("app.api.diagnostic.redis_lib") as mock_redis,
+        ):
+            mock_conn = MagicMock()
+            mock_engine.connect.return_value.__enter__ = MagicMock(return_value=mock_conn)
+            mock_engine.connect.return_value.__exit__ = MagicMock(return_value=False)
+            mock_redis_inst = MagicMock()
+            mock_redis.from_url.return_value = mock_redis_inst
+
+            response = client.get("/api/diagnostic/healthz/ready")
+
+        assert response.status_code == 200
+        data = response.json()
+        assert data["status"] == "ready"
+        assert data["checks"]["database"]["status"] == "ok"
+
+    def test_readiness_returns_503_when_database_fails(self, client):
+        """Readiness probe returns 503 when database is unreachable."""
+        with (
+            patch("app.api.diagnostic.engine") as mock_engine,
+            patch("app.api.diagnostic.redis_lib") as mock_redis,
+        ):
+            mock_engine.connect.side_effect = Exception("DB unavailable")
+            mock_redis_inst = MagicMock()
+            mock_redis.from_url.return_value = mock_redis_inst
+
+            response = client.get("/api/diagnostic/healthz/ready")
+
+        assert response.status_code == 503
+        data = response.json()
+        assert data["status"] == "not_ready"
+        assert data["checks"]["database"]["status"] == "error"
+
+    def test_readiness_returns_200_when_redis_fails(self, client):
+        """Readiness remains 200 when only Redis is down (non-critical)."""
+        with (
+            patch("app.api.diagnostic.engine") as mock_engine,
+            patch("app.api.diagnostic.redis_lib") as mock_redis,
+        ):
+            mock_conn = MagicMock()
+            mock_engine.connect.return_value.__enter__ = MagicMock(return_value=mock_conn)
+            mock_engine.connect.return_value.__exit__ = MagicMock(return_value=False)
+            mock_redis.from_url.return_value = MagicMock()
+            mock_redis.from_url.return_value.ping.side_effect = Exception("Connection refused")
+
+            response = client.get("/api/diagnostic/healthz/ready")
+
+        assert response.status_code == 200
+        data = response.json()
+        assert data["status"] == "ready"
+        assert data["checks"]["redis"]["status"] == "error"
+
+    def test_readiness_contains_checks_keys(self, client):
+        """Readiness response always contains database and redis checks."""
+        response = client.get("/api/diagnostic/healthz/ready")
+        data = response.json()
+        assert "checks" in data
+        assert "database" in data["checks"]
+        assert "redis" in data["checks"]
+
+
 @pytest.mark.unit
 class TestHealthEndpoint:
     """Tests for GET /api/diagnostic/health endpoint."""

tests/test_duplicates.py

@@ -3,11 +3,12 @@
 Covers:
 - ``GET /api/duplicates``            — list all exact-duplicate groups
 - ``GET /api/files/{id}/duplicates`` — per-file exact + near-duplicate info
-- ``POST /api/ui-upload``            — exact-duplicate warning in upload response
+- ``POST /api/ui-upload``            — exact-duplicate rejection at upload time
 - ``GET /duplicates``                — duplicate management UI page
 """
 
 import json
+import os
 from unittest.mock import patch
 
 import pytest
@@ -283,17 +284,25 @@ class TestGetFileDuplicates:
 
 
 # ---------------------------------------------------------------------------
-# POST /api/ui-upload  — exact-duplicate warning
+# POST /api/ui-upload  — exact-duplicate rejection
 # ---------------------------------------------------------------------------
 
 
-class TestUploadDuplicateWarning:
-    """Tests for duplicate warning injected into the upload response."""
+class TestUploadDuplicateRejection:
+    """Tests for duplicate rejection at upload time.
+
+    When ``ENABLE_DEDUPLICATION`` is ``True`` (the default) and the uploaded
+    file's SHA-256 hash matches an already-processed document, the upload
+    endpoint must:
+    - return ``status: "duplicate"`` instead of ``"queued"``
+    - **not** enqueue a Celery task
+    - clean up the temporary file from disk
+    """
 
     @pytest.mark.integration
     @patch("app.tasks.process_document.process_document.delay")
     def test_no_warning_for_unique_file(self, mock_delay, client: TestClient, tmp_path):
-        """Uploading a unique file should not produce a duplicate_warning."""
+        """Uploading a unique file should not produce a duplicate response."""
         mock_delay.return_value.id = "task-unique"
         pdf = tmp_path / "unique.pdf"
         pdf.write_bytes(b"%PDF-1.4\n%%EOF")
@@ -306,14 +315,12 @@ class TestUploadDuplicateWarning:
 
         assert response.status_code == 200
         data = response.json()
-        assert "duplicate_warning" not in data or data.get("duplicate_warning") is None
+        assert data["status"] == "queued"
+        assert "duplicate_of" not in data
 
