Merge pull request #821 from christianlouis/copilot/sub-pr-816

fix(integrations): harden saved-integration test endpoint & resolve merge conflicts

.jules/sentinel.md

@@ -1,8 +1,8 @@
-## 2024-05-24 - SSRF in WebDAV connection test
-**Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`).
-**Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users.
-**Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private.
-## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx
-**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion.
-**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`).
-**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs.
+## 2026-03-20 - Safe Path Traversal Prevention in Low-Level Utilities
+**Vulnerability:** The generic file utility `hash_file` in `app/utils/file_operations.py` accepted any file path and was vulnerable to reading arbitrary files via path traversal (e.g., `../../../etc/passwd`) or absolute paths if an attacker could control the `filepath` argument.
+**Learning:** Naively checking for `".." in path` breaks legitimate relative paths used internally by the application. Blocking absolute paths entirely also breaks functionality. Input validation should occur at the API boundary, but for defense-in-depth, low-level utilities must enforce expected boundaries (e.g., the application's `workdir`).
+**Prevention:** Use `pathlib.Path.resolve()` on both the target path and the allowed base directory (`settings.workdir`). Ensure the resolved target path is strictly within the allowed boundary using `filepath_obj.relative_to(workdir_obj)`, catching the `ValueError` that is raised when the path is out of bounds. This safely blocks both relative traversal attacks and arbitrary absolute paths.
+## 2025-05-18 - [SSRF Bypass via DNS Resolution Failure]
+**Vulnerability:** The `is_private_ip` function in `app/utils/network.py` failed open (returned `False`) when a hostname could not be resolved (`socket.gaierror`).
+**Learning:** This fail-open pattern was originally added to allow external domains in tests, but in production, it created a severe SSRF risk. An attacker could bypass SSRF protections by providing a URL that fails to resolve during the security check but resolves later (DNS rebinding), or by exploiting internal routing behaviors via unresolvable addresses.
+**Prevention:** Always fail securely in network authorization functions. If a domain cannot be resolved to verify its safety, the request must be blocked (`return True` / default-deny). Tests should mock DNS resolution correctly instead of compromising production security logic.

BUILD_DATE

@@ -1 +1 @@
-2026-03-22T18:47:07Z
+2026-03-23T14:11:22Z

CHANGELOG.md

@@ -12,6 +12,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+
+## v0.172.2 (2026-03-23)
+
+### Bug Fixes
+
+- Adapt TemplateResponse calls to Starlette 1.0 new-style API
+  ([`c4e10be`](https://github.com/christianlouis/DocuElevate/commit/c4e10bee5e096e71a5bc4fac4928f69e5c04f2fb))
+
+- Update test assertions and lint fixes for Starlette 1.0 TemplateResponse API
+  ([`93629ff`](https://github.com/christianlouis/DocuElevate/commit/93629ff44083d43f79fdd49431457023e53d13e4))
+
+- **build**: Remove --omit=dev from npm ci in Dockerfile frontend-builder stage
+  ([`b4e0067`](https://github.com/christianlouis/DocuElevate/commit/b4e0067a27e2fb161349bd38c6d3b3f3bcb86972))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0841713`](https://github.com/christianlouis/DocuElevate/commit/084171395d1076c716aa500a516118db49468ff5))
+
+
+## Unreleased
+
 
 ## v0.172.1 (2026-03-22)
 

Dockerfile

@@ -34,7 +34,7 @@ WORKDIR /frontend
 
 # Install dependencies first (layer-cached unless package.json/lockfile changes)
 COPY frontend/package.json frontend/package-lock.json ./
-RUN npm ci --omit=dev
+RUN npm ci
 
 # Copy source files and compile Tailwind CSS
 COPY frontend/ ./

GIT_SHA

@@ -1 +1 @@
-76c0e91
+34457f9

RUNTIME_INFO

@@ -1,10 +1,10 @@
 DocuElevate Build Information
 ==============================
-Version: 0.172.1
-Build Date: 2026-03-22T18:47:07Z
-Git Commit: 76c0e91500963fac4e8d4a43123340a7cc64731f
-Git Short SHA: 76c0e91
+Version: 0.172.2
+Build Date: 2026-03-23T14:11:22Z
+Git Commit: 34457f977509ce145b7411e83982a96b0fd0e33e
+Git Short SHA: 34457f9
 Git Branch: main
-Commit Date: 2026-03-22T19:46:48+01:00
-Build Timestamp: 2026-03-22T18:47:07Z
+Commit Date: 2026-03-23T15:10:59+01:00
+Build Timestamp: 2026-03-23T14:11:22Z
 ==============================

