From 618800389773eb4b21d83eefa1e84c92e2567d57 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 18:48:13 +0000
Subject: [PATCH 01/12] Initial plan


From b4e0067a27e2fb161349bd38c6d3b3f3bcb86972 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Mar 2026 18:54:52 +0000
Subject: [PATCH 02/12] fix(build): remove --omit=dev from npm ci in Dockerfile
 frontend-builder stage

The Tailwind CSS CLI is a devDependency in frontend/package.json. Using
`npm ci --omit=dev` skipped installing it, causing the Docker build to
fail with 'sh: tailwindcss: not found' at the `npm run build` step.

Since this is a multi-stage build where the frontend-builder stage is
discarded after compilation, all dependencies (including devDependencies)
are needed during the build but do not bloat the final image.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/f16fabb4-4d8c-48e3-8d26-c2d38cc7129f
---
 Dockerfile                   |   2 +-
 tests/test_frontend_build.py | 145 +++++++++++++++++++++++++++++++++++
 2 files changed, 146 insertions(+), 1 deletion(-)
 create mode 100644 tests/test_frontend_build.py

diff --git a/Dockerfile b/Dockerfile
index 3fd59488..82cefb60 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ WORKDIR /frontend
 
 # Install dependencies first (layer-cached unless package.json/lockfile changes)
 COPY frontend/package.json frontend/package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci
 