     @pytest.mark.integration
-    @patch("app.tasks.process_document.process_document.delay")
-    def test_warning_for_exact_duplicate(self, mock_delay, client: TestClient, db_session, tmp_path):
-        """Uploading a file with the same hash as an existing record returns a warning."""
-        mock_delay.return_value.id = "task-dup"
-
+    def test_exact_duplicate_rejected(self, client: TestClient, db_session, tmp_path):
+        """Uploading a file with the same hash as an existing record is rejected."""
         # Create a real PDF with known content
         pdf_bytes = b"%PDF-1.4\nsome unique content for test\n%%EOF"
         pdf = tmp_path / "existing.pdf"
@@ -335,16 +342,14 @@ class TestUploadDuplicateWarning:
 
         assert response.status_code == 200
         data = response.json()
-        assert "duplicate_warning" in data
-        assert data["duplicate_warning"]["duplicate_type"] == "exact"
-        assert data["duplicate_warning"]["original_file_id"] == existing.id
+        assert data["status"] == "duplicate"
+        assert "duplicate_of" in data
+        assert data["duplicate_of"]["duplicate_type"] == "exact"
+        assert data["duplicate_of"]["original_file_id"] == existing.id
 
     @pytest.mark.integration
-    @patch("app.tasks.process_document.process_document.delay")
-    def test_upload_still_queued_despite_warning(self, mock_delay, client: TestClient, db_session, tmp_path):
-        """Even when a duplicate is detected, the file should still be queued."""
-        mock_delay.return_value.id = "task-still-queued"
-
+    def test_duplicate_not_enqueued(self, client: TestClient, db_session, tmp_path):
+        """When a duplicate is detected, no Celery task should be created."""
         pdf_bytes = b"%PDF-1.4\nqueue test content\n%%EOF"
         pdf = tmp_path / "queue_test.pdf"
         pdf.write_bytes(pdf_bytes)
@@ -354,16 +359,47 @@ class TestUploadDuplicateWarning:
         filehash = hash_file(str(pdf))
         _make_file(db_session, filehash=filehash, filename="queue_orig.pdf")
 
-        with open(pdf, "rb") as f:
-            response = client.post(
-                "/api/ui-upload",
-                files={"file": ("queue_test.pdf", f, "application/pdf")},
-            )
+        with patch("app.tasks.process_document.process_document.delay") as mock_delay:
+            with open(pdf, "rb") as f:
+                response = client.post(
+                    "/api/ui-upload",
+                    files={"file": ("queue_test.pdf", f, "application/pdf")},
+                )
 
         assert response.status_code == 200
         data = response.json()
-        assert "task_id" in data
-        assert data["status"] == "queued"
+        assert data["status"] == "duplicate"
+        assert "task_id" not in data
+        mock_delay.assert_not_called()
+
+    @pytest.mark.integration
+    def test_duplicate_temp_file_cleaned_up(self, client: TestClient, db_session, tmp_path):
+        """The temporary file saved to disk should be removed for a duplicate."""
+        pdf_bytes = b"%PDF-1.4\ncleanup test content\n%%EOF"
+        pdf = tmp_path / "cleanup_test.pdf"
+        pdf.write_bytes(pdf_bytes)
+
+        from app.utils.file_operations import hash_file
+
+        filehash = hash_file(str(pdf))
+        _make_file(db_session, filehash=filehash, filename="cleanup_orig.pdf")
+
+        with patch("app.tasks.process_document.process_document.delay"):
+            with open(pdf, "rb") as f:
+                response = client.post(
+                    "/api/ui-upload",
+                    files={"file": ("cleanup_test.pdf", f, "application/pdf")},
+                )
+
+        assert response.status_code == 200
+        data = response.json()
+        # The stored_filename is returned so we can verify cleanup
+        stored = data.get("stored_filename")
+        assert stored is not None
+
+        from app.config import settings
+
+        assert not os.path.exists(os.path.join(settings.workdir, stored))
 
 
 # ---------------------------------------------------------------------------

tests/test_local_auth.py

@@ -322,6 +322,35 @@ def test_signup_duplicate_username(la_client, active_user):
     assert "Username" in resp.json()["detail"]
 
