[amar-python]

Tests for the closed and open issues, plus a matrix of which test guards which issue.

What's here

docs/ISSUE_TESTS.md: one row for each of the 69 issues (46 closed, 23 open): the test that fails if it comes back, or the reason there isn't one (decisions, docs, milestones not built, one machine's setup).

New tests

File	Guards
tests/test_issue_regressions.py	#175 uploader can't overwrite or mode-switch over a dataset · #178 distinct rows kept (incl. all 31 control characters) · #183 rate-limit identity · #189 T&E error row numbers
tests/test_tooling_issues.py	#130 lock file · #169 catalogue fresh · #171 setup.sh keeps the old config · #180 · #181 · #182 bundle stops on a failed download · #194 coverage gate · #207 API doc defers to the served schema. The shell tests cut the real block out of each script and run it
tests/test_oidc_https_jwks.py	#113 (what's testable offline): the https key fetch against a local TLS server, key rotation, no re-fetch inside PyJWT's cooldown, untrusted certificate refused
tests/test_open_issues.py	#57 SECURITY.md · #60 offline scripts parse and stop on error
fe: tenant-isolation.test.tsx	#176
e2e/ (Playwright, production build)	#187, #188, #176, and the #154 Streamlit screen: role gating, edit with a required reason, exclude, history, sign-out leaves nothing for the next tenant

I re-introduced the original bug for #171, #175, #178, #181 (wrapper), #182, #183, #189 and the OIDC certificate check, and each test failed. The rest guard existing code.

One known failure, on purpose (strict, so it turns red when fixed)

• RV-F1 (BR-36): browser localStorage history leaks across tenants — pending #154 frontend decision #176 is live. A second tenant on the same browser sees the first one's file names on the import-history page. Reproduced in Chromium on the production build. Closed as moot because the screen is being replaced (Plan the staged migration from React to Streamlit (follow-up to #154) #212), but it still ships. Matters for the Security review of the threat model before the first external tenant #112 security review. It is a vitest it.fails and a browser test, neither of which the pytest CI step runs (that step fails any skipped or expected-fail test).

#181 is only half fixed

The Tier S psql calls in evals/runner.py have no ON_ERROR_STOP; the fix is on the unmerged fix/181-sql-suite-exit-code branch. I first recorded this as an expected-fail pytest test, but CI's --strict report counts that as a skip and failed, so it is only noted in docs/ISSUE_TESTS.md.

Found by the browser tests

Every dynamic import in the React app showed as Failed since #202, though the server saved it: the app's schema didn't list the new header_mapping log step. Fixed separately in #223, which this branch merges so the suite runs against it; if #223 merges first this diff shrinks.

Not included, on purpose

Open issues #172, #173, #174, #184, #195, #168 and #167 already have tests in open PRs (#213, #208, #204, #214); duplicating them would collide when those merge. The matrix points at them.

Running

• New tooling marker: tests that run the repo's real shell scripts need bash, so the Windows job (which runs every unit test) leaves them out; the Linux jobs and local runs include them.

• pytest tests and npx vitest run: as before. Verified here: pytest passes with PostgreSQL (the multi-database environment and parity tests need the other three databases and were not run), vitest 169 passed + 1 expected fail.

• pytest e2e: not part of the default run (needs Playwright, a build and three local servers; see e2e/README.md). 7 passed, 1 expected fail. Not wired into CI: Add accessibility CI job (Playwright + axe-core WCAG 2.1 AA scans) #168 / Test layout, accessibility job, registry-race fix, ragged/XLSX test deltas (#167, #168, #191, #192, #193) #214 are deciding how browser tests join CI.

• docs/TEST_CASES.md regenerated for the new pytest tests.

---

Generated by Claude Code