 # Copy source files and compile Tailwind CSS
 COPY frontend/ ./
diff --git a/tests/test_frontend_build.py b/tests/test_frontend_build.py
new file mode 100644
index 00000000..528bbfff
--- /dev/null
+++ b/tests/test_frontend_build.py
@@ -0,0 +1,145 @@
+"""Tests for frontend build configuration and Docker build consistency.
+
+Validates that the frontend build toolchain (Tailwind CSS) is correctly
+configured in package.json and that the Dockerfile installs all required
+dependencies for the build step.
+"""
+
+import json
+import re
+from pathlib import Path
+
+import pytest
+
+# Resolve the project root from the test file location
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+FRONTEND_DIR = PROJECT_ROOT / "frontend"
+DOCKERFILE_PATH = PROJECT_ROOT / "Dockerfile"
+
+
+@pytest.mark.unit
+class TestFrontendPackageJson:
+    """Validate frontend/package.json structure and scripts."""
+
+    def test_package_json_exists(self) -> None:
+        """package.json must exist in the frontend directory."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        assert pkg_path.exists(), "frontend/package.json not found"
+
+    def test_package_json_is_valid_json(self) -> None:
+        """package.json must be parseable JSON."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        assert isinstance(data, dict), "package.json must be a JSON object"
+
+    def test_build_script_defined(self) -> None:
+        """A 'build' script must be defined in package.json."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        scripts = data.get("scripts", {})
+        assert "build" in scripts, "Missing 'build' script in package.json"
+
+    def test_build_script_uses_tailwindcss(self) -> None:
+        """The build script must invoke the tailwindcss CLI."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        build_cmd = data["scripts"]["build"]
+        assert "tailwindcss" in build_cmd, f"Build script does not reference tailwindcss: {build_cmd}"
+
+    def test_tailwindcss_listed_as_dependency(self) -> None:
+        """tailwindcss must be listed in dependencies or devDependencies."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        deps = data.get("dependencies", {})
+        dev_deps = data.get("devDependencies", {})
+        all_deps = {**deps, **dev_deps}
+        assert "tailwindcss" in all_deps, "tailwindcss is not listed in dependencies or devDependencies"
+
+
+@pytest.mark.unit
+class TestFrontendBuildAssets:
+    """Validate that required frontend build source files exist."""
+
+    def test_input_css_exists(self) -> None:
+        """The Tailwind CSS input file must exist."""
+        input_css = FRONTEND_DIR / "input.css"
+        assert input_css.exists(), "frontend/input.css not found"
+
+    def test_input_css_has_tailwind_directives(self) -> None:
+        """input.css must include Tailwind CSS directives."""
+        input_css = FRONTEND_DIR / "input.css"
+        content = input_css.read_text(encoding="utf-8")
+        assert "@tailwind base" in content, "Missing @tailwind base directive"
+        assert "@tailwind components" in content, "Missing @tailwind components directive"
+        assert "@tailwind utilities" in content, "Missing @tailwind utilities directive"
+
+    def test_tailwind_config_exists(self) -> None:
+        """tailwind.config.js must exist in the frontend directory."""
+        config_path = FRONTEND_DIR / "tailwind.config.js"
+        assert config_path.exists(), "frontend/tailwind.config.js not found"
+
+    def test_package_lock_exists(self) -> None:
+        """package-lock.json must exist for reproducible installs."""
+        lock_path = FRONTEND_DIR / "package-lock.json"
+        assert lock_path.exists(), "frontend/package-lock.json not found"
+
+
+@pytest.mark.unit
+class TestDockerfileFrontendBuilder:
+    """Validate the Dockerfile frontend-builder stage installs build dependencies."""
+
+    def test_dockerfile_exists(self) -> None:
+        """Production Dockerfile must exist at the project root."""
+        assert DOCKERFILE_PATH.exists(), "Dockerfile not found at project root"
+
+    def test_dockerfile_has_frontend_builder_stage(self) -> None:
+        """Dockerfile must define a frontend-builder stage."""
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+        assert "AS frontend-builder" in content, "Dockerfile does not define a frontend-builder stage"
+
+    def test_dockerfile_npm_ci_does_not_omit_dev(self) -> None:
+        """npm ci must NOT use --omit=dev in the frontend-builder stage.
+
+        The tailwindcss CLI is a devDependency required at build time.
+        Using --omit=dev would skip installing it, causing the build to
+        fail with 'tailwindcss: not found'.
+        """
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+
+        # Extract the frontend-builder stage content
+        # Look for the stage start and the next stage (or end of file)
+        stage_pattern = re.compile(
+            r"FROM\s+\S+\s+AS\s+frontend-builder\b(.*?)(?=FROM\s|\Z)",
+            re.DOTALL,
+        )
+        match = stage_pattern.search(content)
+        assert match is not None, "Could not find frontend-builder stage in Dockerfile"
+
+        stage_content = match.group(1)
+        assert "--omit=dev" not in stage_content, (
+            "Dockerfile frontend-builder stage uses 'npm ci --omit=dev' which "
+            "excludes tailwindcss (a devDependency) needed for the build step. "
+            "Use 'npm ci' instead to install all dependencies."
+        )
+
+    def test_dockerfile_runs_npm_build(self) -> None:
+        """Dockerfile frontend-builder stage must run npm run build."""
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+
+        stage_pattern = re.compile(
+            r"FROM\s+\S+\s+AS\s+frontend-builder\b(.*?)(?=FROM\s|\Z)",
+            re.DOTALL,
+        )
+        match = stage_pattern.search(content)
+        assert match is not None, "Could not find frontend-builder stage in Dockerfile"
+
+        stage_content = match.group(1)
+        assert "npm run build" in stage_content, "Dockerfile frontend-builder stage does not run 'npm run build'"
+
+    def test_dockerfile_copies_compiled_css(self) -> None:
+        """Dockerfile must copy the compiled styles.css from the frontend-builder stage."""
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+        assert "COPY --from=frontend-builder" in content, (
+            "Dockerfile does not copy assets from the frontend-builder stage"
+        )
+        assert "styles.css" in content, "Dockerfile does not reference the compiled styles.css"

From c4e10bee5e096e71a5bc4fac4928f69e5c04f2fb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 23 Mar 2026 12:50:09 +0000
Subject: [PATCH 03/12] fix: adapt TemplateResponse calls to Starlette 1.0
 new-style API

Starlette 1.0.0 changed TemplateResponse signature from
(name, context_dict) to (request, name, context=dict).

- Update base.py wrapper to convert old-style calls to new-style
- Update main.py error handler TemplateResponse calls
- Update local_auth.py, billing.py, auth.py, share.py calls
- Update test mocks for new calling convention

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/7b5f7e0d-89ad-43be-b68d-a9c0c5407a7e
---
 app/api/billing.py         |  2 +-
 app/api/local_auth.py      | 18 +++++++++---------
 app/auth.py                |  4 ++--
 app/main.py                |  7 ++++---
 app/views/base.py          | 33 ++++++++++++++++++++++++++++-----
 app/views/share.py         |  3 ++-
 tests/test_dark_mode.py    |  8 ++++----
 tests/test_social_login.py |  4 ++--
 8 files changed, 52 insertions(+), 27 deletions(-)

diff --git a/app/api/billing.py b/app/api/billing.py
index 9c5582b0..85528608 100644
--- a/app/api/billing.py
+++ b/app/api/billing.py
@@ -260,7 +260,7 @@ async def stripe_webhook(request: Request, db: Session = Depends(get_db)) -> dic
 @require_login
 async def billing_success(request: Request) -> Any:
     """Show a success page after a completed Stripe Checkout."""
-    return _templates.TemplateResponse("billing_success.html", {"request": request})
+    return _templates.TemplateResponse(request, "billing_success.html")
 
