chore: initialize project repository

tests/unit/api/test_agent_run_security.py

@@ -0,0 +1,35 @@
+from unittest.mock import AsyncMock, Mock
+
+from fastapi.testclient import TestClient
+
+from app.api.controllers.agent_runs import get_session
+from app.api.dependencies.auth import build_request_context
+from app.core.contracts import RequestContext
+from app.main import create_app
+
+
+def test_unknown_agent_returns_contract_404_without_database_write():
+    app = create_app()
+    session = AsyncMock()
+    session.add = Mock()
+
+    async def context():
+        return RequestContext(user_id="1", trace_id="test-trace", roles=("customer",),
+                              permissions=("agent:run",))
+
+    async def database():
+        yield session
+
+    app.dependency_overrides[build_request_context] = context
+    app.dependency_overrides[get_session] = database
+    with TestClient(app) as client:
+        response = client.post("/api/v1/agent-runs", json={
+            "agent_type": "no_such_agent", "message": "test", "session_id": "test",
+            "idempotency_key": "1234567890123456",
+        })
+    assert response.status_code == 404
+    assert response.json()["error"]["code"] == "AGENT_TYPE_NOT_FOUND"
+    assert response.json()["meta"]["trace_id"] == "test-trace"
+    session.add.assert_not_called()
+    session.execute.assert_not_awaited()
+    session.flush.assert_not_awaited()

tests/unit/api/test_agent_run_sse.py

@@ -0,0 +1,88 @@
+from app.api.views.agent_run_sse import encode_events, recovery_events
+
+
+def test_first_connection_emits_unicode_deltas_only_after_commit():
+    content = "基金😀\n结果" * 100
+    events = recovery_events(run_id="r", trace_id="t", status="succeeded", error_code=None,
+                             content=content, tool_calls=None, replay=False, chunk_size=11)
+    assert events[0][0] == "start" and events[-1][0] == "done"
+    assert "".join(payload["content"] for name, payload in events if name == "delta") == content
+    assert all(len(payload["content"]) <= 11 for name, payload in events if name == "delta")
+    ids = [line for event in encode_events("r", events)
+           for line in event.splitlines() if line.startswith("id:")]
+    assert len(set(ids)) == len(ids)
+    pending = recovery_events(run_id="r", trace_id="t", status="running", error_code=None,
+                              content=content, tool_calls=None, replay=False)
+    assert [name for name, _ in pending] == ["start"]
+
+
+def test_empty_result_still_emits_delta():
+    events = recovery_events(run_id="r", trace_id="t", status="succeeded", error_code=None,
+                             content="", tool_calls=None, replay=False)
+    assert [name for name, _ in events] == ["start", "delta", "done"]
+
+
+def test_pending_run_never_emits_result_events() -> None:
+    events = recovery_events(
+        run_id="run",
+        trace_id="trace",
+        status="running",
+        error_code=None,
+        content=None,
+        tool_calls=None,
+    )
+    assert [name for name, _ in events] == ["start"]
+
+
+def test_succeeded_run_emits_tools_and_result_after_terminal_state() -> None:
+    events = recovery_events(
+        run_id="run",
+        trace_id="trace",
+        status="succeeded",
+        error_code=None,
+        content="answer",
+        tool_calls={"calls": []},
+    )
+    assert [name for name, _ in events] == ["start", "tools", "replace", "done"]
+
+
+def test_failed_run_emits_error_without_result() -> None:
+    events = recovery_events(
+        run_id="run",
+        trace_id="trace",
+        status="failed",
+        error_code="MODEL_TIMEOUT",
+        content=None,
+        tool_calls=None,
+    )
+    assert [name for name, _ in events] == ["start", "error"]
+
+
+def test_client_disconnect_does_not_change_recoverable_terminal_events() -> None:
+    events = recovery_events(
+        run_id="run",
+        trace_id="trace",
+        status="succeeded",
+        error_code=None,
+        content="answer",
+        tool_calls=None,
+    )
+    stream = encode_events("run", events)
+    first = next(stream)
+    assert "event: start" in first
+    del stream
+    recovered = list(
+        encode_events(
+            "run",
+            recovery_events(
+                run_id="run",
+                trace_id="trace",
+                status="succeeded",
+                error_code=None,
+                content="answer",
+                tool_calls=None,
+            ),
+        )
+    )
+    assert any("event: replace" in item for item in recovered)
+    assert any("event: done" in item for item in recovered)

tests/unit/api/test_architecture.py

@@ -0,0 +1,16 @@
+import ast
+from pathlib import Path
+
+
+def test_controllers_do_not_access_models_repositories_or_session_operations():
+    for path in Path("app/api/controllers").glob("*.py"):
+        tree = ast.parse(path.read_text(encoding="utf-8"))
+        for node in ast.walk(tree):
+            if isinstance(node, ast.ImportFrom):
+                assert not (node.module or "").startswith(("app.model", "app.repository")), path
+                if node.module == "sqlalchemy":
+                    raise AssertionError(f"Controller imports SQL statements: {path}")
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+                target = node.func.value
+                if isinstance(target, ast.Name) and target.id == "session":
+                    raise AssertionError(f"Controller operates on session: {path}:{node.lineno}")