 
+@pytest.mark.integration
+def test_signup_invalid_username_with_dot(la_client):
+    """POST /api/auth/signup returns 422 with a list detail when username contains a dot.
+
+    This is a regression test for the bug where ``data.detail`` was an array,
+    causing the frontend to display ``[object Object]`` instead of a message.
+    """
+    with patch("app.api.local_auth.settings") as mock_settings:
+        mock_settings.allow_local_signup = True
+        mock_settings.multi_user_enabled = True
+        mock_settings.email_host = "smtp.example.com"
+        resp = la_client.post(
+            "/api/auth/signup",
+            json={
+                "email": "a@example.com",
+                "username": "christian.louis",
+                "password": "password1",
+                "password_confirm": "password1",
+            },
+        )
+    assert resp.status_code == 422
+    detail = resp.json()["detail"]
+    # FastAPI returns a list of validation errors for Pydantic constraint failures.
+    # Each entry must be a dict with a "msg" key so the frontend can extract a readable message.
+    assert isinstance(detail, list), "detail should be a list for Pydantic validation errors"
+    assert len(detail) > 0
+    assert "msg" in detail[0]
+
+
 @pytest.mark.integration
 def test_signup_smtp_failure_cleans_up(la_client, la_session):
     """POST /api/auth/signup cleans up user records if email send fails."""