SECURITY_AUDIT.md

@@ -1,6 +1,6 @@
 # Security Audit Report
 
-**Date:** 2026-02-12
+**Date:** 2026-03-23
 **Status:** Bandit Security Scan Completed - All Critical/High/Medium Issues Resolved
 
 ## Executive Summary
@@ -9,6 +9,15 @@ This document tracks security vulnerabilities found in DocuElevate and their rem
 
 ## Recent Security Fixes
 
+### Insecure API Endpoint Exposing Integration Credentials ✅ FIXED (2026-03-23)
+**Severity:** HIGH
+
+**Issue:** The endpoint `GET /api/integrations/{integration_id}/credentials` exposed integration credentials (e.g. passwords, API keys) in plaintext over the API. Although requiring login, this allowed anyone with an active user session to extract the raw credentials. The frontend used this endpoint for testing integration connections.
+
+**Remediation:**
+- Removed the `/credentials` endpoint entirely.
+- Added a new `POST /api/integrations/{integration_id}/test` endpoint that securely runs connection tests server-side without returning the decrypted credentials to the client.
+
 ### CVE-2023-36464: PyPDF2/pypdf Infinite Loop Vulnerability ✅ FIXED (2026-02-12)
 
 **Severity:** Moderate (CVSS: 5.5)

VERSION

@@ -1 +1 @@
-0.172.1
+0.172.2

app/api/billing.py

@@ -260,7 +260,7 @@ async def stripe_webhook(request: Request, db: Session = Depends(get_db)) -> dic
 @require_login
 async def billing_success(request: Request) -> Any:
     """Show a success page after a completed Stripe Checkout."""
-    return _templates.TemplateResponse("billing_success.html", {"request": request})
+    return _templates.TemplateResponse(request, "billing_success.html")
 
 
 # ---------------------------------------------------------------------------

app/api/integrations.py

@@ -470,31 +470,6 @@ def delete_integration(
     logger.info("User %s deleted integration %d", owner_id, integration_id)
 
 
-@router.get("/{integration_id}/credentials", summary="Retrieve decrypted credentials for an integration")
-def get_integration_credentials(
-    integration_id: int,
-    request: Request,
-    db: DbSession,
-    owner_id: CurrentOwner,
-) -> dict[str, Any]:
-    """Return the decrypted credentials dict for a saved integration.
-
-    This endpoint is intended for internal use by background tasks that need
-    to authenticate with a third-party service.  Treat the response as
-    sensitive — it contains plaintext secrets.
-    """
-    integration = (
-        db.query(UserIntegration)
-        .filter(UserIntegration.id == integration_id, UserIntegration.owner_id == owner_id)
-        .first()
-    )
-    if not integration:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Integration not found")
-
-    credentials = _decode_credentials(integration.credentials)
-    return {"credentials": credentials or {}}
-
-
 # ---------------------------------------------------------------------------
 # Connection test helpers
 # ---------------------------------------------------------------------------
@@ -662,6 +637,62 @@ _CONNECTION_TESTERS: dict[str, Any] = {
 # ---------------------------------------------------------------------------
 
