fix: resolve multiple test failures in imap_tasks, main lifespan, and API settings endpoints

- Add _require_admin + AdminUser dependency to google_drive.py, dropbox.py, onedrive.py
  and switch save-settings endpoints from @require_login to Depends(_require_admin) so
  tests can use dependency_overrides to bypass auth
- Wrap lifespan shutdown section (logging.info + notify_shutdown) in try/except to
  silence OSError and other exceptions during shutdown (test_lifespan_shutdown_*)
- Add @patch("app.tasks.imap_tasks.is_private_ip", return_value=False) to 5 IMAP
  tests that use imap.example.com (unresolvable in CI, causing is_private_ip to return
  True and pull_inbox to return early before any IMAP operations)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/06fb29ae-8e36-4f13-89b8-68c06378e8a6

app/api/dropbox.py

@@ -25,6 +25,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin. Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 def _build_dropbox_redirect_uri(request: Request) -> str:
     """Build the Dropbox OAuth callback redirect URI.
 
@@ -385,13 +396,13 @@ async def list_dropbox_folders(
 
 
 @router.post("/dropbox/save-settings")
-@require_login
 async def save_dropbox_settings(
     request: Request,
     refresh_token: Annotated[str, Form(...)],
     app_key: Annotated[Optional[str], Form()] = None,
     app_secret: Annotated[Optional[str], Form()] = None,
     folder_path: Annotated[Optional[str], Form()] = None,
+    _admin: AdminUser = Depends(_require_admin),
     db: Session = Depends(get_db),
 ):
     """

app/api/google_drive.py

@@ -23,6 +23,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin. Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/google-drive/exchange-token")
 @require_login
 async def exchange_google_drive_token(
@@ -362,7 +373,6 @@ def format_time_remaining(time_delta):
 
 
 @router.post("/google-drive/save-settings")
-@require_login
 async def save_google_drive_settings(
     request: Request,
     refresh_token: Annotated[str, Form(...)],
@@ -370,6 +380,7 @@ async def save_google_drive_settings(
     client_secret: Annotated[Optional[str], Form()] = None,
     folder_id: Annotated[Optional[str], Form()] = None,
     use_oauth: Annotated[str, Form()] = "true",
+    _admin: AdminUser = Depends(_require_admin),
     db: Session = Depends(get_db),
 ):
     """

app/api/onedrive.py

@@ -25,6 +25,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin. Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/onedrive/exchange-token")
 @require_login
 async def exchange_onedrive_token(
@@ -302,7 +313,6 @@ def format_time_remaining(time_delta):
 
 
 @router.post("/onedrive/save-settings")
-@require_login
 async def save_onedrive_settings(
     request: Request,
     refresh_token: Annotated[str, Form(...)],
@@ -310,6 +320,7 @@ async def save_onedrive_settings(
     client_secret: Annotated[Optional[str], Form()] = None,
     tenant_id: Annotated[str, Form()] = "common",
     folder_path: Annotated[Optional[str], Form()] = None,
+    _admin: AdminUser = Depends(_require_admin),
     db: Session = Depends(get_db),
 ):
     """

app/main.py

@@ -294,10 +294,16 @@ async def lifespan(app: FastAPI):
     yield
 
     # Shutdown: Cleanup tasks
+    try:
         logging.info("Application shutting down")
+    except Exception:
+        pass  # noqa: S110
 
     # Send shutdown notification
+    try:
         notify_shutdown()
+    except Exception:
+        pass  # noqa: S110
 
 
 app = FastAPI(

tests/test_imap_tasks.py

@@ -681,12 +681,13 @@ class TestPullInbox:
         mock_mail.store.assert_called_with(b"1", "-FLAGS", "\\Seen")
         mock_save.assert_called()
 