 
 # ---------------------------------------------------------------------------
diff --git a/app/api/local_auth.py b/app/api/local_auth.py
index 2b68003f..e946f484 100644
--- a/app/api/local_auth.py
+++ b/app/api/local_auth.py
@@ -101,9 +101,9 @@ async def signup_page(request: Request) -> Any:
     if not settings.allow_local_signup:
         return RedirectResponse(url="/login?error=Registration+is+not+enabled", status_code=302)
     return templates.TemplateResponse(
+        request,
         "signup.html",
-        {
-            "request": request,
+        context={
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -113,16 +113,16 @@ async def signup_page(request: Request) -> Any:
 @router.get("/verify-email-sent", include_in_schema=False)
 async def verify_email_sent_page(request: Request) -> Any:
     """Render the verify-email-sent confirmation page."""
-    return templates.TemplateResponse("verify_email_sent.html", {"request": request})
+    return templates.TemplateResponse(request, "verify_email_sent.html")
 
 
 @router.get("/forgot-username", include_in_schema=False)
 async def forgot_username_page(request: Request) -> Any:
     """Render the forgot-username page where users can request a username reminder email."""
     return templates.TemplateResponse(
+        request,
         "forgot_username.html",
-        {
-            "request": request,
+        context={
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -133,9 +133,9 @@ async def forgot_username_page(request: Request) -> Any:
 async def forgot_password_page(request: Request) -> Any:
     """Render the forgot-password page where users can request a reset email."""
     return templates.TemplateResponse(
+        request,
         "forgot_password.html",
-        {
-            "request": request,
+        context={
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -147,9 +147,9 @@ async def reset_password_page(request: Request) -> Any:
     """Render the password reset form page."""
     token = request.query_params.get("token", "")
     return templates.TemplateResponse(
+        request,
         "password_reset_form.html",
-        {
-            "request": request,
+        context={
             "token": token,
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
diff --git a/app/auth.py b/app/auth.py
index 694d08cc..eb0254be 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -536,9 +536,9 @@ async def login(request: Request):
         return RedirectResponse(url="/oauth-login", status_code=status.HTTP_302_FOUND)
 
     return templates.TemplateResponse(
+        request,
         "login.html",
-        {
-            "request": request,
+        context={
             "error": error,
             "message": message,
             "show_oauth": show_oauth,
diff --git a/app/main.py b/app/main.py
index 89477ceb..3e2ee632 100644
--- a/app/main.py
+++ b/app/main.py
@@ -425,14 +425,14 @@ async def http_exception_handler(request: Request, exc: HTTPException):
     # Handle 404 errors with a custom template
     if exc.status_code == 404:
         return _error_templates.TemplateResponse(
-            "404.html", {"request": request}, status_code=status.HTTP_404_NOT_FOUND
+            request, "404.html", status_code=status.HTTP_404_NOT_FOUND
         )
 
     # For other HTTP errors, we could create specific templates or use a generic one
     # For now, return a simple error page
     return _error_templates.TemplateResponse(
+        request,
         "404.html",  # Reuse 404 template for other errors, or create a generic error template
-        {"request": request},
         status_code=exc.status_code,
     )
 
@@ -452,8 +452,9 @@ async def custom_500_handler(request: Request, exc: Exception):
 
     # Serve the 500 template for non-API routes
     return _error_templates.TemplateResponse(
+        request,
         "500.html",
-        {"request": request, "exc": exc},
+        context={"exc": exc},
         status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
     )
 
diff --git a/app/views/base.py b/app/views/base.py
index 6a116733..0c4d2684 100644
--- a/app/views/base.py
+++ b/app/views/base.py
@@ -162,12 +162,35 @@ def _inject_global_context(ctx: dict) -> None:
 