tests/test_upload_rate_limit.py

@@ -0,0 +1,265 @@
+"""Tests for per-user health-aware upload rate limiting (app/middleware/upload_rate_limit.py)."""
+
+from __future__ import annotations
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from app.middleware.upload_rate_limit import compute_effective_limit
+
+# ---------------------------------------------------------------------------
+# Tests for compute_effective_limit (pure function, no Redis needed)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.unit
+class TestComputeEffectiveLimit:
+    """Tests for the health-aware effective-limit calculation."""
+
+    def test_normal_conditions_return_base_limit(self):
+        """Under normal conditions the full base limit should be returned."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=0, cpu_load_ratio=0.0)
+        assert effective == 20
+        assert factor == 1.0
+        assert reason == "normal"
+
+    def test_moderate_queue_halves_limit(self):
+        """Queue depth > 50 should halve the base limit."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=60, cpu_load_ratio=0.0)
+        assert effective == 10
+        assert factor == 0.5
+        assert "moderate_queue" in reason
+
+    def test_high_queue_quarters_limit(self):
+        """Queue depth > 100 should quarter the base limit."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=120, cpu_load_ratio=0.0)
+        assert effective == 5
+        assert factor == 0.25
+        assert "high_queue" in reason
+
+    def test_critical_queue_drops_to_ten_percent(self):
+        """Queue depth > 200 should drop to 10% of base limit."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=250, cpu_load_ratio=0.0)
+        assert effective == 2
+        assert factor == 0.10
+        assert "critical_queue" in reason
+
+    def test_moderate_cpu_halves_limit(self):
+        """CPU load ratio > 1.5 should halve the base limit."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=0, cpu_load_ratio=1.8)
+        assert effective == 10
+        assert factor == 0.5
+        assert "moderate_cpu" in reason
+
+    def test_high_cpu_quarters_limit(self):
+        """CPU load ratio > 2.0 should quarter the base limit."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=0, cpu_load_ratio=2.5)
+        assert effective == 5
+        assert factor == 0.25
+        assert "high_cpu" in reason
+
+    def test_critical_cpu_drops_to_ten_percent(self):
+        """CPU load ratio > 3.0 should drop to 10% of base limit."""
+        effective, factor, reason = compute_effective_limit(20, queue_depth=0, cpu_load_ratio=4.0)
+        assert effective == 2
+        assert factor == 0.10
+        assert "critical_cpu" in reason
+
+    def test_worst_metric_wins(self):
+        """The lowest factor from queue and CPU should be applied."""
+        # Queue says 0.5, CPU says 0.25 → 0.25 wins
+        effective, factor, reason = compute_effective_limit(20, queue_depth=60, cpu_load_ratio=2.5)
+        assert effective == 5
+        assert factor == 0.25
+
+    def test_minimum_effective_limit_is_one(self):
+        """Even under extreme load the effective limit must be ≥ 1."""
+        effective, _factor, _reason = compute_effective_limit(1, queue_depth=999, cpu_load_ratio=10.0)
+        assert effective >= 1
+
+    def test_zero_base_limit_returns_zero(self):
+        """A base limit of 0 (disabled) should clamp to at least 1."""
+        effective, _factor, _reason = compute_effective_limit(0, queue_depth=0, cpu_load_ratio=0.0)
+        # max(1, int(0 * 1.0)) = max(1, 0) = 1
+        # A base_limit of 0 means "disabled" and is handled upstream
+        # (the dependency skips the check entirely), but the pure function
+        # still clamps to 1 as a safety net.
+        assert effective == 1
+
+
+# ---------------------------------------------------------------------------
+# Tests for the FastAPI dependency (mocked Redis)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.unit
+class TestRequireUploadRateLimit:
+    """Tests for the require_upload_rate_limit FastAPI dependency."""
+
+    @pytest.mark.asyncio
+    async def test_allows_request_when_redis_unavailable(self):
+        """When Redis is down the dependency should fail open (allow the request)."""
+        from app.middleware.upload_rate_limit import require_upload_rate_limit
+
+        mock_request = MagicMock()
+        mock_request.session = {}
+        mock_request.client = MagicMock()
+        mock_request.client.host = "127.0.0.1"
+
+        with patch("app.middleware.upload_rate_limit._get_redis", return_value=None):
+            # Should NOT raise
+            result = await require_upload_rate_limit(mock_request)
+            assert result is None
+
+    @pytest.mark.asyncio
+    async def test_allows_request_under_limit(self):
+        """A user below the rate limit should be allowed through."""
+        from app.middleware.upload_rate_limit import require_upload_rate_limit
+
+        mock_request = MagicMock()
+        mock_request.session = {"user": {"username": "testuser"}}
+        mock_request.client = MagicMock()
+        mock_request.client.host = "10.0.0.1"
+
+        mock_redis = MagicMock()
+        mock_pipe = MagicMock()
+        mock_pipe.execute.return_value = [
+            0,  # zremrangebyscore result
+            5,  # zcard — current count (under limit of 20)
+            [],  # zrange oldest
+        ]
+        mock_redis.pipeline.return_value = mock_pipe
+        mock_redis.llen.return_value = 0  # empty queues
+
+        mock_pipe2 = MagicMock()
+        mock_pipe2.execute.return_value = [True, True]
+        # The second pipeline call (record upload)
+        mock_redis.pipeline.side_effect = [mock_pipe, mock_pipe2]
+
+        with (
+            patch("app.middleware.upload_rate_limit._get_redis", return_value=mock_redis),
+            patch("app.middleware.upload_rate_limit.get_current_owner_id", return_value="testuser"),
+            patch("app.middleware.upload_rate_limit._get_cpu_load_ratio", return_value=0.1),
+        ):
+            result = await require_upload_rate_limit(mock_request)
+            assert result is None
+
+    @pytest.mark.asyncio
+    async def test_rejects_request_over_limit(self):
+        """A user at or over the rate limit should receive a 429."""
+        from fastapi import HTTPException
+
+        from app.middleware.upload_rate_limit import require_upload_rate_limit
+
+        mock_request = MagicMock()
+        mock_request.session = {"user": {"username": "spammer"}}
+        mock_request.client = MagicMock()
+        mock_request.client.host = "10.0.0.2"
+
+        mock_redis = MagicMock()
+        mock_pipe = MagicMock()
+        mock_pipe.execute.return_value = [
+            0,  # zremrangebyscore
+            20,  # zcard — at limit
+            [("oldest_entry", 1000000.0)],  # oldest entry for retry_after
+        ]
+        mock_redis.pipeline.return_value = mock_pipe
+        mock_redis.llen.return_value = 0
+
+        with (
+            patch("app.middleware.upload_rate_limit._get_redis", return_value=mock_redis),
+            patch("app.middleware.upload_rate_limit.get_current_owner_id", return_value="spammer"),
+            patch("app.middleware.upload_rate_limit._get_cpu_load_ratio", return_value=0.0),
+        ):
+            with pytest.raises(HTTPException) as exc_info:
+                await require_upload_rate_limit(mock_request)
+            assert exc_info.value.status_code == 429
+            assert "Retry-After" in exc_info.value.headers
+
+    @pytest.mark.asyncio
+    async def test_health_reduces_effective_limit(self):
+        """When queues are deep, the effective limit should drop, causing a 429 sooner."""
+        from fastapi import HTTPException
+
+        from app.middleware.upload_rate_limit import require_upload_rate_limit
+
+        mock_request = MagicMock()
+        mock_request.session = {"user": {"username": "normaluser"}}
+        mock_request.client = MagicMock()
+        mock_request.client.host = "10.0.0.3"
+
+        mock_redis = MagicMock()
+        mock_pipe = MagicMock()
+        # 12 uploads already — under normal limit of 20 but over health-reduced limit
+        mock_pipe.execute.return_value = [
+            0,  # zremrangebyscore
+            12,  # zcard — 12 uploads in window
+            [("oldest", 1000000.0)],
+        ]
+        mock_redis.pipeline.return_value = mock_pipe
+        # Simulate deep queue (>100) → effective limit = 25% of 20 = 5
+        mock_redis.llen.return_value = 40  # 40 per queue * 3 = 120 total
+
+        with (
+            patch("app.middleware.upload_rate_limit._get_redis", return_value=mock_redis),
+            patch("app.middleware.upload_rate_limit.get_current_owner_id", return_value="normaluser"),
+            patch("app.middleware.upload_rate_limit._get_cpu_load_ratio", return_value=0.0),
+        ):
+            with pytest.raises(HTTPException) as exc_info:
+                await require_upload_rate_limit(mock_request)
+            assert exc_info.value.status_code == 429
+
+    @pytest.mark.asyncio
+    async def test_falls_back_to_ip_when_no_user(self):
+        """Unauthenticated requests should use IP-based rate limiting."""
+        from app.middleware.upload_rate_limit import require_upload_rate_limit
+
+        mock_request = MagicMock()
+        mock_request.session = {}
+        mock_request.client = MagicMock()
+        mock_request.client.host = "192.168.1.100"
+
+        mock_redis = MagicMock()
+        mock_pipe = MagicMock()
+        mock_pipe.execute.return_value = [0, 0, []]
+        mock_redis.pipeline.return_value = mock_pipe
+        mock_redis.llen.return_value = 0
+
+        mock_pipe2 = MagicMock()
+        mock_pipe2.execute.return_value = [True, True]
+        mock_redis.pipeline.side_effect = [mock_pipe, mock_pipe2]
+
+        with (
+            patch("app.middleware.upload_rate_limit._get_redis", return_value=mock_redis),
+            patch("app.middleware.upload_rate_limit.get_current_owner_id", return_value=None),
+            patch("app.middleware.upload_rate_limit._get_cpu_load_ratio", return_value=0.0),
+        ):
+            result = await require_upload_rate_limit(mock_request)
+            assert result is None
+
+
+# ---------------------------------------------------------------------------
+# Tests for configuration
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.unit
+class TestUploadRateLimitConfig:
+    """Tests for upload rate limit configuration settings."""
+
+    def test_settings_exist(self):
+        """Verify per-user upload rate limit settings are exposed in config."""
+        from app.config import settings
+
+        assert hasattr(settings, "upload_rate_limit_per_user")
+        assert hasattr(settings, "upload_rate_limit_window")
+
+    def test_sensible_defaults(self):
+        """Default values should be reasonable for a multi-user system."""
+        from app.config import settings
+
+        assert settings.upload_rate_limit_per_user >= 10
+        assert settings.upload_rate_limit_per_user <= 100
+        assert settings.upload_rate_limit_window >= 30
+        assert settings.upload_rate_limit_window <= 300

