chore: import upstream snapshot with attribution

tests/integration/api/__init__.py

@@ -0,0 +1,5 @@
+"""
+API integration tests package.
+
+Tests for HTTP API endpoints using Quart test client.
+"""

tests/integration/api/conftest.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import pytest
+
+
+def dedupe_preregistered_groups() -> None:
+    """Keep API integration route registration isolated across test modules."""
+    from langbot.pkg.api.http.controller import group
+
+    seen: set[tuple[str, str]] = set()
+    unique_groups = []
+    for group_cls in group.preregistered_groups:
+        key = (group_cls.name, group_cls.path)
+        if key in seen:
+            continue
+        seen.add(key)
+        unique_groups.append(group_cls)
+
+    group.preregistered_groups[:] = unique_groups
+
+
+@pytest.fixture(scope='module')
+def http_controller_cls(mock_circular_import_chain):
+    """Import HTTPController under each module's circular-import isolation."""
+    from langbot.pkg.api.http.controller.main import HTTPController
+
+    dedupe_preregistered_groups()
+    return HTTPController

tests/integration/api/test_bots.py

@@ -0,0 +1,252 @@
+"""
+API integration tests for bot endpoints.
+
+Tests real HTTP API behavior for bot management.
+
+Run: uv run pytest tests/integration/api/test_bots.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """Break circular import chain for API controller."""
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.platform',
+        'langbot.pkg.api.http.controller.groups.platform.bots',
+        'langbot.pkg.api.http.controller.groups.platform.adapters',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        import langbot.pkg.api.http.controller.groups.platform.bots as _bots  # noqa: E402, F401
+
+        yield
+
+
+@pytest.fixture(scope='module')
+def fake_bot_app():
+    """Create FakeApp with bot services (module scope for reuse)."""
+    app = FakeApp()
+
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # Auth services
+    app.user_service = Mock()
+    app.user_service.is_initialized = AsyncMock(return_value=True)
+    app.user_service.verify_jwt_token = AsyncMock(return_value='test@example.com')
+    app.user_service.get_user_by_email = AsyncMock(return_value=Mock(email='test@example.com'))
+    app.apikey_service = Mock()
+    app.apikey_service.verify_api_key = AsyncMock(return_value=True)
+
+    # Bot service
+    app.bot_service = Mock()
+    app.bot_service.get_bots = AsyncMock(
+        return_value=[
+            {
+                'uuid': 'test-bot-uuid',
+                'name': 'Test Bot',
+                'platform': 'telegram',
+                'pipeline_uuid': 'test-pipeline-uuid',
+            }
+        ]
+    )
+    app.bot_service.get_runtime_bot_info = AsyncMock(
+        return_value={
+            'uuid': 'test-bot-uuid',
+            'name': 'Test Bot',
+            'platform': 'telegram',
+            'pipeline_uuid': 'test-pipeline-uuid',
+            'webhook_url': 'https://example.com/webhook/test-bot-uuid',
+        }
+    )
+    app.bot_service.create_bot = AsyncMock(return_value={'uuid': 'new-bot-uuid'})
+    app.bot_service.update_bot = AsyncMock(return_value={})
+    app.bot_service.delete_bot = AsyncMock()
+    app.bot_service.list_event_logs = AsyncMock(return_value=([{'uuid': 'log-1', 'message': 'test log'}], 1))
+    app.bot_service.send_message = AsyncMock()
+
+    # Platform manager
+    app.platform_mgr = Mock()
+
+    return app
+
+
+@pytest.fixture(scope='module')
+async def quart_test_client(fake_bot_app, http_controller_cls):
+    """Create Quart test client (module scope to avoid route re-registration)."""
+    controller = http_controller_cls(fake_bot_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+    yield client
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestBotEndpoints:
+    """Tests for /api/v1/platform/bots endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_bots_success(self, quart_test_client):
+        """GET /api/v1/platform/bots returns bot list."""
+        response = await quart_test_client.get('/api/v1/platform/bots', headers={'Authorization': 'Bearer test_token'})
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+        assert 'bots' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_create_bot_success(self, quart_test_client):
+        """POST /api/v1/platform/bots creates new bot."""
+        response = await quart_test_client.post(
+            '/api/v1/platform/bots',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New Bot', 'platform': 'telegram', 'pipeline_uuid': 'test-pipeline'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_get_single_bot_success(self, quart_test_client):
+        """GET /api/v1/platform/bots/{uuid} returns bot with runtime info."""
+        response = await quart_test_client.get(
+            '/api/v1/platform/bots/test-bot-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'bot' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_update_bot_success(self, quart_test_client):
+        """PUT /api/v1/platform/bots/{uuid} updates bot."""
+        response = await quart_test_client.put(
+            '/api/v1/platform/bots/test-bot-uuid',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'Updated Bot'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_delete_bot_success(self, quart_test_client):
+        """DELETE /api/v1/platform/bots/{uuid} deletes bot."""
+        response = await quart_test_client.delete(
+            '/api/v1/platform/bots/test-bot-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestBotLogsEndpoint:
+    """Tests for bot logs endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_bot_logs_success(self, quart_test_client):
+        """POST /api/v1/platform/bots/{uuid}/logs returns logs."""
+        response = await quart_test_client.post(
+            '/api/v1/platform/bots/test-bot-uuid/logs',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'from_index': -1, 'max_count': 10},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'logs' in data['data']
+        assert 'total_count' in data['data']
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestBotSendMessageEndpoint:
+    """Tests for bot send message endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_send_message_success(self, quart_test_client):
+        """POST /api/v1/platform/bots/{uuid}/send_message sends message."""
+        response = await quart_test_client.post(
+            '/api/v1/platform/bots/test-bot-uuid/send_message',
+            headers={'Authorization': 'Bearer test_api_key'},
+            json={
+                'target_type': 'person',
+                'target_id': 'user123',
+                'message_chain': [{'type': 'text', 'text': 'Hello'}],
+            },
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert data['data']['sent'] is True
+
+    @pytest.mark.asyncio
+    async def test_send_message_missing_target_type(self, quart_test_client):
+        """POST send_message without target_type returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/platform/bots/test-bot-uuid/send_message',
+            headers={'Authorization': 'Bearer test_api_key'},
+            json={'target_id': 'user123', 'message_chain': [{'type': 'text', 'text': 'Hello'}]},
+        )
+
+        assert response.status_code == 400
+        data = await response.get_json()
+        assert data['code'] == -1
+
+    @pytest.mark.asyncio
+    async def test_send_message_invalid_target_type(self, quart_test_client):
+        """POST send_message with invalid target_type returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/platform/bots/test-bot-uuid/send_message',
+            headers={'Authorization': 'Bearer test_api_key'},
+            json={
+                'target_type': 'invalid',
+                'target_id': 'user123',
+                'message_chain': [{'type': 'text', 'text': 'Hello'}],
+            },
+        )
+
+        assert response.status_code == 400
+        data = await response.get_json()
+        assert data['code'] == -1