 
+@router.post("/{integration_id}/test", summary="Test a saved integration connection")
+def test_saved_integration_connection(
+    integration_id: int,
+    request: Request,
+    db: DbSession,
+    owner_id: CurrentOwner,
+) -> dict[str, Any]:
+    """Test connection for an already-saved integration."""
+    integration = (
+        db.query(UserIntegration)
+        .filter(UserIntegration.id == integration_id, UserIntegration.owner_id == owner_id)
+        .first()
+    )
+    if not integration:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Integration not found")
+
+    tester = _CONNECTION_TESTERS.get(integration.integration_type)
+    if tester is None:
+        return {
+            "success": False,
+            "message": f"Connection testing is not yet supported for '{integration.integration_type}'. "
+            "The integration can still be saved and will be validated on first use.",
+        }
+
+    try:
+        config = json.loads(integration.config) if integration.config else {}
+    except (json.JSONDecodeError, TypeError):
+        logger.warning(
+            "Invalid JSON in integration.config for integration_id=%s, type=%s",
+            integration.id,
+            integration.integration_type,
+        )
+        return {
+            "success": False,
+            "message": (
+                "Saved integration configuration is invalid and cannot be tested. "
+                "Please edit and re-save the integration, then try again."
+            ),
+        }
+
+    credentials = _decode_credentials(integration.credentials) or {}
+
+    try:
+        return tester(config, credentials)
+    except Exception:
+        logger.exception(
+            "Unexpected error testing integration_id=%s, type=%s",
+            integration.id,
+            integration.integration_type,
+        )
+        return {
+            "success": False,
+            "message": "An unexpected error occurred while testing the connection. Please check your configuration.",
+        }
+
+
 @router.post("/test", summary="Test an integration connection without saving")
 def test_integration_connection(
     request: Request,

app/api/local_auth.py

@@ -101,9 +101,9 @@ async def signup_page(request: Request) -> Any:
     if not settings.allow_local_signup:
         return RedirectResponse(url="/login?error=Registration+is+not+enabled", status_code=302)
     return templates.TemplateResponse(
+        request,
         "signup.html",
-        {
-            "request": request,
+        context={
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -113,16 +113,16 @@ async def signup_page(request: Request) -> Any:
 @router.get("/verify-email-sent", include_in_schema=False)
 async def verify_email_sent_page(request: Request) -> Any:
     """Render the verify-email-sent confirmation page."""
-    return templates.TemplateResponse("verify_email_sent.html", {"request": request})
+    return templates.TemplateResponse(request, "verify_email_sent.html")
 
 
 @router.get("/forgot-username", include_in_schema=False)
 async def forgot_username_page(request: Request) -> Any:
     """Render the forgot-username page where users can request a username reminder email."""
     return templates.TemplateResponse(
+        request,
         "forgot_username.html",
-        {
-            "request": request,
+        context={
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -133,9 +133,9 @@ async def forgot_username_page(request: Request) -> Any:
 async def forgot_password_page(request: Request) -> Any:
     """Render the forgot-password page where users can request a reset email."""
     return templates.TemplateResponse(
+        request,
         "forgot_password.html",
-        {
-            "request": request,
+        context={
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -147,9 +147,9 @@ async def reset_password_page(request: Request) -> Any:
     """Render the password reset form page."""
     token = request.query_params.get("token", "")
     return templates.TemplateResponse(
+        request,
         "password_reset_form.html",
-        {
-            "request": request,
+        context={
             "token": token,
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,

app/auth.py

@@ -536,9 +536,9 @@ async def login(request: Request):
         return RedirectResponse(url="/oauth-login", status_code=status.HTTP_302_FOUND)
 
     return templates.TemplateResponse(
+        request,
         "login.html",
-        {
-            "request": request,
+        context={
             "error": error,
             "message": message,
             "show_oauth": show_oauth,

app/main.py

@@ -424,15 +424,13 @@ async def http_exception_handler(request: Request, exc: HTTPException):
     # For frontend routes, return appropriate HTML templates
     # Handle 404 errors with a custom template
     if exc.status_code == 404:
-        return _error_templates.TemplateResponse(
-            "404.html", {"request": request}, status_code=status.HTTP_404_NOT_FOUND
-        )
+        return _error_templates.TemplateResponse(request, "404.html", status_code=status.HTTP_404_NOT_FOUND)
 
     # For other HTTP errors, we could create specific templates or use a generic one
     # For now, return a simple error page
     return _error_templates.TemplateResponse(
+        request,
         "404.html",  # Reuse 404 template for other errors, or create a generic error template
-        {"request": request},
         status_code=exc.status_code,
     )
 
@@ -452,8 +450,9 @@ async def custom_500_handler(request: Request, exc: Exception):
 