 
 def template_response_with_version(*args, **kwargs):
-    """Wrapper for TemplateResponse to include version and CSRF token in all templates"""
-    # If context dict is provided, add version to it
-    if len(args) >= 2 and isinstance(args[1], dict):
-        _inject_global_context(args[1])
-    elif "context" in kwargs and isinstance(kwargs["context"], dict):
+    """Wrapper for TemplateResponse to include version and CSRF token in all templates.
+
+    Handles both old-style and new-style Starlette TemplateResponse calls:
+      - Old-style (Starlette <1.0): TemplateResponse(name, {"request": req, ...}, ...)
+      - New-style (Starlette 1.0+): TemplateResponse(request, name, context={...}, ...)
+    """
+    if len(args) >= 1 and isinstance(args[0], str):
+        # Old-style call: first positional arg is the template name (string).
+        # Convert to new-style: (request, name, context=..., ...)
+        name = args[0]
+        if len(args) >= 2 and isinstance(args[1], dict):
+            context = args[1]
+            remaining_args = args[2:]
+        else:
+            context = kwargs.pop("context", {})
+            remaining_args = args[1:]
+        request_obj = context.pop("request", None)
+        if request_obj is not None:
+            context["request"] = request_obj
+        _inject_global_context(context)
+        if request_obj is not None:
+            return original_template_response(request_obj, name, context=context, *remaining_args, **kwargs)
+        return original_template_response(name, context=context, *remaining_args, **kwargs)
+
+    # New-style call: (request, name, context=..., ...)
+    if "context" in kwargs and isinstance(kwargs["context"], dict):
         _inject_global_context(kwargs["context"])
+    elif len(args) >= 3 and isinstance(args[2], dict):
+        _inject_global_context(args[2])
     return original_template_response(*args, **kwargs)
 
 
diff --git a/app/views/share.py b/app/views/share.py
index 118e0ee9..925342f6 100644
--- a/app/views/share.py
+++ b/app/views/share.py
@@ -23,6 +23,7 @@ templates = Jinja2Templates(directory=str(_templates_dir))
 async def shared_link_view(request: Request, token: str):
     """Render the public share landing page for a given token."""
     return templates.TemplateResponse(
+        request,
         "shared_link_view.html",
-        {"request": request, "token": token},
+        context={"token": token},
     )
diff --git a/tests/test_dark_mode.py b/tests/test_dark_mode.py
index 82514a20..a39752c7 100644
--- a/tests/test_dark_mode.py
+++ b/tests/test_dark_mode.py
@@ -55,8 +55,8 @@ class TestDarkModeTemplateInjection:
 
         captured = {}
 
-        def fake_original(name, ctx, **kw):
-            captured.update(ctx)
+        def fake_original(request_obj, name, context=None, **kw):
+            captured.update(context or {})
 
         with patch("app.views.base.original_template_response", side_effect=fake_original):
             mock_request = MagicMock()
@@ -73,8 +73,8 @@ class TestDarkModeTemplateInjection:
 
         captured = {}
 
-        def fake_original(name, ctx, **kw):
-            captured.update(ctx)
+        def fake_original(request_obj, name, context=None, **kw):
+            captured.update(context or {})
 
         with patch("app.views.base.original_template_response", side_effect=fake_original):
             mock_request = MagicMock()
diff --git a/tests/test_social_login.py b/tests/test_social_login.py
index 54c81931..f46c874f 100644
--- a/tests/test_social_login.py
+++ b/tests/test_social_login.py
@@ -345,7 +345,7 @@ class TestLoginPageSocialProviders:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args[0][1]
+            context = call_args.kwargs.get("context") or call_args[0][2] if len(call_args[0]) > 2 else {}
             assert context["social_providers"] == mock_providers
 
     @pytest.mark.asyncio
@@ -371,7 +371,7 @@ class TestLoginPageSocialProviders:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args[0][1]
+            context = call_args.kwargs.get("context") or call_args[0][2] if len(call_args[0]) > 2 else {}
             assert context["social_providers"] == {}
 
 

From 93629ff44083d43f79fdd49431457023e53d13e4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:14:25 +0000
Subject: [PATCH 04/12] fix: update test assertions and lint fixes for
 Starlette 1.0 TemplateResponse API

