test: fix 16 stale-test failures from the token-meter migration

CI was red with 16 failures across three test files — all
test-harness staleness from the token-meter work (T4/T5), not
production bugs. No production code changed.

- test_rate_limit.py: T5's login gate 401'd anonymous uploads
  before the rate-limiter ran. Apply the get_required_auth_tokens
  -> get_optional_auth_tokens override on the freshly-reloaded app
  inside _reload_app() (a module-level fixture would patch the
  stale pre-reload app object).
- test_error_handling_scenarios.py: same T5 gate 401'd LLM-route
  scenarios. Add the standard _satisfy_llm_route_auth autouse
  override; no scenario expects a 401 so nothing is masked.
- test_resume_quota_enforcement.py: T4 loosened resume_parses /
  resume_builder_sessions to UNLIMITED. Pin the pre-migration
  finite caps in _fresh_quota_backend, matching the cap-pinning
  in the sibling workspace/assistant quota-enforcement files.

The dedicated 401-gate coverage in test_llm_route_login_required.py
is untouched — no suite-wide override was added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: LEANDERANTONY

docs/DEVLOG.md

@@ -3675,3 +3675,56 @@ sections still dropped cleanly. `test_exporters.py` 37 passed;
 full suite 865 passed with the same 16 pre-existing failures in
 the rate-limit / quota / error-handling suites (confirmed
 identical on a clean baseline — unrelated to rendering).
+
+## Day 73: Fix 16 stale-test failures from the token-meter migration
+
+CI was red with 16 failures across three test files — all
+test-harness staleness from the token-meter work (T4/T5), not
+production bugs. No production code changed; the fixes are scoped
+to the three test files plus this entry.
+
+**`tests/test_rate_limit.py` (5 failures).** T5 made the
+resume-upload route require login via `get_required_auth_tokens`,
+so the anonymous uploads these tests fire returned 401 before the
+rate-limiter ran (expected 200/429). This file's `_reload_app()`
+helper reloads `backend.app` and binds the client to the
+freshly-built app object, so a module-level autouse fixture would
+patch the stale pre-reload app. Fixed by installing the
+`get_required_auth_tokens → get_optional_auth_tokens` override on
+`backend.app.app` inside `_reload_app()`, right before the
+`TestClient` is returned — so the rate-limiter decides the status.
+
+**`tests/test_error_handling_scenarios.py` (4 failures).** Same
+T5 gate: scenarios hitting LLM routes anonymously got 401 instead
+of 400/422, and one failed `KeyError: 'session_id'` because a 401
+body has no `session_id`. Scanned `_SCENARIOS` first — no scenario
+expects a 401 (the admin-refresh scenarios accept 401/403 but that
+route uses `get_optional_auth_tokens`, not the gated dependency),
+so a file-wide autouse override masks nothing. Added the standard
+`_satisfy_llm_route_auth` override fixture.
+
+**`tests/backend/test_resume_quota_enforcement.py` (7 failures).**
+All `DID NOT RAISE QuotaExceededError`. The gate is driven through
+the service layer directly here, so the 401 gate is not the cause —
+the real cause is T4 loosening `resume_parses` and
+`resume_builder_sessions` to UNLIMITED (`-1`) in `TIER_CAPS`, and
+this file lacked the cap-pinning autouse fixture its siblings have.
+Pinned the pre-migration finite caps in `_fresh_quota_backend`
+(`resume_parses` free 3 / pro 25 / business 100;
+`resume_builder_sessions` free 1 / pro 3 / business 15), matching
+the `tailored_applications` / `assistant_turns` pinning in
+`test_workspace_quota_enforcement` / `test_assistant_quota_enforcement`.
+
+The T5 401 gate's own coverage
+(`tests/backend/test_llm_route_login_required.py`) is untouched —
+no suite-wide conftest override was added, so its anonymous-401
+assertions still hold.
+
+Verification: the three files green (30 passed). Full suite in a
+CI-like environment (no `.env`) — 881 passed, 0 failed. With a
+populated local `.env`, two unrelated tests
+(`test_cached_jobs_store::test_search_calls_rpc_with_normalized_args`,
+`test_workspace_retention::test_sweep_with_no_service_role_client_logs_and_returns_zero`)
+fail because the dev `.env` sets `JOB_SEARCH_HYBRID_ENABLED=true`
+and `SUPABASE_SERVICE_ROLE_KEY`; both are green on CI (which ships
+no `.env`) and out of scope for this fix.

