chore: import upstream snapshot with attribution

tests/security/test_security_init_deep_coverage.py

@@ -0,0 +1,173 @@
+"""Deep coverage tests for security/__init__.py.
+
+The __init__.py conditionally imports several optional components:
+- PathValidator (requires werkzeug)
+- FileUploadValidator (requires pdfplumber)
+
+Tests cover:
+- All required imports are present
+- Conditional flag values
+- __all__ completeness
+- Individual security re-exports callable/usable
+"""
+
+MODULE = "local_deep_research.security"
+
+
+class TestRequiredImportsAlwaysPresent:
+    """These symbols must always be importable regardless of optional deps."""
+
+    def test_sanitize_data_present(self):
+        from local_deep_research.security import sanitize_data
+
+        assert callable(sanitize_data)
+
+    def test_redact_data_present(self):
+        from local_deep_research.security import redact_data
+
+        assert callable(redact_data)
+
+    def test_filter_research_metadata_present(self):
+        from local_deep_research.security import filter_research_metadata
+
+        assert callable(filter_research_metadata)
+
+    def test_safe_get_present(self):
+        from local_deep_research.security import safe_get
+
+        assert callable(safe_get)
+
+    def test_safe_post_present(self):
+        from local_deep_research.security import safe_post
+
+        assert callable(safe_post)
+
+    def test_validate_url_present(self):
+        from local_deep_research.security import validate_url
+
+        assert callable(validate_url)
+
+    def test_is_ip_blocked_present(self):
+        from local_deep_research.security import is_ip_blocked
+
+        assert callable(is_ip_blocked)
+
+    def test_get_account_lockout_manager_present(self):
+        from local_deep_research.security import get_account_lockout_manager
+
+        assert callable(get_account_lockout_manager)
+
+    def test_sanitize_for_log_present(self):
+        from local_deep_research.security import sanitize_for_log
+
+        assert callable(sanitize_for_log)
+
+    def test_strip_control_chars_present(self):
+        from local_deep_research.security import strip_control_chars
+
+        assert callable(strip_control_chars)
+
+    def test_get_safe_module_class_present(self):
+        from local_deep_research.security import get_safe_module_class
+
+        assert callable(get_safe_module_class)
+
+    def test_module_not_allowed_error_present(self):
+        from local_deep_research.security import ModuleNotAllowedError
+
+        assert issubclass(ModuleNotAllowedError, Exception)
+
+    def test_allowed_modules_present(self):
+        from local_deep_research.security import ALLOWED_MODULES
+
+        assert isinstance(ALLOWED_MODULES, (set, frozenset, dict, list))
+
+    def test_get_safe_url_present(self):
+        from local_deep_research.security import get_safe_url
+
+        assert callable(get_safe_url)
+
+    def test_strip_settings_snapshot_present(self):
+        from local_deep_research.security import strip_settings_snapshot
+
+        assert callable(strip_settings_snapshot)
+
+    def test_get_security_default_present(self):
+        from local_deep_research.security import get_security_default
+
+        assert callable(get_security_default)
+
+    def test_notification_url_validation_error_present(self):
+        from local_deep_research.security import NotificationURLValidationError
+
+        assert issubclass(NotificationURLValidationError, Exception)
+
+
+class TestConditionalFlags:
+    def test_has_path_validator_flag_is_bool(self):
+        import local_deep_research.security as sec
+
+        assert isinstance(sec._has_path_validator, bool)
+
+    def test_has_file_upload_validator_flag_is_bool(self):
+        import local_deep_research.security as sec
+
+        assert isinstance(sec._has_file_upload_validator, bool)
+
+    def test_path_validator_is_class_or_none(self):
+        from local_deep_research.security import PathValidator
+
+        assert PathValidator is None or isinstance(PathValidator, type)
+
+    def test_file_upload_validator_is_class_or_none(self):
+        from local_deep_research.security import FileUploadValidator
+
+        assert FileUploadValidator is None or isinstance(
+            FileUploadValidator, type
+        )
+
+    def test_path_validator_flag_consistent_with_object(self):
+        import local_deep_research.security as sec
+
+        if sec._has_path_validator:
+            assert sec.PathValidator is not None
+        else:
+            assert sec.PathValidator is None
+
+
+class TestDunderAll:
+    def test_all_is_list(self):
+        import local_deep_research.security as sec
+
+        assert isinstance(sec.__all__, list)
+
+    def test_all_contains_key_symbols(self):
+        import local_deep_research.security as sec
+
+        must_have = {
+            "DataSanitizer",
+            "sanitize_data",
+            "safe_get",
+            "safe_post",
+            "validate_url",
+            "PasswordValidator",
+            "AccountLockoutManager",
+            "sanitize_for_log",
+            "PathValidator",
+            "SecurityHeaders",
+            "URLValidator",
+        }
+        for sym in must_have:
+            assert sym in sec.__all__, f"{sym} missing from __all__"
+
+    def test_all_symbols_defined_as_attributes(self):
+        """Every symbol in __all__ must be defined as an attribute (may be None)."""
+        import local_deep_research.security as sec
+
+        for name in sec.__all__:
+            assert hasattr(sec, name), f"{name} in __all__ but not defined"
+
+    def test_no_duplicates_in_all(self):
+        import local_deep_research.security as sec
+
+        assert len(sec.__all__) == len(set(sec.__all__))