     # Serve the 500 template for non-API routes
     return _error_templates.TemplateResponse(
+        request,
         "500.html",
-        {"request": request, "exc": exc},
+        context={"exc": exc},
         status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
     )
 

app/utils/file_operations.py

@@ -7,8 +7,19 @@ def hash_file(filepath: str | Path, chunk_size: int = 65536) -> str:
     Returns the SHA-256 hash of the file at 'filepath'.
     Reads the file in chunks to handle large files efficiently.
     """
+    from app.config import settings
+
+    filepath_obj = Path(filepath).resolve()
+    workdir_obj = Path(settings.workdir).resolve()
+
+    # Security check: Ensure the resolved path is strictly within the allowed workdir
+    try:
+        filepath_obj.relative_to(workdir_obj)
+    except ValueError:
+        raise FileNotFoundError(f"Access denied: path traversal attempt or file outside workdir '{filepath}'")
+
     sha256 = hashlib.sha256()
-    with open(filepath, "rb") as f:
+    with open(filepath_obj, "rb") as f:
         while True:
             data = f.read(chunk_size)
             if not data:

app/utils/network.py

@@ -27,8 +27,8 @@ def is_private_ip(hostname: str) -> bool:
                     return True
             return False
         except (socket.gaierror, socket.error):
-            # Cannot resolve - allow for testing/development
-            # In production, DNS should work properly
-            # Log this for debugging
-            logger.warning(f"Could not resolve hostname: {hostname}")
-            return False  # Changed from True to False to allow external domains in tests
+            # Cannot resolve.
+            # Fail securely: block unresolved domains to prevent DNS rebinding
+            # and SSRF bypasses via unresolvable addresses.
+            logger.warning(f"Could not resolve hostname (blocking securely): {hostname}")
+            return True

app/views/base.py

@@ -162,12 +162,36 @@ def _inject_global_context(ctx: dict) -> None:
 
 
 def template_response_with_version(*args, **kwargs):
-    """Wrapper for TemplateResponse to include version and CSRF token in all templates"""
-    # If context dict is provided, add version to it
-    if len(args) >= 2 and isinstance(args[1], dict):
-        _inject_global_context(args[1])
-    elif "context" in kwargs and isinstance(kwargs["context"], dict):
+    """Wrapper for TemplateResponse to include version and CSRF token in all templates.
+
+    Handles both old-style and new-style Starlette TemplateResponse calls:
+      - Old-style (Starlette <1.0): TemplateResponse(name, {"request": req, ...}, ...)
+      - New-style (Starlette 1.0+): TemplateResponse(request, name, context={...}, ...)
+    """
+    if len(args) >= 1 and isinstance(args[0], str):
+        # Old-style call: first positional arg is the template name (string).
+        # Convert to new-style: (request, name, context=..., ...)
+        name = args[0]
+        if len(args) >= 2 and isinstance(args[1], dict):
+            context = args[1]
+            # Old-style may have status_code as 3rd positional arg
+            if len(args) >= 3 and "status_code" not in kwargs:
+                kwargs["status_code"] = args[2]
+        else:
+            context = kwargs.pop("context", {})
+        request_obj = context.pop("request", None)
+        if request_obj is not None:
+            context["request"] = request_obj
+        _inject_global_context(context)
+        if request_obj is not None:
+            return original_template_response(request_obj, name, context=context, **kwargs)
+        return original_template_response(name, context=context, **kwargs)
+
+    # New-style call: (request, name, context=..., ...)
+    if "context" in kwargs and isinstance(kwargs["context"], dict):
         _inject_global_context(kwargs["context"])
+    elif len(args) >= 3 and isinstance(args[2], dict):
+        _inject_global_context(args[2])
     return original_template_response(*args, **kwargs)
 
 

app/views/share.py

@@ -23,6 +23,7 @@ templates = Jinja2Templates(directory=str(_templates_dir))
 async def shared_link_view(request: Request, token: str):
     """Render the public share landing page for a given token."""
     return templates.TemplateResponse(
+        request,
         "shared_link_view.html",
-        {"request": request, "token": token},
+        context={"token": token},
     )