tests/integration/api/test_embed.py

@@ -0,0 +1,291 @@
+"""
+API integration tests for embed widget endpoints.
+
+Tests real HTTP API behavior for embed widget functionality.
+
+Run: uv run pytest tests/integration/api/test_embed.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """Break circular import chain for API controller."""
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.pipelines',
+        'langbot.pkg.api.http.controller.groups.pipelines.embed',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        import langbot.pkg.api.http.controller.groups.pipelines.embed as _embed  # noqa: E402, F401
+
+        yield
+
+
+@pytest.fixture(scope='module')
+def fake_embed_app():
+    """Create FakeApp with embed widget services (module scope)."""
+    app = FakeApp()
+
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # Create mock web_page_bot with valid UUID format
+    mock_bot_entity = Mock()
+    mock_bot_entity.uuid = 'a1b2c3d4-5678-90ab-cdef-123456789abc'
+    mock_bot_entity.adapter = 'web_page_bot'
+    mock_bot_entity.enable = True
+    mock_bot_entity.use_pipeline_uuid = 'test-pipeline-uuid'
+    mock_bot_entity.name = 'Test Web Bot'
+    mock_bot_entity.adapter_config = {
+        'turnstile_secret_key': '',
+        'turnstile_site_key': '',
+        'language': 'en_US',
+        'bubble_icon': 'logo',
+    }
+
+    mock_runtime_bot = Mock()
+    mock_runtime_bot.bot_entity = mock_bot_entity
+
+    # Platform manager with bots
+    app.platform_mgr = Mock()
+    app.platform_mgr.bots = [mock_runtime_bot]
+
+    # WebSocket proxy bot with adapter
+    mock_websocket_adapter = Mock()
+    mock_websocket_adapter.get_websocket_messages = Mock(return_value=[{'id': 'msg-1', 'content': 'test message'}])
+    mock_websocket_adapter.reset_session = Mock()
+    mock_websocket_adapter.handle_websocket_message = AsyncMock()
+
+    mock_ws_proxy_bot = Mock()
+    mock_ws_proxy_bot.adapter = mock_websocket_adapter
+    app.platform_mgr.websocket_proxy_bot = mock_ws_proxy_bot
+
+    # Monitoring service for feedback
+    app.monitoring_service = Mock()
+    app.monitoring_service.record_feedback = AsyncMock()
+
+    return app
+
+
+@pytest.fixture(scope='module')
+async def quart_test_client(fake_embed_app, http_controller_cls):
+    """Create Quart test client (module scope)."""
+    controller = http_controller_cls(fake_embed_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+    yield client
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbedWidgetEndpoint:
+    """Tests for widget.js endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_widget_js_success(self, quart_test_client):
+        """GET /api/v1/embed/{bot_uuid}/widget.js returns JS."""
+        response = await quart_test_client.get('/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/widget.js')
+
+        assert response.status_code == 200
+        assert 'javascript' in response.content_type
+
+    @pytest.mark.asyncio
+    async def test_get_widget_js_invalid_uuid(self, quart_test_client):
+        """GET widget.js with invalid UUID returns 400."""
+        response = await quart_test_client.get('/api/v1/embed/invalid-uuid/widget.js')
+
+        assert response.status_code == 400
+
+    @pytest.mark.asyncio
+    async def test_get_widget_js_bot_not_found(self, quart_test_client):
+        """GET widget.js for non-existent bot returns 404."""
+        response = await quart_test_client.get('/api/v1/embed/00000000-0000-0000-0000-000000000000/widget.js')
+
+        assert response.status_code == 404
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbedLogoEndpoint:
+    """Tests for logo endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_logo_success(self, quart_test_client):
+        """GET /api/v1/embed/logo returns image."""
+        response = await quart_test_client.get('/api/v1/embed/logo')
+
+        assert response.status_code == 200
+        assert 'image/webp' in response.content_type
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbedTurnstileVerifyEndpoint:
+    """Tests for Turnstile verification endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_turnstile_verify_no_secret(self, quart_test_client):
+        """POST turnstile verify without secret returns dummy token."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/turnstile/verify', json={'token': 'test-token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'token' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_turnstile_verify_invalid_uuid(self, quart_test_client):
+        """POST turnstile verify with invalid UUID returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/invalid-uuid/turnstile/verify', json={'token': 'test-token'}
+        )
+
+        assert response.status_code == 400
+
+    @pytest.mark.asyncio
+    async def test_turnstile_verify_missing_token(self, quart_test_client):
+        """POST turnstile verify without token returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/turnstile/verify', json={}
+        )
+
+        assert response.status_code == 400
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbedMessagesEndpoint:
+    """Tests for messages endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_messages_person_success(self, quart_test_client):
+        """GET messages/person returns messages."""
+        response = await quart_test_client.get(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/messages/person',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'messages' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_get_messages_group_success(self, quart_test_client):
+        """GET messages/group returns messages."""
+        response = await quart_test_client.get(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/messages/group',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_get_messages_invalid_session_type(self, quart_test_client):
+        """GET messages with invalid session_type returns 400."""
+        response = await quart_test_client.get(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/messages/invalid',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+        )
+
+        assert response.status_code == 400
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbedResetEndpoint:
+    """Tests for session reset endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_reset_session_person_success(self, quart_test_client):
+        """POST reset/person resets session."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/reset/person',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_reset_session_invalid_uuid(self, quart_test_client):
+        """POST reset with invalid UUID returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/invalid-uuid/reset/person', headers={'Authorization': 'Bearer 1234567890.dummy'}
+        )
+
+        assert response.status_code == 400
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbedFeedbackEndpoint:
+    """Tests for feedback submission endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_submit_feedback_like(self, quart_test_client):
+        """POST feedback with type=1 (like) succeeds."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/feedback',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+            json={'message_id': 'msg-123', 'feedback_type': 1},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'feedback_id' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_submit_feedback_dislike(self, quart_test_client):
+        """POST feedback with type=2 (dislike) succeeds."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/feedback',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+            json={'message_id': 'msg-123', 'feedback_type': 2},
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_submit_feedback_invalid_type(self, quart_test_client):
+        """POST feedback with invalid type returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/embed/a1b2c3d4-5678-90ab-cdef-123456789abc/feedback',
+            headers={'Authorization': 'Bearer 1234567890.dummy'},
+            json={'message_id': 'msg-123', 'feedback_type': 99},
+        )
+
+        assert response.status_code == 400

