test: fix latent failures + reconcile k8s tests with main; RBAC/e2e/CodeQL coverage

k8s: k8s_exceptions rename, Job-release parallelism contract, extension-
registration order-independence, CLI event-loop deadlock (await main not
asyncio.run). Telemetry OTel proxy deadlock; env-var pollution; stale env-setup
+ auth-performance fixtures; SSE-stream 300s-timeout. New get_current_user RBAC
tests (viewer-when-disabled, fail-closed); e2e authorized via dependency_overrides
+ args._container; _StickyOverridesDict __eq__ (CodeQL).

Author: fgogolli

tests/e2e/test_cli_integration.py

@@ -31,8 +31,7 @@ def create_config_file(self, config_data):
         return self.config_path
 
     @pytest.mark.asyncio
-    @patch("orb.interface.system_command_handlers.get_container")
-    async def test_get_provider_config_cli_e2e(self, mock_get_container):
+    async def test_get_provider_config_cli_e2e(self):
         """Test getProviderConfig CLI operation end-to-end."""
         # Setup mocks
         mock_container = Mock()
@@ -50,12 +49,13 @@ async def mock_execute(_query):
         mock_orchestrator = Mock()
         mock_orchestrator.execute = mock_execute
         mock_container.get.return_value = mock_orchestrator
-        mock_get_container.return_value = mock_container
 
         # Test async function-based handler
         from orb.interface.command_handlers import handle_provider_config
 
+        # Handlers resolve the DI container from args._container.
         mock_command = Mock()
+        mock_command._container = mock_container
 
         result = await handle_provider_config(mock_command)
 
@@ -96,8 +96,7 @@ async def test_validate_provider_config_cli_e2e(self, mock_register_services):
         assert "provider configuration" in result["message"].lower()
 
     @pytest.mark.asyncio
-    @patch("orb.interface.system_command_handlers.get_container")
-    async def test_reload_provider_config_cli_e2e(self, mock_get_container):
+    async def test_reload_provider_config_cli_e2e(self):
         """Test reloadProviderConfig CLI operation end-to-end."""
         from orb.application.dto.interface_response import InterfaceResponse
         from orb.application.services.provider_registry_service import ProviderRegistryService
@@ -125,12 +124,13 @@ def container_get(cls):
             return Mock()
 
         mock_container.get.side_effect = container_get
-        mock_get_container.return_value = mock_container
 
         # Test async function-based handler
         from orb.interface.command_handlers import handle_reload_provider_config
 
+        # Handlers resolve the DI container from args._container.
         mock_command = Mock()
+        mock_command._container = mock_container
         mock_command.config_path = self.config_path
         mock_command.file = None
         mock_command.data = None

tests/e2e/test_critical_path_e2e.py

@@ -18,9 +18,11 @@
 from fastapi.testclient import TestClient
 
 from orb.api.dependencies import (
+    CurrentUser,
     get_acquire_machines_orchestrator,
     get_command_bus,
     get_create_template_orchestrator,
+    get_current_user,
     get_get_template_orchestrator,
     get_health_check_port,
     get_list_machines_orchestrator,
@@ -36,6 +38,41 @@
 from orb.config.schemas.server_schema import AuthConfig, ServerConfig
 from orb.infrastructure.di.buses import CommandBus, QueryBus
 