frontend/templates/integrations_dashboard.html

@@ -1379,27 +1379,15 @@ function integrationsDashboard() {
     async testSavedIntegration(intg) {
       this.testingId = intg.id;
       try {
-        // Retrieve saved credentials to test
-        const credsResp = await fetch(`/api/integrations/${intg.id}/credentials`);
-        if (!credsResp.ok) {
-          this.showAlert('error', 'Test Failed', 'Could not retrieve saved credentials for testing.');
-          return;
-        }
-        const creds = await credsResp.json();
-        const resp = await fetch('/api/integrations/test', {
+        const resp = await fetch(`/api/integrations/${intg.id}/test`, {
           method: 'POST',
           headers: authHeaders(true),
-          body: JSON.stringify({
-            integration_type: intg.integration_type,
-            config: intg.config,
-            credentials: creds.credentials,
-          }),
         });
         const data = await resp.json();
-        if (data.success) {
+        if (resp.ok && data.success) {
           this.showAlert('success', `${intg.name}: Connection OK`, data.message);
         } else {
-          this.showAlert('error', `${intg.name}: Connection Failed`, data.message);
+          this.showAlert('error', `${intg.name}: Connection Failed`, data.message || {{ _("integrations.connection_test_failed_fallback")|tojson }});
         }
       } catch (err) {
         this.showAlert('error', 'Test Failed', `Network error: ${err.message || 'Unknown error'}`);

frontend/translations/en.json

@@ -1107,6 +1107,7 @@
   "integrations.connected": "Connected",
   "integrations.connection_failed": "Connection failed",
   "integrations.connection_success": "Connection successful",
+  "integrations.connection_test_failed_fallback": "Connection test failed.",
   "integrations.delete_confirm_are_you_sure": "Are you sure you want to delete",
   "integrations.delete_confirm_title": "Delete Integration?",
   "integrations.delete_confirm_undone": "This action cannot be undone.",

tests/test_api_integrations.py

@@ -1,6 +1,7 @@
 """Tests for the per-user integrations API (app/api/integrations.py)."""
 
 import unittest.mock
+from unittest.mock import MagicMock, patch
 
 import pytest
 from fastapi.testclient import TestClient
@@ -405,32 +406,33 @@ class TestDeleteIntegration:
 
 
 @pytest.mark.integration
-class TestGetIntegrationCredentials:
-    """Tests for GET /api/integrations/{id}/credentials."""
+class TestTestSavedIntegrationConnection:
+    """Tests for POST /api/integrations/{id}/test."""
+
+    @patch("app.api.integrations._CONNECTION_TESTERS")
+    def test_test_saved_integration_success(self, mock_testers, int_client):
+        """Test a saved integration successfully."""
+        mock_tester = MagicMock(return_value={"success": True, "message": "OK"})
+        mock_testers.get.return_value = mock_tester
 
-    def test_returns_decrypted_credentials(self, int_client):
-        """Credentials endpoint returns the decrypted dict."""
         created = int_client.post("/api/integrations/", json=_IMAP_SOURCE).json()
-        resp = int_client.get(f"/api/integrations/{created['id']}/credentials")
-        assert resp.status_code == 200
-        creds = resp.json()["credentials"]
-        assert creds["password"] == "s3cr3t"  # noqa: S105
+        resp = int_client.post(f"/api/integrations/{created['id']}/test")
 
-    def test_returns_empty_dict_when_no_credentials(self, int_client):
-        """No credentials stored returns empty dict."""
-        payload = dict(_IMAP_SOURCE, credentials=None)
-        created = int_client.post("/api/integrations/", json=payload).json()
-        resp = int_client.get(f"/api/integrations/{created['id']}/credentials")
         assert resp.status_code == 200
-        assert resp.json()["credentials"] == {}
+        assert resp.json()["success"] is True
+        mock_testers.get.assert_called_with("IMAP")
+        mock_tester.assert_called_once()
+        args = mock_tester.call_args[0]
+        assert args[0]["host"] == "imap.gmail.com"
+        assert args[1]["password"] == "s3cr3t"
 
     def test_not_found(self, int_client):
         """Non-existent integration returns 404."""
-        resp = int_client.get("/api/integrations/9999/credentials")
+        resp = int_client.post("/api/integrations/9999/test")
         assert resp.status_code == 404
 