tests/integration/api/test_knowledge.py

@@ -0,0 +1,257 @@
+"""
+API integration tests for knowledge base endpoints.
+
+Tests real HTTP API behavior for knowledge base management.
+
+Run: uv run pytest tests/integration/api/test_knowledge.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """Break circular import chain for API controller."""
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.knowledge',
+        'langbot.pkg.api.http.controller.groups.knowledge.base',
+        'langbot.pkg.api.http.controller.groups.knowledge.engines',
+        'langbot.pkg.api.http.controller.groups.knowledge.parsers',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        import langbot.pkg.api.http.controller.groups.knowledge.base as _knowledge  # noqa: E402, F401
+
+        yield
+
+
+@pytest.fixture(scope='module')
+def fake_knowledge_app():
+    """Create FakeApp with knowledge services (module scope for reuse)."""
+    app = FakeApp()
+
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # Auth services
+    app.user_service = Mock()
+    app.user_service.is_initialized = AsyncMock(return_value=True)
+    app.user_service.verify_jwt_token = AsyncMock(return_value='test@example.com')
+    app.user_service.get_user_by_email = AsyncMock(return_value=Mock(email='test@example.com'))
+    app.apikey_service = Mock()
+    app.apikey_service.verify_api_key = AsyncMock(return_value=True)
+
+    # Knowledge service
+    app.knowledge_service = Mock()
+    app.knowledge_service.get_knowledge_bases = AsyncMock(
+        return_value=[
+            {
+                'uuid': 'test-kb-uuid',
+                'name': 'Test Knowledge Base',
+                'description': 'Test KB description',
+                'engine_plugin_id': 'test/engine',
+                'created_at': '2024-01-01T00:00:00',
+                'updated_at': '2024-01-01T00:00:00',
+            }
+        ]
+    )
+    app.knowledge_service.get_knowledge_base = AsyncMock(
+        return_value={
+            'uuid': 'test-kb-uuid',
+            'name': 'Test Knowledge Base',
+            'description': 'Test KB description',
+            'engine_plugin_id': 'test/engine',
+        }
+    )
+    app.knowledge_service.create_knowledge_base = AsyncMock(return_value={'uuid': 'new-kb-uuid'})
+    app.knowledge_service.update_knowledge_base = AsyncMock(return_value={})
+    app.knowledge_service.delete_knowledge_base = AsyncMock()
+    app.knowledge_service.get_files_by_knowledge_base = AsyncMock(
+        return_value=[{'uuid': 'test-file-uuid', 'filename': 'test.pdf'}]
+    )
+    app.knowledge_service.store_file = AsyncMock(return_value={'task_id': 'test-task-id'})
+    app.knowledge_service.delete_file = AsyncMock()
+    app.knowledge_service.retrieve_knowledge_base = AsyncMock(return_value=[{'content': 'test result', 'score': 0.95}])
+
+    # RAG manager
+    app.rag_mgr = Mock()
+
+    return app
+
+
+@pytest.fixture(scope='module')
+async def quart_test_client(fake_knowledge_app, http_controller_cls):
+    """Create Quart test client (module scope to avoid route re-registration)."""
+    controller = http_controller_cls(fake_knowledge_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+    yield client
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestKnowledgeBaseEndpoints:
+    """Tests for /api/v1/knowledge/bases endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_knowledge_bases_success(self, quart_test_client):
+        """GET /api/v1/knowledge/bases returns knowledge base list."""
+        response = await quart_test_client.get(
+            '/api/v1/knowledge/bases', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+        assert 'bases' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_create_knowledge_base_success(self, quart_test_client):
+        """POST /api/v1/knowledge/bases creates new knowledge base."""
+        response = await quart_test_client.post(
+            '/api/v1/knowledge/bases',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New KB', 'engine_plugin_id': 'test/engine'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_get_single_knowledge_base_success(self, quart_test_client):
+        """GET /api/v1/knowledge/bases/{uuid} returns knowledge base."""
+        response = await quart_test_client.get(
+            '/api/v1/knowledge/bases/test-kb-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'base' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_update_knowledge_base_success(self, quart_test_client):
+        """PUT /api/v1/knowledge/bases/{uuid} updates knowledge base."""
+        response = await quart_test_client.put(
+            '/api/v1/knowledge/bases/test-kb-uuid',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'Updated KB'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_delete_knowledge_base_success(self, quart_test_client):
+        """DELETE /api/v1/knowledge/bases/{uuid} deletes knowledge base."""
+        response = await quart_test_client.delete(
+            '/api/v1/knowledge/bases/test-kb-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestKnowledgeBaseFilesEndpoints:
+    """Tests for knowledge base files endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_files_success(self, quart_test_client):
+        """GET /api/v1/knowledge/bases/{uuid}/files returns files."""
+        response = await quart_test_client.get(
+            '/api/v1/knowledge/bases/test-kb-uuid/files', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'files' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_add_file_to_knowledge_base(self, quart_test_client):
+        """POST /api/v1/knowledge/bases/{uuid}/files adds file."""
+        response = await quart_test_client.post(
+            '/api/v1/knowledge/bases/test-kb-uuid/files',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'file_id': 'test-file-id', 'parser_plugin_id': 'test/parser'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'task_id' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_delete_file_from_knowledge_base(self, quart_test_client):
+        """DELETE /api/v1/knowledge/bases/{uuid}/files/{file_id}."""
+        response = await quart_test_client.delete(
+            '/api/v1/knowledge/bases/test-kb-uuid/files/test-file-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestKnowledgeBaseRetrieveEndpoint:
+    """Tests for knowledge base retrieval endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_retrieve_knowledge_success(self, quart_test_client):
+        """POST /api/v1/knowledge/bases/{uuid}/retrieve."""
+        response = await quart_test_client.post(
+            '/api/v1/knowledge/bases/test-kb-uuid/retrieve',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'query': 'test query', 'retrieval_settings': {'top_k': 5}},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'results' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_retrieve_without_query_returns_error(self, quart_test_client):
+        """POST retrieve without query returns 400."""
+        response = await quart_test_client.post(
+            '/api/v1/knowledge/bases/test-kb-uuid/retrieve', headers={'Authorization': 'Bearer test_token'}, json={}
+        )
+
+        assert response.status_code == 400
+        data = await response.get_json()
+        assert data['code'] == -1

