chore: import upstream snapshot with attribution

tests/performance/api_auth/conftest.py

@@ -0,0 +1,98 @@
+"""
+Pytest configuration and shared fixtures for API tests
+"""
+
+import json
+import subprocess
+import uuid
+import pytest
+import requests
+from pathlib import Path
+import tempfile
+import os
+
+# Base URL for tests
+BASE_URL = os.environ.get("LDR_TEST_BASE_URL", "http://127.0.0.1:5000")
+# Use UUID for unique usernames to avoid collisions in parallel tests
+TEST_USERNAME = f"testuser_{uuid.uuid4().hex[:12]}"
+TEST_PASSWORD = "TestPass123"
+
+
+class AuthHelper:
+    """Helper class to handle Puppeteer authentication"""
+
+    @staticmethod
+    def get_auth_cookies():
+        """Use Puppeteer to authenticate and get cookies"""
+        # Create a temporary file for cookie storage
+        cookie_file = tempfile.NamedTemporaryFile(
+            mode="w", suffix=".json", delete=False
+        )
+        cookie_file.close()
+
+        # Run the Node.js auth helper. The JS file still lives under
+        # tests/api_tests_with_login/ — it's shared with other Puppeteer
+        # suites, so we reference it in place rather than duplicate.
+        auth_script = (
+            Path(__file__).parents[2]
+            / "api_tests_with_login"
+            / "auth_helper.js"
+        )
+        cmd = [
+            "node",
+            str(auth_script),
+            BASE_URL,
+            TEST_USERNAME,
+            TEST_PASSWORD,
+            cookie_file.name,
+        ]
+
+        try:
+            result = subprocess.run(
+                cmd, capture_output=True, text=True, timeout=90
+            )
+            if result.returncode != 0:
+                raise Exception(f"Auth failed: {result.stderr}")
+
+            # Read cookies from file
+            with open(cookie_file.name, "r") as f:
+                cookies = json.load(f)
+
+            # Convert to requests format
+            cookie_dict = {c["name"]: c["value"] for c in cookies}
+
+            # Extract CSRF token
+            csrf_token = None
+            for cookie in cookies:
+                if cookie["name"] == "csrf_token":
+                    csrf_token = cookie["value"]
+                    break
+
+            return cookie_dict, csrf_token
+
+        finally:
+            # Clean up temp file
+            if Path(cookie_file.name).exists():
+                os.unlink(cookie_file.name)
+
+
+@pytest.fixture(scope="session")
+def auth_session():
+    """Session-wide fixture for authenticated requests"""
+    cookies, csrf_token = AuthHelper.get_auth_cookies()
+
+    session = requests.Session()
+    session.cookies.update(cookies)
+    session.headers.update(
+        {"X-CSRFToken": csrf_token, "Accept": "application/json"}
+    )
+
+    yield session, csrf_token
+
+    session.close()
+
+
+@pytest.fixture
+def base_url():
+    """Fixture to provide base URL"""
+    return BASE_URL

tests/performance/api_auth/test_research_validation.py

@@ -0,0 +1,68 @@
+"""
+Test research API validation
+
+These tests require a running server instance and use Puppeteer for
+authentication. They are integration tests that cannot run in CI
+where no server is available.
+"""
+
+import pytest
+
+
+@pytest.mark.integration
+def test_research_without_required_fields(auth_session, base_url):
+    """Test validation of required fields"""
+    session, csrf_token = auth_session
+
+    # Only test truly invalid requests
+    # Note: Empty model is now allowed and uses defaults from database
+    invalid_requests = [
+        {},  # Empty request - missing query
+        {"model": "gemma3n:e2b"},  # Missing query
+        {"query": "", "model": "gemma3n:e2b"},  # Empty query
+    ]
+
+    for data in invalid_requests:
+        response = session.post(f"{base_url}/api/start_research", json=data)
+
+        assert response.status_code in [400, 422], (
+            f"Expected validation error for {data}, got {response.status_code}"
+        )
+        print(f"✓ Correctly rejected invalid request: {data}")
+
+    # Test that requests with query but no model are accepted (uses defaults)
+    valid_requests_with_defaults = [
+        {"query": "test"},  # Missing model - uses default
+        {"query": "test", "model": ""},  # Empty model - uses default
+    ]
+
+    for data in valid_requests_with_defaults:
+        response = session.post(f"{base_url}/api/start_research", json=data)
+
+        # Requests with query but missing/empty model should succeed (200 or research started)
+        assert response.status_code == 200, (
+            f"Expected success for {data}, got {response.status_code}"
+        )
+        print(f"✓ Correctly accepted request with default model: {data}")
+
+
+@pytest.mark.integration
+def test_research_requires_authentication(base_url):
+    """Test that research API requires authentication"""
+    import requests
+
+    # Try without any auth
+    response = requests.post(
+        f"{base_url}/api/start_research",
+        json={
+            "query": "test",
+            "model": "gemma3n:e2b",
+            "model_provider": "OLLAMA",
+        },
+    )
+
+    # Accept both 400 (bad request) and 401 (unauthorized) as both indicate the request was rejected
+    assert response.status_code in [400, 401], (
+        f"Expected 400 or 401 for unauthenticated request, got {response.status_code}"
+    )
+    print("✓ API correctly requires authentication")