-    def test_other_users_credentials_returns_404(self, int_client, int_session):
-        """Cannot retrieve another user's credentials."""
+    def test_other_users_integration_returns_404(self, int_client, int_session):
+        """Cannot test another user's integration."""
         other_integration = UserIntegration(
             owner_id=_OTHER_OWNER,
             direction="SOURCE",
@@ -441,9 +443,47 @@ class TestGetIntegrationCredentials:
         )
         int_session.add(other_integration)
         int_session.commit()
-        resp = int_client.get(f"/api/integrations/{other_integration.id}/credentials")
+        resp = int_client.post(f"/api/integrations/{other_integration.id}/test")
         assert resp.status_code == 404
 
+    @patch("app.api.integrations._CONNECTION_TESTERS")
+    def test_invalid_json_config_returns_failure(self, mock_testers, int_client, int_session):
+        """Invalid JSON in config returns a controlled failure response."""
+        mock_tester = MagicMock()
+        mock_testers.get.return_value = mock_tester
+
+        bad_integration = UserIntegration(
+            owner_id=_OWNER,
+            direction="SOURCE",
+            integration_type="IMAP",
+            name="Bad Config",
+            config="not-valid-json{{{",
+            credentials="{}",
+            is_active=True,
+        )
+        int_session.add(bad_integration)
+        int_session.commit()
+
+        resp = int_client.post(f"/api/integrations/{bad_integration.id}/test")
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "invalid" in data["message"].lower()
+        mock_tester.assert_not_called()
+
+    @patch("app.api.integrations._CONNECTION_TESTERS")
+    def test_tester_raises_exception_returns_failure(self, mock_testers, int_client):
+        """Tester that raises an exception returns a controlled failure response."""
+        mock_testers.get.return_value = MagicMock(side_effect=ValueError("bad port"))
+
+        created = int_client.post("/api/integrations/", json=_IMAP_SOURCE).json()
+        resp = int_client.post(f"/api/integrations/{created['id']}/test")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "unexpected error" in data["message"].lower()
+
 
 @pytest.mark.unit
 class TestIntegrationModel:

tests/test_auth.py

@@ -430,8 +430,8 @@ class TestLoginFunction:
             # Verify TemplateResponse was called with correct context
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            assert call_args[0][0] == "login.html"
-            context = call_args[0][1]
+            assert call_args[0][1] == "login.html"
+            context = call_args.kwargs["context"]
             assert context["error"] == "Test error"
             assert context["message"] == "Test message"
 
@@ -450,7 +450,7 @@ class TestLoginFunction:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args[0][1]
+            context = call_args.kwargs["context"]
             assert context["error"] is None
             assert context["message"] is None
 

tests/test_auth_module.py

@@ -281,7 +281,7 @@ class TestLoginEndpoint:
                             # Verify template was rendered with OAuth enabled
                             mock_templates.TemplateResponse.assert_called_once()
                             call_args = mock_templates.TemplateResponse.call_args
-                            context = call_args[0][1]
+                            context = call_args.kwargs["context"]
                             assert context["show_oauth"] is True
                             assert context["oauth_provider_name"] == "Test SSO"
 

tests/test_coverage_polish.py

@@ -520,14 +520,14 @@ class TestURLUploadAdditionalCoverage:
         assert exc_info.value.status_code == 400
 
     def test_is_private_ip_unresolvable_hostname(self):
-        """Cover DNS resolution failure branch (lines 67-72)."""
+        """Cover DNS resolution failure branch blocking unresolvable domains."""
         import socket as _socket
 
         from app.utils.network import is_private_ip
 
         with patch("socket.getaddrinfo", side_effect=_socket.gaierror("nope")):
             result = is_private_ip("nonexistent.invalid.hostname.test")
-            assert result is False
+            assert result is True  # Fail securely by returning True
 
     def test_is_private_ip_hostname_resolves_to_private(self):
         """Cover branch where hostname resolves to a private IP (line 64-65)."""

tests/test_coverage_remaining_gaps.py

@@ -69,8 +69,9 @@ class TestViewsBase:
             context = {"request": req}
             template_response_with_version("template.html", context)
 
-        args, _ = mock_orig.call_args
-        assert args[1].get("csrf_token") == "my-csrf"
+        args, kwargs = mock_orig.call_args
+        context = kwargs.get("context", {})
+        assert context.get("csrf_token") == "my-csrf"
 
     def test_kwargs_context_no_request(self):
         """Test kwargs context path when request is not in context."""