tests/integration/api/test_monitoring.py

@@ -0,0 +1,313 @@
+"""
+API integration tests for monitoring endpoints.
+
+Tests real HTTP API behavior for monitoring data retrieval.
+
+Run: uv run pytest tests/integration/api/test_monitoring.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """Break circular import chain for API controller."""
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.monitoring',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        import langbot.pkg.api.http.controller.groups.monitoring as _monitoring  # noqa: E402, F401
+
+        yield
+
+
+@pytest.fixture(scope='module')
+def fake_monitoring_app():
+    """Create FakeApp with monitoring services (module scope)."""
+    app = FakeApp()
+
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # Auth services - USER_TOKEN auth requires jwt verification AND get_user_by_email
+    app.user_service = Mock()
+    app.user_service.is_initialized = AsyncMock(return_value=True)
+    app.user_service.verify_jwt_token = AsyncMock(return_value='test@example.com')
+    app.user_service.get_user_by_email = AsyncMock(return_value=Mock(email='test@example.com'))
+
+    # Monitoring service
+    app.monitoring_service = Mock()
+    app.monitoring_service.get_overview_metrics = AsyncMock(
+        return_value={
+            'total_messages': 100,
+            'total_llm_calls': 50,
+            'total_sessions': 20,
+            'active_sessions': 5,
+            'total_errors': 2,
+        }
+    )
+    app.monitoring_service.get_messages = AsyncMock(return_value=([{'id': 'msg-1', 'content': 'test'}], 100))
+    app.monitoring_service.get_llm_calls = AsyncMock(return_value=([{'id': 'llm-1'}], 50))
+    app.monitoring_service.get_tool_calls = AsyncMock(return_value=([{'id': 'tool-1'}], 5))
+    app.monitoring_service.get_embedding_calls = AsyncMock(return_value=([{'id': 'emb-1'}], 10))
+    app.monitoring_service.get_sessions = AsyncMock(return_value=([{'session_id': 'sess-1'}], 20))
+    app.monitoring_service.get_errors = AsyncMock(return_value=([{'id': 'err-1'}], 2))
+    app.monitoring_service.get_session_analysis = AsyncMock(
+        return_value={
+            'found': True,
+            'session_id': 'sess-1',
+        }
+    )
+    app.monitoring_service.get_message_details = AsyncMock(
+        return_value={
+            'found': True,
+            'message_id': 'msg-1',
+        }
+    )
+    app.monitoring_service.get_feedback_stats = AsyncMock(return_value={'like_count': 10})
+    app.monitoring_service.get_feedback_list = AsyncMock(return_value=([{'feedback_id': 'fb-1'}], 12))
+    app.monitoring_service.export_messages = AsyncMock(return_value=[{'id': 'msg-1'}])
+    app.monitoring_service.export_llm_calls = AsyncMock(return_value=[{'id': 'llm-1'}])
+    app.monitoring_service.export_errors = AsyncMock(return_value=[{'id': 'err-1'}])
+    app.monitoring_service.export_sessions = AsyncMock(return_value=[{'session_id': 'sess-1'}])
+    app.monitoring_service.export_feedback = AsyncMock(return_value=[{'id': 'fb-1'}])
+    app.monitoring_service.export_embedding_calls = AsyncMock(return_value=[{'id': 'emb-1'}])
+    app.monitoring_service._escape_csv_field = Mock(return_value='escaped')
+
+    return app
+
+
+@pytest.fixture(scope='module')
+async def quart_test_client(fake_monitoring_app, http_controller_cls):
+    """Create Quart test client (module scope)."""
+    controller = http_controller_cls(fake_monitoring_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+    yield client
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringOverviewEndpoint:
+    """Tests for /api/v1/monitoring/overview endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_overview_success(self, quart_test_client):
+        """GET /api/v1/monitoring/overview returns metrics."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/overview', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringMessagesEndpoint:
+    """Tests for /api/v1/monitoring/messages endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_messages_success(self, quart_test_client):
+        """GET /api/v1/monitoring/messages returns message list."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/messages', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'messages' in data['data']
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringLLMCallsEndpoint:
+    """Tests for /api/v1/monitoring/llm-calls endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_llm_calls_success(self, quart_test_client):
+        """GET /api/v1/monitoring/llm-calls."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/llm-calls', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringEmbeddingCallsEndpoint:
+    """Tests for /api/v1/monitoring/embedding-calls endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_embedding_calls_success(self, quart_test_client):
+        """GET /api/v1/monitoring/embedding-calls."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/embedding-calls', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringSessionsEndpoint:
+    """Tests for /api/v1/monitoring/sessions endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_sessions_success(self, quart_test_client):
+        """GET /api/v1/monitoring/sessions."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/sessions', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringErrorsEndpoint:
+    """Tests for /api/v1/monitoring/errors endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_errors_success(self, quart_test_client):
+        """GET /api/v1/monitoring/errors."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/errors', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringAllDataEndpoint:
+    """Tests for /api/v1/monitoring/data endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_all_data_success(self, quart_test_client):
+        """GET /api/v1/monitoring/data returns all data."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/data', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert 'overview' in data['data']
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringDetailsEndpoints:
+    """Tests for detail endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_session_analysis(self, quart_test_client):
+        """GET /api/v1/monitoring/sessions/{id}/analysis."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/sessions/sess-1/analysis', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_get_message_details(self, quart_test_client):
+        """GET /api/v1/monitoring/messages/{id}/details."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/messages/msg-1/details', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringFeedbackEndpoints:
+    """Tests for feedback endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_feedback_stats(self, quart_test_client):
+        """GET /api/v1/monitoring/feedback/stats."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/feedback/stats', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_get_feedback_list(self, quart_test_client):
+        """GET /api/v1/monitoring/feedback."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/feedback', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestMonitoringExportEndpoint:
+    """Tests for /api/v1/monitoring/export endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_export_messages(self, quart_test_client):
+        """GET export?type=messages returns CSV."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/export?type=messages', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        assert 'text/csv' in response.content_type
+
+    @pytest.mark.asyncio
+    async def test_export_llm_calls(self, quart_test_client):
+        """GET export?type=llm-calls returns CSV."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/export?type=llm-calls', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_export_sessions(self, quart_test_client):
+        """GET export?type=sessions returns CSV."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/export?type=sessions', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_export_feedback(self, quart_test_client):
+        """GET export?type=feedback returns CSV."""
+        response = await quart_test_client.get(
+            '/api/v1/monitoring/export?type=feedback', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200

