Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_recovery_audit_integrity_rc.py

@@ -38,10 +38,21 @@ from modelforge_api.services.audit import (
 )
 from modelforge_api.services.recovery import RecoveryError, RecoveryService
 from modelforge_api.services.recovery_fingerprint import (
+    ALERT_NOTIFICATION_TABLES,
+    CREATIVE_TABLES,
     CURRENT_TRUTH_TABLES,
     FINGERPRINT_VERSION,
+    LAB_EXECUTION_TABLES,
     LEGACY_FINGERPRINT_VERSION,
+    MANAGED_ACTIVATION_TABLE,
+    MANAGED_IDENTITY_TABLES,
     MAX_ROWS_PER_TABLE,
+    MODEL_CHANGE_TABLES,
+    MODEL_UPDATE_TABLES,
+    PORTFOLIO_TABLES,
+    SECRET_CURRENT_TABLES,
+    SECRET_TABLES,
+    SELECTED_COMPARISON_TABLES,
     _canonical_row,
     _table_digest,
     audit_fingerprint_differences_are_compatible,
@@ -334,6 +345,31 @@ def test_valid_resume_checks_chain_before_returning_already_applied(
     assert engine.operations.index("query_rows") < engine.operations.index("scalar")
 
 
+@pytest.mark.parametrize("table_exists", [False, True])
+def test_reconciliation_clears_only_present_model_watch_claims(
+    session: Session, tmp_path: Path, monkeypatch: pytest.MonkeyPatch, table_exists: bool,
+) -> None:
+    subject = _service(session, tmp_path)
+    sql_seen: list[str] = []
+    def scalar(target: object, sql: str) -> str:
+        sql_seen.append(sql)
+        if "table_name='model_update_watches'" in sql:
+            return "1" if table_exists else "0"
+        if "select count(*) from model_update_watches" in sql:
+            return "2"
+        return "" if "string_agg" in sql else "0"
+    monkeypatch.setattr(subject.engine, "scalar", scalar)
+    monkeypatch.setattr(subject, "_verify_restored_audit_chain", lambda target: {})
+    monkeypatch.setattr(subject, "_append_restored_audit_marker", lambda *args, **kwargs: None)
+    record = SimpleNamespace(id=uuid.uuid4())
+    plan = SimpleNamespace(database_destination="postgresql://modelforge:test@postgres:5432/restored",
+                           backup_set=SimpleNamespace(backup_id="watch-recovery"))
+    result = subject._reconcile_restored(record, plan)
+    assert ("update model_update_watches set check_token=NULL, check_until=NULL" in sql_seen) is table_exists
+    assert result["cleared_current_truth"].get("model_update_watch_claims", 0) == (2 if table_exists else 0)
+    assert not any("delete from model_update" in sql for sql in sql_seen)
+
+
 def test_corruption_is_an_independent_ready_gate_before_fingerprints(
     session: Session, tmp_path: Path
 ) -> None:
@@ -506,7 +542,8 @@ def _fingerprint(
     *,
     include_checkpoint: bool,
 ) -> dict[str, object]:
-    table_names = set(classified_tables())
+    # These fixtures model schema 0022/0024, before online identities and secrets.
+    table_names = set(classified_tables()) - ALERT_NOTIFICATION_TABLES - PORTFOLIO_TABLES - MODEL_CHANGE_TABLES - CREATIVE_TABLES - SELECTED_COMPARISON_TABLES - MODEL_UPDATE_TABLES - SECRET_TABLES - MANAGED_IDENTITY_TABLES - LAB_EXECUTION_TABLES - {"configuration_state", "configuration_revisions", "project_onboarding"}
     if not include_checkpoint:
         table_names.remove("audit_chain_heads")
     tables: dict[str, object] = {
@@ -536,7 +573,7 @@ def _fingerprint(
         "tables": tables,
         "digest": hashlib.sha256(version.encode()).hexdigest(),
         "groups": {},
-        "physical_tables": sorted(table_names | CURRENT_TRUTH_TABLES),
+        "physical_tables": sorted(table_names | (CURRENT_TRUTH_TABLES - SECRET_CURRENT_TABLES - {MANAGED_ACTIVATION_TABLE})),
         "unexpected_tables": [],
     }
 
@@ -548,7 +585,9 @@ def _with_legitimate_reconciliation_delta(
     restored["version"] = FINGERPRINT_VERSION
     restored["digest"] = "f" * 64
     restored["unexpected_tables"] = []
-    restored["physical_tables"] = sorted(classified_tables() | CURRENT_TRUTH_TABLES)
+    restored["physical_tables"] = sorted(
+        (classified_tables() - ALERT_NOTIFICATION_TABLES - PORTFOLIO_TABLES - MODEL_CHANGE_TABLES - CREATIVE_TABLES - SELECTED_COMPARISON_TABLES - MODEL_UPDATE_TABLES - SECRET_TABLES - MANAGED_IDENTITY_TABLES - LAB_EXECUTION_TABLES - {"configuration_state", "configuration_revisions", "project_onboarding"}) | (CURRENT_TRUTH_TABLES - SECRET_CURRENT_TABLES - {MANAGED_ACTIVATION_TABLE})
+    )
     tables = restored["tables"]
     assert isinstance(tables, dict)
     tables["audit_events"] = {