tests/test_dark_mode.py

@@ -55,8 +55,8 @@ class TestDarkModeTemplateInjection:
 
         captured = {}
 
-        def fake_original(name, ctx, **kw):
-            captured.update(ctx)
+        def fake_original(request_obj, name, context=None, **kw):
+            captured.update(context or {})
 
         with patch("app.views.base.original_template_response", side_effect=fake_original):
             mock_request = MagicMock()
@@ -73,8 +73,8 @@ class TestDarkModeTemplateInjection:
 
         captured = {}
 
-        def fake_original(name, ctx, **kw):
-            captured.update(ctx)
+        def fake_original(request_obj, name, context=None, **kw):
+            captured.update(context or {})
 
         with patch("app.views.base.original_template_response", side_effect=fake_original):
             mock_request = MagicMock()

tests/test_frontend_build.py

@@ -0,0 +1,145 @@
+"""Tests for frontend build configuration and Docker build consistency.
+
+Validates that the frontend build toolchain (Tailwind CSS) is correctly
+configured in package.json and that the Dockerfile installs all required
+dependencies for the build step.
+"""
+
+import json
+import re
+from pathlib import Path
+
+import pytest
+
+# Resolve the project root from the test file location
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+FRONTEND_DIR = PROJECT_ROOT / "frontend"
+DOCKERFILE_PATH = PROJECT_ROOT / "Dockerfile"
+
+
+@pytest.mark.unit
+class TestFrontendPackageJson:
+    """Validate frontend/package.json structure and scripts."""
+
+    def test_package_json_exists(self) -> None:
+        """package.json must exist in the frontend directory."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        assert pkg_path.exists(), "frontend/package.json not found"
+
+    def test_package_json_is_valid_json(self) -> None:
+        """package.json must be parseable JSON."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        assert isinstance(data, dict), "package.json must be a JSON object"
+
+    def test_build_script_defined(self) -> None:
+        """A 'build' script must be defined in package.json."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        scripts = data.get("scripts", {})
+        assert "build" in scripts, "Missing 'build' script in package.json"
+
+    def test_build_script_uses_tailwindcss(self) -> None:
+        """The build script must invoke the tailwindcss CLI."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        build_cmd = data["scripts"]["build"]
+        assert "tailwindcss" in build_cmd, f"Build script does not reference tailwindcss: {build_cmd}"
+
+    def test_tailwindcss_listed_as_dependency(self) -> None:
+        """tailwindcss must be listed in dependencies or devDependencies."""
+        pkg_path = FRONTEND_DIR / "package.json"
+        data = json.loads(pkg_path.read_text(encoding="utf-8"))
+        deps = data.get("dependencies", {})
+        dev_deps = data.get("devDependencies", {})
+        all_deps = {**deps, **dev_deps}
+        assert "tailwindcss" in all_deps, "tailwindcss is not listed in dependencies or devDependencies"
+
+
+@pytest.mark.unit
+class TestFrontendBuildAssets:
+    """Validate that required frontend build source files exist."""
+
+    def test_input_css_exists(self) -> None:
+        """The Tailwind CSS input file must exist."""
+        input_css = FRONTEND_DIR / "input.css"
+        assert input_css.exists(), "frontend/input.css not found"
+
+    def test_input_css_has_tailwind_directives(self) -> None:
+        """input.css must include Tailwind CSS directives."""
+        input_css = FRONTEND_DIR / "input.css"
+        content = input_css.read_text(encoding="utf-8")
+        assert "@tailwind base" in content, "Missing @tailwind base directive"
+        assert "@tailwind components" in content, "Missing @tailwind components directive"
+        assert "@tailwind utilities" in content, "Missing @tailwind utilities directive"
+
+    def test_tailwind_config_exists(self) -> None:
+        """tailwind.config.js must exist in the frontend directory."""
+        config_path = FRONTEND_DIR / "tailwind.config.js"
+        assert config_path.exists(), "frontend/tailwind.config.js not found"
+
+    def test_package_lock_exists(self) -> None:
+        """package-lock.json must exist for reproducible installs."""
+        lock_path = FRONTEND_DIR / "package-lock.json"
+        assert lock_path.exists(), "frontend/package-lock.json not found"
+
+
+@pytest.mark.unit
+class TestDockerfileFrontendBuilder:
+    """Validate the Dockerfile frontend-builder stage installs build dependencies."""
+
+    def test_dockerfile_exists(self) -> None:
+        """Production Dockerfile must exist at the project root."""
+        assert DOCKERFILE_PATH.exists(), "Dockerfile not found at project root"
+
+    def test_dockerfile_has_frontend_builder_stage(self) -> None:
+        """Dockerfile must define a frontend-builder stage."""
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+        assert "AS frontend-builder" in content, "Dockerfile does not define a frontend-builder stage"
+
+    def test_dockerfile_npm_ci_does_not_omit_dev(self) -> None:
+        """npm ci must NOT use --omit=dev in the frontend-builder stage.
+
+        The tailwindcss CLI is a devDependency required at build time.
+        Using --omit=dev would skip installing it, causing the build to
+        fail with 'tailwindcss: not found'.
+        """
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+
+        # Extract the frontend-builder stage content
+        # Look for the stage start and the next stage (or end of file)
+        stage_pattern = re.compile(
+            r"FROM\s+\S+\s+AS\s+frontend-builder\b(.*?)(?=FROM\s|\Z)",
+            re.DOTALL,
+        )
+        match = stage_pattern.search(content)
+        assert match is not None, "Could not find frontend-builder stage in Dockerfile"
+
+        stage_content = match.group(1)
+        assert "--omit=dev" not in stage_content, (
+            "Dockerfile frontend-builder stage uses 'npm ci --omit=dev' which "
+            "excludes tailwindcss (a devDependency) needed for the build step. "
+            "Use 'npm ci' instead to install all dependencies."
+        )
+
+    def test_dockerfile_runs_npm_build(self) -> None:
+        """Dockerfile frontend-builder stage must run npm run build."""
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+
+        stage_pattern = re.compile(
+            r"FROM\s+\S+\s+AS\s+frontend-builder\b(.*?)(?=FROM\s|\Z)",
+            re.DOTALL,
+        )
+        match = stage_pattern.search(content)
+        assert match is not None, "Could not find frontend-builder stage in Dockerfile"
+
+        stage_content = match.group(1)
+        assert "npm run build" in stage_content, "Dockerfile frontend-builder stage does not run 'npm run build'"
+
+    def test_dockerfile_copies_compiled_css(self) -> None:
+        """Dockerfile must copy the compiled styles.css from the frontend-builder stage."""
+        content = DOCKERFILE_PATH.read_text(encoding="utf-8")
+        assert "COPY --from=frontend-builder" in content, (
+            "Dockerfile does not copy assets from the frontend-builder stage"
+        )
+        assert "styles.css" in content, "Dockerfile does not reference the compiled styles.css"