tests/integration/api/test_pipelines.py

@@ -0,0 +1,280 @@
+"""
+API integration tests for pipeline endpoints.
+
+Tests real HTTP API behavior using Quart test client with mocked services.
+Extends test_smoke.py coverage for pipeline-related endpoints.
+
+Run: uv run pytest tests/integration/api/test_pipelines.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+# ============== FIXTURE FOR SYS.MODULES ISOLATION ==============
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """Break circular import chain for API controller."""
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.pipelines',
+        'langbot.pkg.api.http.controller.groups.pipelines.pipelines',
+        'langbot.pkg.api.http.controller.groups.pipelines.embed',
+        'langbot.pkg.api.http.controller.groups.pipelines.websocket_chat',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        # Import groups after mocking to populate preregistered_groups
+        import langbot.pkg.api.http.controller.groups.pipelines.pipelines as _pipelines  # noqa: E402, F401
+
+        yield
+
+
+# ============== FAKE APPLICATION WITH PIPELINE SERVICES ==============
+
+
+@pytest.fixture(scope='module')
+def fake_pipeline_app():
+    """Create FakeApp with pipeline-specific services (module scope for reuse)."""
+    app = FakeApp()
+
+    # Pipeline config
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # Auth services
+    app.user_service = Mock()
+    app.user_service.is_initialized = AsyncMock(return_value=True)
+    app.user_service.verify_jwt_token = AsyncMock(return_value='test@example.com')
+    app.user_service.get_user_by_email = AsyncMock(return_value=Mock(email='test@example.com'))
+    app.apikey_service = Mock()
+    app.apikey_service.verify_api_key = AsyncMock(return_value=True)
+
+    # Pipeline service
+    app.pipeline_service = Mock()
+    app.pipeline_service.get_pipeline_metadata = AsyncMock(
+        return_value=[
+            {'name': 'trigger', 'stages': []},
+            {'name': 'ai', 'stages': []},
+        ]
+    )
+    app.pipeline_service.get_pipelines = AsyncMock(
+        return_value=[
+            {
+                'uuid': 'test-pipeline-uuid',
+                'name': 'Test Pipeline',
+                'description': 'Test description',
+                'created_at': '2024-01-01T00:00:00',
+                'updated_at': '2024-01-01T00:00:00',
+                'is_default': False,
+            }
+        ]
+    )
+    app.pipeline_service.get_pipeline = AsyncMock(
+        return_value={
+            'uuid': 'test-pipeline-uuid',
+            'name': 'Test Pipeline',
+            'config': {},
+        }
+    )
+    app.pipeline_service.create_pipeline = AsyncMock(return_value={'uuid': 'new-pipeline-uuid'})
+    app.pipeline_service.update_pipeline = AsyncMock(return_value={})
+    app.pipeline_service.delete_pipeline = AsyncMock()
+    app.pipeline_service.copy_pipeline = AsyncMock(return_value={'uuid': 'copied-pipeline-uuid'})
+
+    # Bot service
+    app.bot_service = Mock()
+    app.bot_service.get_bots = AsyncMock(return_value=[])
+    app.bot_service.create_bot = AsyncMock(return_value={'uuid': 'new-bot-uuid'})
+
+    # MCP service (for extensions endpoint)
+    app.mcp_service = Mock()
+    app.mcp_service.get_mcp_servers = AsyncMock(return_value=[])
+
+    # Skill service (for extensions endpoint)
+    app.skill_service = Mock()
+    app.skill_service.list_skills = AsyncMock(return_value=[])
+
+    # Plugin connector (for extensions endpoint)
+    app.plugin_connector.list_plugins = AsyncMock(return_value=[])
+
+    return app
+
+
+@pytest.fixture(scope='module')
+async def quart_test_client(fake_pipeline_app, http_controller_cls):
+    """Create Quart test client (module scope to avoid route re-registration)."""
+    controller = http_controller_cls(fake_pipeline_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+    yield client
+
+
+# ============== PIPELINE ENDPOINT TESTS ==============
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestPipelineMetadataEndpoint:
+    """Tests for /api/v1/pipelines/_/metadata endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_pipeline_metadata_success(self, quart_test_client):
+        """GET /api/v1/pipelines/_/metadata returns metadata list."""
+        response = await quart_test_client.get(
+            '/api/v1/pipelines/_/metadata', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+        assert isinstance(data['data'], dict)
+
+    @pytest.mark.asyncio
+    async def test_get_pipeline_metadata_requires_auth(self, quart_test_client):
+        """Pipeline metadata endpoint requires authentication."""
+        response = await quart_test_client.get('/api/v1/pipelines/_/metadata')
+        assert response.status_code == 401
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestPipelinesListEndpoint:
+    """Tests for /api/v1/pipelines endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_get_pipelines_success(self, quart_test_client):
+        """GET /api/v1/pipelines returns pipeline list."""
+        response = await quart_test_client.get('/api/v1/pipelines', headers={'Authorization': 'Bearer test_token'})
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+
+    @pytest.mark.asyncio
+    async def test_get_pipelines_with_sort_param(self, quart_test_client):
+        """GET pipelines with sort parameter."""
+        response = await quart_test_client.get(
+            '/api/v1/pipelines?sort_by=created_at&sort_order=DESC', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestPipelinesCRUDEndpoints:
+    """Tests for pipeline CRUD operations."""
+
+    @pytest.mark.asyncio
+    async def test_get_single_pipeline_success(self, quart_test_client):
+        """GET /api/v1/pipelines/{uuid} returns pipeline."""
+        response = await quart_test_client.get(
+            '/api/v1/pipelines/test-pipeline-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+
+    @pytest.mark.asyncio
+    async def test_create_pipeline_success(self, quart_test_client):
+        """POST /api/v1/pipelines creates new pipeline."""
+        response = await quart_test_client.post(
+            '/api/v1/pipelines',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New Pipeline', 'config': {}},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_update_pipeline_success(self, quart_test_client):
+        """PUT /api/v1/pipelines/{uuid} updates pipeline."""
+        response = await quart_test_client.put(
+            '/api/v1/pipelines/test-pipeline-uuid',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'Updated Pipeline'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_delete_pipeline_success(self, quart_test_client):
+        """DELETE /api/v1/pipelines/{uuid} deletes pipeline."""
+        response = await quart_test_client.delete(
+            '/api/v1/pipelines/test-pipeline-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_copy_pipeline_success(self, quart_test_client):
+        """POST /api/v1/pipelines/{uuid}/copy copies pipeline."""
+        response = await quart_test_client.post(
+            '/api/v1/pipelines/test-pipeline-uuid/copy', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestPipelineExtensionsEndpoint:
+    """Tests for pipeline extensions."""
+
+    @pytest.mark.asyncio
+    async def test_get_extensions(self, quart_test_client):
+        """GET /api/v1/pipelines/{uuid}/extensions."""
+        response = await quart_test_client.get(
+            '/api/v1/pipelines/test-pipeline-uuid/extensions', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        # Should return 200 if pipeline found
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0