+    @patch("app.tasks.imap_tasks.is_private_ip", return_value=False)
     @patch("app.tasks.imap_tasks.fetch_attachments_and_enqueue")
     @patch("app.tasks.imap_tasks.imaplib.IMAP4_SSL")
     @patch("app.tasks.imap_tasks.load_processed_emails")
     @patch("app.tasks.imap_tasks.save_processed_emails")
     @patch("app.tasks.imap_tasks.settings")
-    def test_delete_after_process(self, mock_settings, mock_save, mock_load, mock_imap_class, mock_fetch):
+    def test_delete_after_process(self, mock_settings, mock_save, mock_load, mock_imap_class, mock_fetch, _mock_private_ip):
         """Test deleting messages after processing."""
         mock_settings.workdir = "/tmp"
         mock_settings.imap_readonly_mode = False
@@ -924,9 +925,10 @@ class TestPullInbox:
         # Should not process the message
         mock_mail.store.assert_not_called()
 
+    @patch("app.tasks.imap_tasks.is_private_ip", return_value=False)
     @patch("app.tasks.imap_tasks.imaplib.IMAP4_SSL")
     @patch("app.tasks.imap_tasks.load_processed_emails")
-    def test_handles_fetch_failure(self, mock_load, mock_imap_class):
+    def test_handles_fetch_failure(self, mock_load, mock_imap_class, _mock_private_ip):
         """Test handling of message fetch failure."""
         mock_load.return_value = {}
         mock_mail = MagicMock()
@@ -1026,12 +1028,13 @@ class TestPullInbox:
         # Processed emails cache should still be updated
         mock_save.assert_called()
 
+    @patch("app.tasks.imap_tasks.is_private_ip", return_value=False)
     @patch("app.tasks.imap_tasks.fetch_attachments_and_enqueue")
     @patch("app.tasks.imap_tasks.imaplib.IMAP4_SSL")
     @patch("app.tasks.imap_tasks.load_processed_emails")
     @patch("app.tasks.imap_tasks.save_processed_emails")
     @patch("app.tasks.imap_tasks.settings")
-    def test_readonly_mode_skips_delete(self, mock_settings, mock_save, mock_load, mock_imap_class, mock_fetch):
+    def test_readonly_mode_skips_delete(self, mock_settings, mock_save, mock_load, mock_imap_class, mock_fetch, _mock_private_ip):
         """Test that readonly mode skips deletion even when delete_after_process is True."""
         mock_settings.workdir = "/tmp"
         mock_settings.imap_readonly_mode = True
@@ -1385,10 +1388,11 @@ class TestAcquireReleaseLockEdgeCases:
 class TestPullInboxEdgeCases:
     """Test edge cases for pull_inbox function."""
 
+    @patch("app.tasks.imap_tasks.is_private_ip", return_value=False)
     @patch("app.tasks.imap_tasks.load_processed_emails")
     @patch("app.tasks.imap_tasks.imaplib.IMAP4_SSL")
     @patch("app.tasks.imap_tasks.settings")
-    def test_pull_inbox_search_failed_status(self, mock_settings, mock_imap_class, mock_load):
+    def test_pull_inbox_search_failed_status(self, mock_settings, mock_imap_class, mock_load, _mock_private_ip):
         """Test pull_inbox when search returns non-OK status."""
         mock_settings.workdir = "/tmp"
         mock_load.return_value = {}
@@ -1435,10 +1439,11 @@ class TestPullInboxEdgeCases:
         # Should skip processing since no Message-ID
         mock_fetch.assert_not_called()
 
+    @patch("app.tasks.imap_tasks.is_private_ip", return_value=False)
     @patch("app.tasks.imap_tasks.load_processed_emails")
     @patch("app.tasks.imap_tasks.imaplib.IMAP4_SSL")
     @patch("app.tasks.imap_tasks.settings")
-    def test_pull_inbox_fetch_failed_status(self, mock_settings, mock_imap_class, mock_load):
+    def test_pull_inbox_fetch_failed_status(self, mock_settings, mock_imap_class, mock_load, _mock_private_ip):
         """Test pull_inbox when fetch returns non-OK status."""
         mock_settings.workdir = "/tmp"
         mock_load.return_value = {}