tests/test_social_login.py

@@ -345,7 +345,7 @@ class TestLoginPageSocialProviders:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args[0][1]
+            context = call_args.kwargs.get("context", {})
             assert context["social_providers"] == mock_providers
 
     @pytest.mark.asyncio
@@ -371,7 +371,7 @@ class TestLoginPageSocialProviders:
 
             mock_templates.TemplateResponse.assert_called_once()
             call_args = mock_templates.TemplateResponse.call_args
-            context = call_args[0][1]
+            context = call_args.kwargs.get("context", {})
             assert context["social_providers"] == {}
 
 

tests/test_url_upload.py

@@ -698,6 +698,18 @@ class TestURLUploadCoverageGaps:
         assert result is False
         mock_getaddrinfo.assert_called_once()
 
+    @patch("app.utils.network.socket.getaddrinfo")
+    def test_is_private_ip_unresolvable_hostname_fails_securely(self, mock_getaddrinfo):
+        """Test that unresolvable hostnames fail securely by blocking access."""
+        import socket
+
+        from app.utils.network import is_private_ip
+
+        mock_getaddrinfo.side_effect = socket.gaierror("Name or service not known")
+
+        result = is_private_ip("unresolvable.example.internal")
+        assert result is True  # Fails securely
+
     @patch("socket.getaddrinfo")
     def test_is_private_ip_hostname_resolves_multiple_ips_all_public(self, mock_getaddrinfo):
         """Test hostname with multiple public IPs returns False (covers 65->61 loop branch)"""