tests/integration/api/test_providers.py

@@ -0,0 +1,337 @@
+"""
+API integration tests for provider/model endpoints.
+
+Tests real HTTP API behavior for provider and model management.
+
+Run: uv run pytest tests/integration/api/test_providers.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """Break circular import chain for API controller."""
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.provider',
+        'langbot.pkg.api.http.controller.groups.provider.providers',
+        'langbot.pkg.api.http.controller.groups.provider.models',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        import langbot.pkg.api.http.controller.groups.provider.providers as _providers  # noqa: E402, F401
+        import langbot.pkg.api.http.controller.groups.provider.models as _models  # noqa: E402, F401
+
+        yield
+
+
+@pytest.fixture(scope='module')
+def fake_provider_app():
+    """Create FakeApp with provider/model services (module scope for reuse)."""
+    app = FakeApp()
+
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # Auth services
+    app.user_service = Mock()
+    app.user_service.is_initialized = AsyncMock(return_value=True)
+    app.user_service.verify_jwt_token = AsyncMock(return_value='test@example.com')
+    app.user_service.get_user_by_email = AsyncMock(return_value=Mock(email='test@example.com'))
+    app.apikey_service = Mock()
+    app.apikey_service.verify_api_key = AsyncMock(return_value=True)
+
+    # Provider service
+    app.provider_service = Mock()
+    app.provider_service.get_providers = AsyncMock(
+        return_value=[{'uuid': 'test-provider-uuid', 'name': 'OpenAI', 'requester': 'chatcmpl'}]
+    )
+    app.provider_service.get_provider = AsyncMock(
+        return_value={'uuid': 'test-provider-uuid', 'name': 'OpenAI', 'requester': 'chatcmpl'}
+    )
+    app.provider_service.create_provider = AsyncMock(return_value='new-provider-uuid')
+    app.provider_service.update_provider = AsyncMock(return_value={})
+    app.provider_service.delete_provider = AsyncMock()
+    app.provider_service.get_provider_model_counts = AsyncMock(
+        return_value={'llm_count': 2, 'embedding_count': 1, 'rerank_count': 0}
+    )
+
+    # LLM model service
+    app.llm_model_service = Mock()
+    app.llm_model_service.get_llm_models = AsyncMock(return_value=[{'uuid': 'test-model-uuid', 'name': 'gpt-4'}])
+    app.llm_model_service.get_llm_model = AsyncMock(return_value={'uuid': 'test-model-uuid', 'name': 'gpt-4'})
+    app.llm_model_service.create_llm_model = AsyncMock(return_value={'uuid': 'new-model-uuid'})
+    app.llm_model_service.update_llm_model = AsyncMock(return_value={})
+    app.llm_model_service.delete_llm_model = AsyncMock()
+
+    # Embedding model service
+    app.embedding_models_service = Mock()
+    app.embedding_models_service.get_embedding_models = AsyncMock(return_value=[])
+    app.embedding_models_service.create_embedding_model = AsyncMock(return_value={'uuid': 'new-embedding-uuid'})
+
+    # Rerank model service
+    app.rerank_models_service = Mock()
+    app.rerank_models_service.get_rerank_models = AsyncMock(return_value=[])
+    app.rerank_models_service.create_rerank_model = AsyncMock(return_value={'uuid': 'new-rerank-uuid'})
+
+    # Model manager
+    app.model_mgr = Mock()
+    app.model_mgr.load_provider = AsyncMock()
+    app.model_mgr.unload_provider = AsyncMock()
+
+    return app
+
+
+@pytest.fixture(scope='module')
+async def quart_test_client(fake_provider_app, http_controller_cls):
+    """Create Quart test client (module scope to avoid route re-registration)."""
+    controller = http_controller_cls(fake_provider_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+    yield client
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestProviderEndpoints:
+    """Tests for /api/v1/provider endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_providers_success(self, quart_test_client):
+        """GET /api/v1/provider/providers returns provider list with complete structure."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/providers', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+        # Verify response structure completeness
+        providers = data['data']['providers']
+        assert isinstance(providers, list)
+        assert len(providers) == 1
+        # Verify required fields in provider object
+        provider = providers[0]
+        assert 'uuid' in provider
+        assert 'name' in provider
+        assert 'requester' in provider
+        assert provider['uuid'] == 'test-provider-uuid'
+        assert provider['name'] == 'OpenAI'
+
+    @pytest.mark.asyncio
+    async def test_get_single_provider_success(self, quart_test_client):
+        """GET /api/v1/provider/providers/{uuid} returns complete provider structure."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/providers/test-provider-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        # Verify response structure
+        provider = data['data']['provider']
+        assert 'uuid' in provider
+        assert 'name' in provider
+        assert 'requester' in provider
+        assert provider['uuid'] == 'test-provider-uuid'
+
+    @pytest.mark.asyncio
+    async def test_create_provider_success(self, quart_test_client):
+        """POST /api/v1/provider/providers creates new provider with uuid returned."""
+        response = await quart_test_client.post(
+            '/api/v1/provider/providers',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New Provider', 'requester': 'chatcmpl'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        # Verify uuid is present and matches expected
+        assert 'data' in data
+        assert 'uuid' in data['data']
+        assert data['data']['uuid'] == 'new-provider-uuid'
+
+    @pytest.mark.asyncio
+    async def test_update_provider_success(self, quart_test_client):
+        """PUT /api/v1/provider/providers/{uuid} updates provider."""
+        response = await quart_test_client.put(
+            '/api/v1/provider/providers/test-provider-uuid',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'Updated Provider'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_delete_provider_success(self, quart_test_client):
+        """DELETE /api/v1/provider/providers/{uuid} deletes provider."""
+        response = await quart_test_client.delete(
+            '/api/v1/provider/providers/test-provider-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_get_provider_includes_model_counts(self, quart_test_client):
+        """GET provider response includes model counts."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/providers/test-provider-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        # Model counts are embedded in provider response
+        provider_data = data['data']['provider']
+        assert 'llm_count' in provider_data
+        assert 'embedding_count' in provider_data
+        assert 'rerank_count' in provider_data
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestModelEndpoints:
+    """Tests for /api/v1/provider/models endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_llm_models_success(self, quart_test_client):
+        """GET /api/v1/provider/models/llm returns model list."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/models/llm', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'data' in data
+
+    @pytest.mark.asyncio
+    async def test_get_single_llm_model_success(self, quart_test_client):
+        """GET /api/v1/provider/models/llm/{uuid} returns model."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/models/llm/test-model-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+
+    @pytest.mark.asyncio
+    async def test_create_llm_model_success(self, quart_test_client):
+        """POST /api/v1/provider/models/llm creates new model."""
+        response = await quart_test_client.post(
+            '/api/v1/provider/models/llm',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New Model', 'provider_uuid': 'test-provider-uuid'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_delete_llm_model_success(self, quart_test_client):
+        """DELETE /api/v1/provider/models/llm/{uuid} deletes model."""
+        response = await quart_test_client.delete(
+            '/api/v1/provider/models/llm/test-model-uuid', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestEmbeddingModelEndpoints:
+    """Tests for /api/v1/provider/models/embedding endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_embedding_models_success(self, quart_test_client):
+        """GET /api/v1/provider/models/embedding returns model list."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/models/embedding', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'models' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_create_embedding_model_success(self, quart_test_client):
+        """POST /api/v1/provider/models/embedding creates new model."""
+        response = await quart_test_client.post(
+            '/api/v1/provider/models/embedding',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New Embedding Model', 'provider_uuid': 'test-provider-uuid'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestRerankModelEndpoints:
+    """Tests for /api/v1/provider/models/rerank endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_get_rerank_models_success(self, quart_test_client):
+        """GET /api/v1/provider/models/rerank returns model list."""
+        response = await quart_test_client.get(
+            '/api/v1/provider/models/rerank', headers={'Authorization': 'Bearer test_token'}
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'models' in data['data']
+
+    @pytest.mark.asyncio
+    async def test_create_rerank_model_success(self, quart_test_client):
+        """POST /api/v1/provider/models/rerank creates new model."""
+        response = await quart_test_client.post(
+            '/api/v1/provider/models/rerank',
+            headers={'Authorization': 'Bearer test_token'},
+            json={'name': 'New Rerank Model', 'provider_uuid': 'test-provider-uuid'},
+        )
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['code'] == 0
+        assert 'uuid' in data['data']