Update test mocks to check kwargs["context"] instead of positional
args[1] for tests that verify auth.py and base.py wrapper behavior.
Fix B026 lint error by avoiding star-arg after keyword argument.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/7b5f7e0d-89ad-43be-b68d-a9c0c5407a7e
---
 app/main.py                           | 4 +---
 app/views/base.py                     | 9 +++++----
 tests/test_auth.py                    | 6 +++---
 tests/test_auth_module.py             | 2 +-
 tests/test_coverage_remaining_gaps.py | 5 +++--
 tests/test_social_login.py            | 4 ++--
 6 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/app/main.py b/app/main.py
index 3e2ee632..b11b3148 100644
--- a/app/main.py
+++ b/app/main.py
@@ -424,9 +424,7 @@ async def http_exception_handler(request: Request, exc: HTTPException):
     # For frontend routes, return appropriate HTML templates
     # Handle 404 errors with a custom template
     if exc.status_code == 404:
-        return _error_templates.TemplateResponse(
-            request, "404.html", status_code=status.HTTP_404_NOT_FOUND
-        )
+        return _error_templates.TemplateResponse(request, "404.html", status_code=status.HTTP_404_NOT_FOUND)
 
     # For other HTTP errors, we could create specific templates or use a generic one
     # For now, return a simple error page
diff --git a/app/views/base.py b/app/views/base.py
index 0c4d2684..f3ffa157 100644
--- a/app/views/base.py
+++ b/app/views/base.py
@@ -174,17 +174,18 @@ def template_response_with_version(*args, **kwargs):
         name = args[0]
         if len(args) >= 2 and isinstance(args[1], dict):
             context = args[1]
-            remaining_args = args[2:]
+            # Old-style may have status_code as 3rd positional arg
+            if len(args) >= 3 and "status_code" not in kwargs:
+                kwargs["status_code"] = args[2]
         else:
             context = kwargs.pop("context", {})
-            remaining_args = args[1:]
         request_obj = context.pop("request", None)
         if request_obj is not None:
             context["request"] = request_obj
         _inject_global_context(context)
         if request_obj is not None:
-            return original_template_response(request_obj, name, context=context, *remaining_args, **kwargs)
-        return original_template_response(name, context=context, *remaining_args, **kwargs)
+            return original_template_response(request_obj, name, context=context, **kwargs)
+        return original_template_response(name, context=context, **kwargs)
 
     # New-style call: (request, name, context=..., ...)
     if "context" in kwargs and isinstance(kwargs["context"], dict):
diff --git a/tests/test_auth.py b/tests/test_auth.py
index 85e047e8..d3af75ca 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -430,8 +430,8 @@ class TestLoginFunction:
             # Verify TemplateResponse was called with correct context
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            assert call_args[0][0] == "login.html"
-            context = call_args[0][1]
+            assert call_args[0][1] == "login.html"
+            context = call_args.kwargs["context"]
             assert context["error"] == "Test error"
             assert context["message"] == "Test message"
 
@@ -450,7 +450,7 @@ class TestLoginFunction:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args[0][1]
+            context = call_args.kwargs["context"]
             assert context["error"] is None
             assert context["message"] is None
 
diff --git a/tests/test_auth_module.py b/tests/test_auth_module.py
index 233dfd5e..ba41b756 100644
--- a/tests/test_auth_module.py
+++ b/tests/test_auth_module.py
@@ -281,7 +281,7 @@ class TestLoginEndpoint:
                             # Verify template was rendered with OAuth enabled
                             mock_templates.TemplateResponse.assert_called_once()
                             call_args = mock_templates.TemplateResponse.call_args
-                            context = call_args[0][1]
+                            context = call_args.kwargs["context"]
                             assert context["show_oauth"] is True
                             assert context["oauth_provider_name"] == "Test SSO"
 
diff --git a/tests/test_coverage_remaining_gaps.py b/tests/test_coverage_remaining_gaps.py
index b4bf96ec..e68fdb93 100644
--- a/tests/test_coverage_remaining_gaps.py
+++ b/tests/test_coverage_remaining_gaps.py
@@ -69,8 +69,9 @@ class TestViewsBase:
             context = {"request": req}
             template_response_with_version("template.html", context)
 
-        args, _ = mock_orig.call_args
-        assert args[1].get("csrf_token") == "my-csrf"
+        args, kwargs = mock_orig.call_args
+        context = kwargs.get("context", {})
+        assert context.get("csrf_token") == "my-csrf"
 
     def test_kwargs_context_no_request(self):
         """Test kwargs context path when request is not in context."""
diff --git a/tests/test_social_login.py b/tests/test_social_login.py
index f46c874f..b4b330bc 100644
--- a/tests/test_social_login.py
+++ b/tests/test_social_login.py
@@ -345,7 +345,7 @@ class TestLoginPageSocialProviders:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args.kwargs.get("context") or call_args[0][2] if len(call_args[0]) > 2 else {}
+            context = call_args.kwargs.get("context", {})
             assert context["social_providers"] == mock_providers
 
