test: 7 agents — plugins ~158 tests, extractor 98-100%, dashboard routes 99-100%, git services 94-100%, services 94-100%, dataset_review 100%. Fix test_api_key_routes.py sys.modules pollution

backend/tests/api/test_admin.py

@@ -222,6 +222,65 @@ class TestUpdateUser:
             resp = client.put("/api/admin/users/user-999", json={"email": "x@y.com"})
         assert resp.status_code == 404
 
+    def test_update_user_password_and_active(self):
+        """Update with password and is_active covers lines 125, 127."""
+        from src.core.database import get_auth_db
+        mock_session = MagicMock()
+        mock_repo = MagicMock()
+        existing_user = MagicMock()
+        existing_user.id = "user-1"
+        existing_user.username = "testuser"
+        existing_user.email = "old@example.com"
+        existing_user.is_active = False
+        existing_user.auth_source = "LOCAL"
+        existing_user.created_at = __import__("datetime").datetime.now()
+        existing_user.roles = []
+        mock_repo.get_user_by_id.return_value = existing_user
+
+        with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
+            client = _make_client({get_auth_db: lambda: mock_session})
+            resp = client.put("/api/admin/users/user-1", json={
+                "password": "NewStrongPass1",
+                "is_active": False,
+            })
+        assert resp.status_code == 200
+        assert existing_user.is_active is False
+        mock_session.commit.assert_called_once()
+
+    def test_update_user_with_roles(self):
+        """Update with roles list covers lines 130-134."""
+        from src.core.database import get_auth_db
+        mock_session = MagicMock()
+        mock_repo = MagicMock()
+        existing_user = MagicMock()
+        existing_user.id = "user-1"
+        existing_user.username = "testuser"
+        existing_user.email = "old@example.com"
+        existing_user.is_active = True
+        existing_user.auth_source = "LOCAL"
+        existing_user.created_at = __import__("datetime").datetime.now()
+        existing_user.roles = []
+        mock_repo.get_user_by_id.return_value = existing_user
+
+        def _get_role_by_name(name):
+            role = MagicMock()
+            role.id = f"role-{name}"
+            role.name = name
+            role.description = "A role"
+            role.permissions = []
+            return role
+
+        mock_repo.get_role_by_name.side_effect = _get_role_by_name
+
+        with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
+            client = _make_client({get_auth_db: lambda: mock_session})
+            resp = client.put("/api/admin/users/user-1", json={
+                "roles": ["Editor"],
+            })
+        assert resp.status_code == 200
+        assert len(existing_user.roles) == 1
+        mock_session.commit.assert_called_once()
+
 
 class TestDeleteUser:
     """DELETE /api/admin/users/{user_id}"""
@@ -322,6 +381,36 @@ class TestCreateRole:
         assert resp.status_code == 400
         assert "Role already exists" in resp.text
 
+    def test_create_role_with_string_permission(self):
+        """Create role with resource:action string permission (covers lines 220-221)."""
+        mock_session = MagicMock()
+        mock_session.query.return_value.filter.return_value.first.return_value = None
+        mock_repo = MagicMock()
+        # get_permission_by_id returns None -> falls through to split
+        mock_repo.get_permission_by_id.return_value = None
+        mock_perm = MagicMock()
+        mock_perm.id = "perm-resolved"
+        mock_perm.resource = "users"
+        mock_perm.action = "read"
+        mock_repo.get_permission_by_resource_action.return_value = mock_perm
+
+        def _refresh_side_effect(obj):
+            obj.id = "new-role-id"
+
+        mock_session.refresh.side_effect = _refresh_side_effect
+
+        with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
+            from src.core.database import get_auth_db
+            client = _make_client({get_auth_db: lambda: mock_session})
+            resp = client.post("/api/admin/roles", json={
+                "name": "Editor",
+                "description": "Can edit",
+                "permissions": ["users:read"],
+            })
+        assert resp.status_code == 201
+        mock_repo.get_permission_by_resource_action.assert_called_once_with("users", "read")
+        mock_session.add.assert_called_once()
+
 
 class TestUpdateRole:
     """PUT /api/admin/roles/{role_id}"""
@@ -357,6 +446,61 @@ class TestUpdateRole:
             resp = client.put("/api/admin/roles/role-999", json={"name": "Ghost"})
         assert resp.status_code == 404
 
+    def test_update_role_with_permissions(self):
+        """Update role with permission changes (covers lines 261-269)."""
+        mock_session = MagicMock()
+        mock_repo = MagicMock()
+        existing_role = MagicMock()
+        existing_role.id = "role-1"
+        existing_role.name = "OldName"
+        existing_role.description = "Old desc"
+        existing_role.permissions = []
+        mock_repo.get_role_by_id.return_value = existing_role
+        mock_perm = MagicMock()
+        mock_perm.id = "perm-1"
+        mock_perm.resource = "test"
+        mock_perm.action = "read"
+        mock_repo.get_permission_by_id.return_value = mock_perm
+
+        with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
+            from src.core.database import get_auth_db
+            client = _make_client({get_auth_db: lambda: mock_session})
+            resp = client.put("/api/admin/roles/role-1", json={
+                "name": "Updated",
+                "permissions": ["perm-1"],
+            })
+        assert resp.status_code == 200
+        assert existing_role.name == "Updated"
+        assert len(existing_role.permissions) == 1
+
+    def test_update_role_with_string_permissions(self):
+        """Update role with resource:action permission strings (covers lines 261-269 fallback)."""
+        mock_session = MagicMock()
+        mock_repo = MagicMock()
+        existing_role = MagicMock()
+        existing_role.id = "role-1"
+        existing_role.name = "OldName"
+        existing_role.description = "Old desc"
+        existing_role.permissions = []
+        mock_repo.get_role_by_id.return_value = existing_role
+        # get_permission_by_id returns None -> falls through
+        mock_repo.get_permission_by_id.return_value = None
+        mock_perm = MagicMock()
+        mock_perm.id = "perm-resolved"
+        mock_perm.resource = "users"
+        mock_perm.action = "write"
+        mock_repo.get_permission_by_resource_action.return_value = mock_perm
+
+        with patch("src.api.routes.admin.AuthRepository", return_value=mock_repo):
+            from src.core.database import get_auth_db
+            client = _make_client({get_auth_db: lambda: mock_session})
+            resp = client.put("/api/admin/roles/role-1", json={
+                "name": "Updated",
+                "permissions": ["users:write"],
+            })
+        assert resp.status_code == 200
+        mock_repo.get_permission_by_resource_action.assert_called_once_with("users", "write")
+
 
 class TestDeleteRole:
     """DELETE /api/admin/roles/{role_id}"""