tests/integration/api/test_smoke.py

@@ -0,0 +1,347 @@
+"""
+API smoke integration tests.
+
+Tests real HTTP API behavior using Quart test client.
+Validates controller/service/routing wiring without real provider/platform.
+
+Run: uv run pytest tests/integration/api/test_smoke.py -q
+"""
+
+from __future__ import annotations
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, Mock
+
+from tests.factories import FakeApp
+
+
+pytestmark = pytest.mark.integration
+
+
+# ============== FIXTURE FOR SYS.MODULES ISOLATION ==============
+
+
+@pytest.fixture(scope='module')
+def mock_circular_import_chain():
+    """
+    Break circular import chain for API controller using isolated_sys_modules.
+
+    Chain: http_controller → groups/plugins → core.app → pipeline entities
+
+    We need to mock core.app to prevent the circular chain when importing HTTPController.
+    But we must allow groups to be imported to populate preregistered_groups.
+    """
+    from tests.utils.import_isolation import isolated_sys_modules, MockLifecycleControlScope
+
+    # Mock core.app with minimal Application that groups can reference
+    class FakeMinimalApplication:
+        pass
+
+    mock_app = MagicMock()
+    mock_app.Application = FakeMinimalApplication
+
+    # Mock core.entities with proper Enum
+    mock_entities = MagicMock()
+    mock_entities.LifecycleControlScope = MockLifecycleControlScope
+
+    # Modules to clear (force re-import after mocking)
+    clear = [
+        'langbot.pkg.api.http.controller.group',
+        'langbot.pkg.api.http.controller.groups',
+        'langbot.pkg.api.http.controller.groups.system',
+        'langbot.pkg.api.http.controller.groups.user',
+        'langbot.pkg.api.http.controller.main',
+    ]
+
+    with isolated_sys_modules(
+        mocks={
+            'langbot.pkg.core.app': mock_app,
+            'langbot.pkg.core.entities': mock_entities,
+        },
+        clear=clear,
+    ):
+        # Import groups after mocking core.app/core.entities
+        import langbot.pkg.api.http.controller.group as _group_module  # noqa: E402, F401
+        import langbot.pkg.api.http.controller.groups.system as _system_group  # noqa: E402, F401
+        import langbot.pkg.api.http.controller.groups.user as _user_group  # noqa: E402, F401
+
+        yield
+
+
+# ============== FAKE APPLICATION FOR API TESTS ==============
+
+
+@pytest.fixture
+def fake_api_app():
+    """
+    Create minimal FakeApp for API smoke tests with all required services.
+
+    Uses tests.factories.FakeApp as base and adds API-specific services.
+    """
+    app = FakeApp()
+
+    # API-specific config
+    app.instance_config.data.update(
+        {
+            'api': {'port': 5300},
+            'plugin': {'enable_marketplace': True},
+            'space': {'url': 'https://space.langbot.app'},
+            'system': {'allow_modify_login_info': True, 'limitation': {}},
+        }
+    )
+
+    # API-specific services
+    app.user_service = Mock()
+    app.user_service.is_initialized = AsyncMock(return_value=False)
+    app.user_service.authenticate = AsyncMock(return_value='fake_token')
+    app.user_service.create_user = AsyncMock()
+    app.user_service.verify_jwt_token = AsyncMock(side_effect=ValueError('Invalid token'))
+    app.user_service.get_user_by_email = AsyncMock(return_value=Mock())
+    app.user_service.generate_jwt_token = AsyncMock(return_value='fake_token')
+
+    app.apikey_service = Mock()
+    app.apikey_service.verify_api_key = AsyncMock(return_value=True)
+
+    app.maintenance_service = Mock()
+    app.maintenance_service.get_storage_analysis = AsyncMock(return_value={})
+
+    app.plugin_connector.is_enable_plugin = False
+    app.plugin_connector.ping_plugin_runtime = AsyncMock()
+
+    app.task_mgr.get_tasks_dict = Mock(return_value={'tasks': []})
+    app.task_mgr.get_task_by_id = Mock(return_value=None)
+
+    # Required by controller groups
+    app.model_mgr = Mock()
+    app.platform_mgr = Mock()
+    app.pipeline_pool = Mock()
+    app.pipeline_mgr = Mock()
+
+    return app
+
+
+# ============== QUART TEST CLIENT FIXTURE ==============
+
+
+@pytest.fixture
+async def quart_test_client(fake_api_app, http_controller_cls):
+    """
+    Create Quart test client with real HTTPController and route registration.
+
+    Requires mock_circular_import_chain fixture to run first (usefixtures).
+    """
+    controller = http_controller_cls(fake_api_app)
+    await controller.initialize()
+
+    client = controller.quart_app.test_client()
+
+    yield client
+
+
+# ============== API SMOKE TESTS ==============
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestHealthEndpoint:
+    """Tests for /healthz endpoint - simplest smoke test."""
+
+    @pytest.mark.asyncio
+    async def test_healthz_returns_ok(self, quart_test_client):
+        """
+        /healthz endpoint returns {'code': 0, 'msg': 'ok'}.
+
+        This tests:
+        - HTTPController instantiation
+        - Quart app creation
+        - Route registration
+        - Basic response handling
+        """
+        response = await quart_test_client.get('/healthz')
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data == {'code': 0, 'msg': 'ok'}
+
+    @pytest.mark.asyncio
+    async def test_healthz_no_auth_required(self, quart_test_client):
+        """
+        /healthz doesn't require authentication.
+
+        Tests that AuthType.NONE endpoints work without headers.
+        """
+        response = await quart_test_client.get('/healthz')
+        assert response.status_code == 200
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestSystemEndpoint:
+    """Tests for /api/v1/system endpoints."""
+
+    @pytest.mark.asyncio