     @pytest.mark.asyncio
@@ -371,7 +371,7 @@ class TestLoginPageSocialProviders:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args.kwargs.get("context") or call_args[0][2] if len(call_args[0]) > 2 else {}
+            context = call_args.kwargs.get("context", {})
             assert context["social_providers"] == {}
 
 

From 8b4280d5ddeed3f111a114297b0c1f9ba0ca00fc Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:42:14 +0000
Subject: [PATCH 05/12] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20Fix=20SSRF=20bypass=20on=20DNS=20resolution=20failure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Modified `is_private_ip` in `app/utils/network.py` to fail securely by returning True (blocking the request) when a hostname cannot be resolved. The previous implementation failed open, creating a risk for Server-Side Request Forgery (SSRF) and DNS rebinding attacks.

Updated corresponding tests to expect the secure behavior.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 .jules/sentinel.md            | 12 ++++--------
 app/utils/network.py          | 10 +++++-----
 tests/test_coverage_polish.py |  4 ++--
 tests/test_url_upload.py      | 12 ++++++++++++
 4 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index fa35a57f..4ad0579f 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,8 +1,4 @@
-## 2024-05-24 - SSRF in WebDAV connection test
-**Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`).
-**Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users.
-**Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private.
-## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx
-**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion.
-**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`).
-**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs.
+## 2025-05-18 - [SSRF Bypass via DNS Resolution Failure]
+**Vulnerability:** The `is_private_ip` function in `app/utils/network.py` failed open (returned `False`) when a hostname could not be resolved (`socket.gaierror`).
+**Learning:** This fail-open pattern was originally added to allow external domains in tests, but in production, it created a severe SSRF risk. An attacker could bypass SSRF protections by providing a URL that fails to resolve during the security check but resolves later (DNS rebinding), or by exploiting internal routing behaviors via unresolvable addresses.
+**Prevention:** Always fail securely in network authorization functions. If a domain cannot be resolved to verify its safety, the request must be blocked (`return True` / default-deny). Tests should mock DNS resolution correctly instead of compromising production security logic.
\ No newline at end of file
diff --git a/app/utils/network.py b/app/utils/network.py
index 7ea6d88b..ef775ba0 100644
--- a/app/utils/network.py
+++ b/app/utils/network.py
@@ -27,8 +27,8 @@ def is_private_ip(hostname: str) -> bool:
                     return True
             return False
         except (socket.gaierror, socket.error):
-            # Cannot resolve - allow for testing/development
-            # In production, DNS should work properly
-            # Log this for debugging
-            logger.warning(f"Could not resolve hostname: {hostname}")
-            return False  # Changed from True to False to allow external domains in tests
+            # Cannot resolve.
+            # Fail securely: block unresolved domains to prevent DNS rebinding
+            # and SSRF bypasses via unresolvable addresses.
+            logger.warning(f"Could not resolve hostname (blocking securely): {hostname}")
+            return True
diff --git a/tests/test_coverage_polish.py b/tests/test_coverage_polish.py
index c5b7c4de..1f196ba3 100644
--- a/tests/test_coverage_polish.py
+++ b/tests/test_coverage_polish.py
@@ -520,14 +520,14 @@ class TestURLUploadAdditionalCoverage:
         assert exc_info.value.status_code == 400
 
     def test_is_private_ip_unresolvable_hostname(self):
-        """Cover DNS resolution failure branch (lines 67-72)."""
+        """Cover DNS resolution failure branch blocking unresolvable domains."""
         import socket as _socket
 
         from app.utils.network import is_private_ip
 
         with patch("socket.getaddrinfo", side_effect=_socket.gaierror("nope")):
             result = is_private_ip("nonexistent.invalid.hostname.test")
-            assert result is False
+            assert result is True  # Fail securely by returning True
 
     def test_is_private_ip_hostname_resolves_to_private(self):
         """Cover branch where hostname resolves to a private IP (line 64-65)."""
diff --git a/tests/test_url_upload.py b/tests/test_url_upload.py
index 7fead0ae..5dff00ac 100644
--- a/tests/test_url_upload.py
+++ b/tests/test_url_upload.py
@@ -698,6 +698,18 @@ class TestURLUploadCoverageGaps:
         assert result is False
         mock_getaddrinfo.assert_called_once()
 