+
+def _admin_user() -> CurrentUser:
+    """Return an admin CurrentUser for dependency override in e2e tests."""
+    return CurrentUser(username="test-admin", role="admin", claims={})
+
+
+class _StickyOverridesDict(dict):
+    """dict subclass that re-inserts a set of 'sticky' entries after every
+    ``clear()``.  Used so that auth overrides survive the per-step
+    ``app.dependency_overrides.clear()`` calls in lifecycle tests.
+    """
+
+    def __init__(self, sticky: dict, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self._sticky = sticky
+        self.update(sticky)
+
+    def clear(self):
+        super().clear()
+        self.update(self._sticky)
+
+    def __eq__(self, other: object) -> bool:
+        # Include _sticky in equality so the added attribute is not ignored
+        # (CodeQL py/missing-equals). Two sticky dicts are equal when both
+        # their contents and their sticky sets match; comparison with a plain
+        # mapping falls back to dict contents for normal interoperability.
+        if isinstance(other, _StickyOverridesDict):
+            return dict.__eq__(self, other) and self._sticky == other._sticky
+        if isinstance(other, dict):
+            return dict.__eq__(self, other)
+        return NotImplemented
+
+    __hash__ = None  # type: ignore[assignment]  # mutable mapping is unhashable
+
+
 # ---------------------------------------------------------------------------
 # Shared helpers and fixtures
 # ---------------------------------------------------------------------------
@@ -59,7 +96,15 @@ def _make_command_bus(return_value: Any = None) -> AsyncMock:
 
 @pytest.fixture
 def app():
-    return create_fastapi_app(_server_config())
+    _app = create_fastapi_app(_server_config())
+    # Auth is disabled in the test server config, so get_current_user would
+    # resolve to viewer (least privilege).  Replace dependency_overrides with a
+    # sticky-dict subclass that re-inserts the auth override after every
+    # .clear() call.  This lets multi-step lifecycle tests reset their
+    # orchestrator overrides between steps without losing the admin identity.
+    sticky = {get_current_user: _admin_user}
+    _app.dependency_overrides = _StickyOverridesDict(sticky)
+    return _app
 
 
 @pytest.fixture
@@ -373,6 +418,8 @@ def test_list_templates_returns_empty_list(self, app, client: TestClient):
         """GET /api/v1/templates/ returns empty list when no templates exist."""
         mock_result = Mock()
         mock_result.templates = []
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 
@@ -401,6 +448,8 @@ def test_list_templates_returns_templates(self, app, client: TestClient):
         )
         mock_result = Mock()
         mock_result.templates = [mock_template]
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 
@@ -647,6 +696,8 @@ def test_list_templates_with_provider_api_filter(self, app, client: TestClient):
         )
         mock_result = Mock()
         mock_result.templates = [mock_template]
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 
@@ -757,6 +808,8 @@ def test_list_machines_endpoint_exists(self, app, client: TestClient):
         """GET /api/v1/machines/ endpoint is reachable and returns results."""
         mock_result = Mock()
         mock_result.machines = []
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 

tests/performance/test_auth_performance.py

@@ -21,10 +21,12 @@ def no_auth_client(self):
         from unittest.mock import MagicMock
 
         from orb.api.dependencies import get_health_check_port
+        from orb.config.schemas.server_schema import RateLimitConfig
 
         server_config = ServerConfig(  # type: ignore[call-arg]
             enabled=True,
             auth=AuthConfig(enabled=False, strategy="replace"),  # type: ignore[call-arg]
+            rate_limiting=RateLimitConfig(enabled=False),
         )
         app = create_fastapi_app(server_config)
         mock_health_port = MagicMock()
@@ -35,6 +37,11 @@ def no_auth_client(self):
     @pytest.fixture
     def auth_client_and_token(self):
         """Client with authentication and valid token."""
+        from unittest.mock import MagicMock
+
+        from orb.api.dependencies import get_health_check_port
+        from orb.config.schemas.server_schema import RateLimitConfig
+
         server_config = ServerConfig(  # type: ignore[call-arg]
             enabled=True,
             auth=AuthConfig(  # type: ignore[call-arg]
@@ -45,8 +52,12 @@ def auth_client_and_token(self):
                     "algorithm": "HS256",
                 },
             ),
+            rate_limiting=RateLimitConfig(enabled=False),
         )
         app = create_fastapi_app(server_config)
+        mock_health_port = MagicMock()
+        mock_health_port.get_status.return_value = {"status": "healthy"}
+        app.dependency_overrides[get_health_check_port] = lambda: mock_health_port
         client = TestClient(app)
 
         # Create valid token