fix: address PR review nits for frontend test suite

Rename the misnamed CSRF browser test, drop the duplicate jinja context
assertion from test_templates, document the autouse org fixture, and use
None with explicit org_id override in GET page cases.

Author: chriscarrollsmith

tests/browser/test_browser_csrf.py

@@ -72,7 +72,7 @@ def test_htmx_login_with_valid_csrf_succeeds(browser, live_server_csrf: str):
     context.close()
 
 
-def test_org_htmx_action_requires_csrf_header(browser, live_server_csrf: str):
+def test_forgot_password_without_csrf_shows_error_toast(browser, live_server_csrf: str):
     context = browser.new_context(viewport={"width": 1280, "height": 720})
     page = context.new_page()
     page.goto(f"{live_server_csrf}/account/forgot_password")

tests/test_get_pages_jinja_integration.py

@@ -22,14 +22,16 @@ def _url(name: str, **path_params) -> str:
 class GetPageCase:
     id: str
     client_fixture: str
-    path_factory: Callable[[], str]
+    path_factory: Callable[[], str | None]
     marker: str | None = None
     jinja_route: str | None = None
     expected_status: int = 200
 
 
 GET_PAGE_CASES = [
-    GetPageCase("home", "unauth_client", lambda: _url("read_home"), jinja_route="read_home"),
+    GetPageCase(
+        "home", "unauth_client", lambda: _url("read_home"), jinja_route="read_home"
+    ),
     GetPageCase(
         "login", "unauth_client", lambda: _url("read_login"), jinja_route="read_login"
     ),
@@ -68,14 +70,14 @@ class GetPageCase:
     GetPageCase(
         "organization_owner",
         "auth_client_owner",
-        lambda: _url("read_organization", org_id=0),
+        lambda: None,
         marker="Create Role",
         jinja_route="read_organization",
     ),
     GetPageCase(
         "organization_member",
         "auth_client_member",
-        lambda: _url("read_organization", org_id=0),
+        lambda: None,
         marker="Members",
         jinja_route="read_organization",
     ),
@@ -99,7 +101,8 @@ def _setup_org_owner(
         test_organization,
         org_owner,
     ):
-        """Ensure org-scoped clients have a membership relationship loaded."""
+        # No setup body: autouse only so test_organization and org_owner run before
+        # org-scoped client fixtures (auth_client_owner, auth_client_member).
         del request, test_organization, org_owner
 
     def test_static_context_analysis_passes(self, missing_context_variables):
@@ -139,7 +142,7 @@ def test_get_page_renders(
         assert not missing_context_variables
         client = request.getfixturevalue(case.client_fixture)
         path = case.path_factory()
-        if "organization" in case.id:
+        if path is None:
             assert test_organization.id is not None
             path = _url("read_organization", org_id=test_organization.id)
         response = client.get(path)
@@ -215,7 +218,7 @@ class TestGetPagesRequireAuth:
         [
             ("unauth_client", lambda: _url("read_dashboard")),
             ("unauth_client", lambda: _url("read_profile")),
-            ("unauth_client", lambda: _url("read_organization", org_id=1)),
+            ("unauth_client", lambda: None),
         ],
         ids=["dashboard", "profile", "organization"],
     )
@@ -228,7 +231,7 @@ def test_unauthenticated_redirects_to_login(
     ):
         client = request.getfixturevalue(client_fixture)
         path = path_factory()
-        if "organization" in request.node.callspec.id:
+        if path is None:
             assert test_organization.id is not None
             path = _url("read_organization", org_id=test_organization.id)
         response = client.get(path)

tests/test_templates.py

@@ -14,11 +14,6 @@ def test_no_hardcoded_routes(hardcoded_routes):
     assert not hardcoded_routes, hardcoded_routes
 
 
-def test_no_missing_context_variables(missing_context_variables):
-    """Test that routes pass all required variables to their templates."""
-    assert not missing_context_variables, missing_context_variables
-
-
 def test_valid_endpoints(validate_endpoints):
     """Test that url_for() calls in templates reference valid FastAPI endpoints."""
     from main import app