+    @patch("app.utils.network.socket.getaddrinfo")
+    def test_is_private_ip_unresolvable_hostname_fails_securely(self, mock_getaddrinfo):
+        """Test that unresolvable hostnames fail securely by blocking access."""
+        import socket
+
+        from app.utils.network import is_private_ip
+
+        mock_getaddrinfo.side_effect = socket.gaierror("Name or service not known")
+
+        result = is_private_ip("unresolvable.example.internal")
+        assert result is True  # Fails securely
+
     @patch("socket.getaddrinfo")
     def test_is_private_ip_hostname_resolves_multiple_ips_all_public(self, mock_getaddrinfo):
         """Test hostname with multiple public IPs returns False (covers 65->61 loop branch)"""

From 89dec45062ac03f72299d1a83ef0a6c2f901710a Mon Sep 17 00:00:00 2001
From: semantic-release <semantic-release>
Date: Mon, 23 Mar 2026 14:11:22 +0000
Subject: [PATCH 06/12] 0.172.2

Automatically generated by python-semantic-release
---
 CHANGELOG.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index becc0061..924f3aa7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## v0.172.2 (2026-03-23)
+
+### Bug Fixes
+
+- Adapt TemplateResponse calls to Starlette 1.0 new-style API
+  ([`c4e10be`](https://github.com/christianlouis/DocuElevate/commit/c4e10bee5e096e71a5bc4fac4928f69e5c04f2fb))
+
+- Update test assertions and lint fixes for Starlette 1.0 TemplateResponse API
+  ([`93629ff`](https://github.com/christianlouis/DocuElevate/commit/93629ff44083d43f79fdd49431457023e53d13e4))
+
+- **build**: Remove --omit=dev from npm ci in Dockerfile frontend-builder stage
+  ([`b4e0067`](https://github.com/christianlouis/DocuElevate/commit/b4e0067a27e2fb161349bd38c6d3b3f3bcb86972))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0841713`](https://github.com/christianlouis/DocuElevate/commit/084171395d1076c716aa500a516118db49468ff5))
+
+
 ## Unreleased
 
 

From 96420208879603287552bf030a45247d45954866 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 14:11:26 +0000
Subject: [PATCH 07/12] chore(release): update build metadata files [skip ci]

---
 BUILD_DATE   |  2 +-
 GIT_SHA      |  2 +-
 RUNTIME_INFO | 12 ++++++------
 VERSION      |  2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/BUILD_DATE b/BUILD_DATE
index 9adfb980..7c7cd695 100644
--- a/BUILD_DATE
+++ b/BUILD_DATE
@@ -1 +1 @@
-2026-03-22T18:47:07Z
+2026-03-23T14:11:22Z
diff --git a/GIT_SHA b/GIT_SHA
index 49106340..a66d3a39 100644
--- a/GIT_SHA
+++ b/GIT_SHA
@@ -1 +1 @@
-76c0e91
+34457f9
diff --git a/RUNTIME_INFO b/RUNTIME_INFO
index b562196b..3b67ecaa 100644
--- a/RUNTIME_INFO
+++ b/RUNTIME_INFO
@@ -1,10 +1,10 @@
 DocuElevate Build Information
 ==============================
-Version: 0.172.1
-Build Date: 2026-03-22T18:47:07Z
-Git Commit: 76c0e91500963fac4e8d4a43123340a7cc64731f
-Git Short SHA: 76c0e91
+Version: 0.172.2
+Build Date: 2026-03-23T14:11:22Z
+Git Commit: 34457f977509ce145b7411e83982a96b0fd0e33e
+Git Short SHA: 34457f9
 Git Branch: main
-Commit Date: 2026-03-22T19:46:48+01:00
-Build Timestamp: 2026-03-22T18:47:07Z
+Commit Date: 2026-03-23T15:10:59+01:00
+Build Timestamp: 2026-03-23T14:11:22Z
 ==============================
diff --git a/VERSION b/VERSION
index f6bbd8d3..3c99c40a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.172.1
+0.172.2

From 45d3ac8cf07d39d49930dd6866f76e6015067b08 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 14:12:41 +0000
Subject: [PATCH 08/12] docs(changelog): update changelog [skip ci]

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 924f3aa7..c441ae6e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## Unreleased
+
+
 ## v0.172.2 (2026-03-23)
 
 ### Bug Fixes

From eeae47ddec01339421e503ba484157e798750b8a Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 14:23:12 +0000
Subject: [PATCH 09/12] test: add assertions for task enqueuing parameters

