test: add API integration suite, fixtures, and frontend unit tests (#40)

* test: add API integration suite, fixtures, and frontend unit tests

* test: add integration and frontend test suite with search limit validation

* test: address PR review — shared fixtures, coverage, hygiene

Extract Flask client fixtures to tests/conftest.py, use client_single
for search limit tests, and relax session count assertion to >= 1.
Include utils/ in coverage (omit untested export modules), stop
tracking .coverage, and align integration-tests CI with full cov scope.

Co-Authored-By: Cursor <cursoragent@cursor.com>

* test: address timon0305 PR review feedback

Add client_empty and client_thinking fixtures, exercise thinking
blocks via session detail API, preserve ValueError cause in _parse_limit,
and remove .coverage from git tracking (already in .gitignore).

Co-authored-by: Cursor <cursoragent@cursor.com>

* Updating the assertion to be order-independent

* test: collapse conftest fixtures and use real DOMPurify in JS tests

Extract _make_test_client() for shared Flask client seeding. Run
markdown XSS tests against dompurify/marked dev deps (CDN versions)
instead of a regex mock sanitize implementation.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: clean6378-max-it

.github/workflows/ci.yml

@@ -14,10 +14,14 @@ jobs:
   prod-install-smoke:
     name: Verify prod requirements.txt is sufficient
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
           cache: pip
@@ -41,10 +45,14 @@ jobs:
 
   pytest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
           cache: pip
@@ -79,3 +87,52 @@ jobs:
 
       - name: Run mypy on tests (non-strict smoke)
         run: mypy tests --config-file mypy-tests.ini --follow-imports skip
+
+  integration-tests:
+    name: API integration tests + coverage
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+
+      - name: Install dev dependencies
+        run: pip install -r requirements-dev.txt
+
+      # Subset run: skip fail-under (full suite enforces 60% in pytest job).
+      - name: Run integration tests with coverage
+        run: pytest tests/test_api_integration.py tests/test_search.py -v --cov=api --cov=utils --cov-report=xml --cov-fail-under=0
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: coverage-report
+          path: coverage.xml
+
+  js-tests:
+    name: Frontend unit tests (vitest)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "20"
+          cache: npm
+
+      - run: npm ci
+      - run: npm test

.gitignore

@@ -10,3 +10,7 @@ build/
 .vscode/
 *.swp
 *.swo
+node_modules/
+.coverage
+coverage/
+coverage.xml

api/search.py

@@ -13,19 +13,20 @@
 search_bp = Blueprint("search", __name__)
 
 _DEFAULT_LIMIT = 50
+_MAX_LIMIT = 500
 
 
 def _parse_limit(raw: str | None, default: int = _DEFAULT_LIMIT) -> int:
     """Parse a positive integer limit from a query string value."""
     if raw is None or raw.strip() == "":
         return default
     try:
-        value = int(raw)
-    except ValueError:
-        raise ValueError("Invalid limit: must be a positive integer") from None
+        value = int(raw.strip())
+    except ValueError as exc:
+        raise ValueError("Invalid limit: must be a positive integer") from exc
     if value < 1:
         raise ValueError("Invalid limit: must be a positive integer")
-    return value
+    return min(value, _MAX_LIMIT)
 
 
 @search_bp.route("/api/search")