+    async def test_system_info_no_auth(self, quart_test_client):
+        """
+        /api/v1/system/info returns system information without auth.
+
+        AuthType.NONE endpoint.
+        """
+        response = await quart_test_client.get('/api/v1/system/info')
+
+        assert response.status_code == 200
+        data = await response.get_json()
+
+        # Verify response structure
+        assert data['code'] == 0
+        assert data['msg'] == 'ok'
+        assert 'data' in data
+
+        # Verify expected fields
+        system_data = data['data']
+        assert 'version' in system_data
+        assert 'debug' in system_data
+        assert 'edition' in system_data
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestProtectedEndpoints:
+    """Tests for authentication/authorization behavior."""
+
+    @pytest.mark.asyncio
+    async def test_protected_endpoint_rejects_no_token(self, quart_test_client):
+        """
+        Protected endpoint (USER_TOKEN) returns 401 without auth.
+
+        Tests that AuthType.USER_TOKEN properly rejects unauthorized requests.
+        """
+        # /api/v1/user/check-token requires USER_TOKEN
+        response = await quart_test_client.get('/api/v1/user/check-token')
+
+        assert response.status_code == 401
+        data = await response.get_json()
+
+        # Verify error response structure
+        assert data['code'] == -1
+        assert 'msg' in data
+
+    @pytest.mark.asyncio
+    async def test_protected_endpoint_with_invalid_token(self, quart_test_client):
+        """
+        Protected endpoint returns 401 with invalid token.
+        """
+        response = await quart_test_client.get(
+            '/api/v1/user/check-token', headers={'Authorization': 'Bearer invalid_token'}
+        )
+
+        assert response.status_code == 401
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestInvalidPayload:
+    """Tests for error handling with invalid payloads."""
+
+    @pytest.mark.asyncio
+    async def test_missing_json_body(self, quart_test_client):
+        """
+        POST endpoint without JSON body handles gracefully.
+        """
+        # /api/v1/user/auth expects JSON with 'user' and 'password'
+        response = await quart_test_client.post('/api/v1/user/auth')
+
+        # Should return error (500, 400, or 401) with stable JSON structure
+        assert response.status_code in (400, 500, 401)
+        data = await response.get_json()
+
+        # Verify error response has expected structure
+        assert 'code' in data
+        assert 'msg' in data
+
+    @pytest.mark.asyncio
+    async def test_invalid_json_structure(self, quart_test_client):
+        """
+        POST with wrong JSON structure returns stable error.
+        """
+        response = await quart_test_client.post('/api/v1/user/auth', json={'wrong_field': 'value'})
+
+        # Should return error with stable JSON structure
+        assert response.status_code in (400, 500, 401)
+        data = await response.get_json()
+        assert 'code' in data
+        assert 'msg' in data
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestUserInitEndpoint:
+    """Tests for /api/v1/user/init endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_user_init_get_returns_not_initialized(self, quart_test_client):
+        """
+        GET /api/v1/user/init returns initialized status.
+
+        Uses fake user_service.is_initialized() = False.
+        """
+        response = await quart_test_client.get('/api/v1/user/init')
+
+        assert response.status_code == 200
+        data = await response.get_json()
+
+        assert data['code'] == 0
+        assert data['msg'] == 'ok'
+        assert data['data']['initialized'] is False
+
+
+@pytest.mark.usefixtures('mock_circular_import_chain')
+class TestRealImports:
+    """Tests that verify real production code is imported."""
+
+    def test_http_controller_real_import(self):
+        """
+        Verify HTTPController is real production class, not mock.
+        """
+        from langbot.pkg.api.http.controller.main import HTTPController
+
+        assert HTTPController.__name__ == 'HTTPController'
+        assert hasattr(HTTPController, 'initialize')
+        assert hasattr(HTTPController, 'register_routes')
+
+    def test_group_real_import(self):
+        """
+        Verify RouterGroup and AuthType are real production classes.
+        """
+        from langbot.pkg.api.http.controller.group import RouterGroup, AuthType, preregistered_groups
+
+        assert RouterGroup.__name__ == 'RouterGroup'
+        assert hasattr(AuthType, 'NONE')
+        assert hasattr(AuthType, 'USER_TOKEN')
+        assert isinstance(preregistered_groups, list)
+
+    def test_system_group_registered(self):
+        """
+        Verify SystemRouterGroup is registered in preregistered_groups.
+        """
+        from langbot.pkg.api.http.controller.group import preregistered_groups
+
+        # Find system group
+        system_group = None
+        for g in preregistered_groups:
+            if g.name == 'system':
+                system_group = g
+                break
+
+        assert system_group is not None
+        assert system_group.path == '/api/v1/system'
+
+    def test_user_group_registered(self):
+        """
+        Verify UserRouterGroup is registered in preregistered_groups.
+        """
+        from langbot.pkg.api.http.controller.group import preregistered_groups
+
+        # Find user group
+        user_group = None
+        for g in preregistered_groups:
+            if g.name == 'user':
+                user_group = g
+                break
+
+        assert user_group is not None
+        assert user_group.path == '/api/v1/user'