tests/backend/test_resume_quota_enforcement.py

@@ -63,6 +63,20 @@ def is_configured(self) -> bool:
             return False
 
     monkeypatch.setattr(quota, "_SUPABASE_BACKEND", _NeverConfigured())
+    # T4 of the token-meter migration loosened resume_parses and
+    # resume_builder_sessions to UNLIMITED in the production TIER_CAPS.
+    # The gate CODE in parse_resume_upload / start_resume_builder_session
+    # is still present and revertable ("not a hard swap"), so this file
+    # pins the pre-migration finite caps to verify that gate machinery
+    # still fires ("Nth call -> 429"). This mirrors the autouse cap-
+    # pinning in test_workspace_quota_enforcement (tailored_applications)
+    # and test_assistant_quota_enforcement (assistant_turns). The
+    # production cap POLICY (UNLIMITED) is asserted in test_tiers.py; the
+    # LIVE LLM gate for these routes is the unified llm_tokens meter.
+    for _tier, _cap in (("free", 3), ("pro", 25), ("business", 100)):
+        monkeypatch.setitem(quota.TIER_CAPS[_tier], "resume_parses", _cap)
+    for _tier, _cap in (("free", 1), ("pro", 3), ("business", 15)):
+        monkeypatch.setitem(quota.TIER_CAPS[_tier], "resume_builder_sessions", _cap)
     reset_in_memory_backend()
     yield
     reset_in_memory_backend()

tests/test_error_handling_scenarios.py

@@ -22,12 +22,31 @@
 from fastapi.testclient import TestClient
 
 from backend.app import app
+from backend.request_auth import get_optional_auth_tokens, get_required_auth_tokens
 from src.errors import AgentExecutionError, AppError
 
 
 client = TestClient(app)
 
 
+@pytest.fixture(autouse=True)
+def _satisfy_llm_route_auth():
+    """The token-meter migration (T5) made every LLM route require
+    login. These error-handling scenarios predate that gate and
+    exercise route ERROR behaviour (bad payloads, unknown sessions,
+    LLM failures), not the auth gate itself — most fire anonymously.
+    Overriding ``get_required_auth_tokens`` with
+    ``get_optional_auth_tokens`` restores pre-T5 behaviour: real
+    tokens when auth headers are present, ``(None, None)`` when
+    absent, never a 401 — so the validation/error paths under test
+    are reached. None of the scenarios in ``_SCENARIOS`` expects a
+    401, so a file-wide override masks nothing. The 401 gate itself
+    is covered by ``tests/backend/test_llm_route_login_required.py``."""
+    app.dependency_overrides[get_required_auth_tokens] = get_optional_auth_tokens
+    yield
+    app.dependency_overrides.pop(get_required_auth_tokens, None)
+
+
 # ---------------------------------------------------------------------------
 # Friendliness assertions — what counts as "leaky"?
 # ---------------------------------------------------------------------------

tests/test_rate_limit.py

@@ -28,20 +28,44 @@ def _reload_app(monkeypatch: pytest.MonkeyPatch, override: str = "2/minute"):
     Returns a fresh TestClient bound to a freshly-decorated app.
     Reloads in dependency order so the decorators see the new
     LIMIT_* constants.
+
+    The token-meter migration (T5) made every LLM route — including
+    the resume-upload endpoint these rate-limit tests fire — require
+    login via the ``get_required_auth_tokens`` dependency. Anonymous
+    requests now 401 BEFORE the rate-limiter runs, which would mask
+    the 200/429 behaviour under test. Because this helper RELOADS
+    ``backend.app`` and returns a client bound to the freshly-built
+    app object, the auth-override has to be installed on THAT object
+    (a module-level autouse fixture would patch the stale pre-reload
+    app). Overriding ``get_required_auth_tokens`` with
+    ``get_optional_auth_tokens`` restores pre-T5 behaviour — real
+    tokens when auth headers/cookies are present, ``(None, None)``
+    when absent, never a 401 — so the rate-limiter is what decides
+    the status code. The 401 gate itself is covered by
+    ``tests/backend/test_llm_route_login_required.py``.
     """
     monkeypatch.setenv("RATE_LIMIT_OVERRIDE", override)
 
     import backend.rate_limit
     import backend.routers.workspace
     import backend.routers.jobs
     import backend.app
+    from backend.request_auth import (
+        get_optional_auth_tokens,
+        get_required_auth_tokens,
+    )
 
     # Reload bottom-up so decorators on routes pick up new limits.
     importlib.reload(backend.rate_limit)
     importlib.reload(backend.routers.workspace)
     importlib.reload(backend.routers.jobs)
     importlib.reload(backend.app)
 
+    # Apply the auth-override to the FRESHLY-reloaded app object.
+    backend.app.app.dependency_overrides[get_required_auth_tokens] = (
+        get_optional_auth_tokens
+    )
+
     return TestClient(backend.app.app)