Added `mock_task.delay.assert_called_once_with(str(test_file))` to all integration tests involving background task enqueuing in `app/api/process.py` endpoints to ensure background tasks are called with the correct file path arguments.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

From 0497fbbbad71fd728e528498508bbfc7802dab70 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 14:40:10 +0000
Subject: [PATCH 10/12] docs(changelog): update changelog [skip ci]

---
 CHANGELOG.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c441ae6e..033af865 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
 
 ## v0.172.2 (2026-03-23)
 

From 1018ea17d9a9c60b37ce3afacc9055300050bf99 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 15:53:18 +0000
Subject: [PATCH 11/12] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRIT?=
 =?UTF-8?q?ICAL]=20Fix=20path=20traversal=20vulnerability=20in=20file=20ut?=
 =?UTF-8?q?ilities?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: CRITICAL
💡 Vulnerability: The generic file hashing utility `app/utils/file_operations.py:hash_file` was vulnerable to path traversal. An attacker controlling the `filepath` argument could read arbitrary files on the system by passing relative paths like `../../../etc/passwd` or providing absolute paths directly.
🎯 Impact: This could lead to Arbitrary File Read and potential information disclosure.
🔧 Fix: Used `pathlib.Path.resolve()` to resolve both the target file path and the allowed base directory (`settings.workdir`). Added a strict check to ensure the resolved target path is strictly within the allowed boundary using `filepath_obj.relative_to(workdir_obj)`, catching the `ValueError` raised when the path is out of bounds. This safely blocks both relative traversal attacks and arbitrary absolute paths, without breaking legitimate relative application paths.
✅ Verification: Ran the test suite `pytest tests/test_path_traversal_security.py -v` successfully, which explicitly checks for `FileNotFoundError` upon traversal attempts.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 .jules/sentinel.md           |  8 ++++----
 app/utils/file_operations.py | 13 ++++++++++++-
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 7833fd12..c0b4089f 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,4 +1,4 @@
-## 2024-05-24 - SSRF in WebDAV connection test
-**Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`).
-**Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users.
-**Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private.
+## 2026-03-20 - Safe Path Traversal Prevention in Low-Level Utilities
+**Vulnerability:** The generic file utility `hash_file` in `app/utils/file_operations.py` accepted any file path and was vulnerable to reading arbitrary files via path traversal (e.g., `../../../etc/passwd`) or absolute paths if an attacker could control the `filepath` argument.
+**Learning:** Naively checking for `".." in path` breaks legitimate relative paths used internally by the application. Blocking absolute paths entirely also breaks functionality. Input validation should occur at the API boundary, but for defense-in-depth, low-level utilities must enforce expected boundaries (e.g., the application's `workdir`).
+**Prevention:** Use `pathlib.Path.resolve()` on both the target path and the allowed base directory (`settings.workdir`). Ensure the resolved target path is strictly within the allowed boundary using `filepath_obj.relative_to(workdir_obj)`, catching the `ValueError` that is raised when the path is out of bounds. This safely blocks both relative traversal attacks and arbitrary absolute paths.
diff --git a/app/utils/file_operations.py b/app/utils/file_operations.py
index 485da36d..03e6fd0f 100644
--- a/app/utils/file_operations.py
+++ b/app/utils/file_operations.py
@@ -7,8 +7,19 @@ def hash_file(filepath: str | Path, chunk_size: int = 65536) -> str:
     Returns the SHA-256 hash of the file at 'filepath'.
     Reads the file in chunks to handle large files efficiently.
     """
+    from app.config import settings
+
+    filepath_obj = Path(filepath).resolve()
+    workdir_obj = Path(settings.workdir).resolve()
+
+    # Security check: Ensure the resolved path is strictly within the allowed workdir
+    try:
+        filepath_obj.relative_to(workdir_obj)
+    except ValueError:
+        raise FileNotFoundError(f"Access denied: path traversal attempt or file outside workdir '{filepath}'")
+
     sha256 = hashlib.sha256()
-    with open(filepath, "rb") as f:
+    with open(filepath_obj, "rb") as f:
         while True:
             data = f.read(chunk_size)
             if not data:

From cc5e879ea98507ec5656cce7162a69d385ee00f2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 16:07:58 +0000
Subject: [PATCH 12/12] docs(changelog): update changelog [skip ci]

---
 CHANGELOG.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 033af865..e117f896 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
 ## Unreleased
 
 ### Documentation