tests/test_views_dropbox.py

@@ -144,3 +144,37 @@ class TestDropboxViews:
         assert response.status_code == 200
         assert b"/Documents/Uploads" in response.content
         assert b"Back to Integrations" in response.content
+
+
+@pytest.mark.integration
+class TestDropboxCallbackUrl:
+    """Tests that the callback_url is correctly passed to templates."""
+
+    def test_setup_page_includes_callback_url(self, client):
+        """Setup page should include the callback_url variable in its response."""
+        response = client.get("/dropbox-setup")
+        assert response.status_code == 200
+        # callback_url is embedded in the JS as the dropboxCallbackUrl constant
+        assert b"dropboxCallbackUrl" in response.content
+
+    def test_callback_page_includes_callback_url(self, client):
+        """Callback page should embed the server-side callback URL."""
+        response = client.get("/dropbox-callback?code=testcode")
+        assert response.status_code == 200
+        # callback_url is used as the redirectUri
+        assert b"redirectUri" in response.content
+
+    def test_setup_page_uses_public_base_url_when_set(self, client):
+        """When PUBLIC_BASE_URL is configured, it should appear in the redirect URI hint."""
+        with patch("app.views.dropbox.settings") as mock_settings:
+            mock_settings.public_base_url = "https://configured.example.com"
+            mock_settings.dropbox_app_key = ""
+            mock_settings.dropbox_app_secret = ""
+            mock_settings.dropbox_refresh_token = ""
+            mock_settings.dropbox_folder = ""
+            mock_settings.dropbox_allow_global_credentials_for_integrations = False
+            response = client.get("/dropbox-setup")
+        assert response.status_code == 200
+        # The configured public_base_url hostname must appear in the page (redirect URI display)
+        page_text = response.text
+        assert "configured.example.com/dropbox-callback" in page_text