test: cover erasure error paths and wiring selectors

PyMongoError propagation on the erasure repo methods, filter shapes on
the satellite delete_many delegates, and build_account_erasure_service
composition (noop/mock vs configured edge+R2+CF branches). Covers all
diff lines except the two inside the worker's _build_runtime.

Author: Zingzy

tests/unit/repositories/test_erasure_deletes.py

@@ -0,0 +1,36 @@
+"""Account-erasure bulk deletes on the satellite repositories.
+
+Each is a one-line ``_delete_many`` delegate; what matters is the filter
+key — a wrong key silently erases nothing (or worse, everything).
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from repositories.page_layout_repository import PageLayoutRepository
+from repositories.webhook_delivery_repository import WebhookDeliveryRepository
+from repositories.webhook_endpoint_repository import WebhookEndpointRepository
+from repositories.webhook_event_repository import WebhookEventRepository
+
+from .conftest import USER_OID, make_collection
+
+
+@pytest.mark.parametrize(
+    ("repo_cls", "method", "filter_key"),
+    [
+        (PageLayoutRepository, "delete_by_user", "user_id"),
+        (WebhookEndpointRepository, "delete_by_user", "user_id"),
+        (WebhookDeliveryRepository, "delete_by_user", "user_id"),
+        (WebhookEventRepository, "delete_by_owner", "owner_id"),
+    ],
+)
+@pytest.mark.asyncio
+async def test_erasure_delete_filters_on_the_user(repo_cls, method, filter_key):
+    col = make_collection()
+    col.delete_many = AsyncMock(return_value=MagicMock(deleted_count=5))
+    count = await getattr(repo_cls(col), method)(USER_OID)
+    col.delete_many.assert_awaited_once_with({filter_key: USER_OID})
+    assert count == 5

tests/unit/repositories/test_feature_flag_repository.py

@@ -7,6 +7,7 @@
 
 import pytest
 from bson import ObjectId
+from pymongo.errors import PyMongoError
 
 from .conftest import make_collection
 
@@ -115,3 +116,12 @@ async def test_pulls_id_and_both_email_casings_from_every_flag(self):
             },
         )
         assert count == 2
+
+    @pytest.mark.asyncio
+    async def test_propagates_pymongo_error(self):
+        col = make_collection()
+        col.update_many = AsyncMock(side_effect=PyMongoError("conn lost"))
+        with pytest.raises(PyMongoError):
+            await self._repo(col).pull_allowlisted(
+                ObjectId("aaaaaaaaaaaaaaaaaaaaaaaa"), "user@example.com"
+            )

tests/unit/repositories/test_report_repository.py

@@ -0,0 +1,54 @@
+"""Unit tests for the report repositories' account-erasure surface."""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+from pymongo.errors import PyMongoError
+
+from repositories.report_repository import (
+    ReportRepository,
+    ReportSubmissionRepository,
+)
+
+from .conftest import USER_OID, make_collection
+
+
+class TestPullReporter:
+    @pytest.mark.asyncio
+    async def test_pulls_reporter_id_from_matching_reports(self):
+        col = make_collection()
+        col.update_many = AsyncMock(return_value=MagicMock(modified_count=3))
+        count = await ReportRepository(col).pull_reporter(USER_OID)
+        col.update_many.assert_awaited_once_with(
+            {"reporter_ids": USER_OID},
+            {"$pull": {"reporter_ids": USER_OID}},
+        )
+        assert count == 3
+
+    @pytest.mark.asyncio
+    async def test_propagates_pymongo_error(self):
+        col = make_collection()
+        col.update_many = AsyncMock(side_effect=PyMongoError("conn lost"))
+        with pytest.raises(PyMongoError):
+            await ReportRepository(col).pull_reporter(USER_OID)
+
+
+class TestDeleteByReporter:
+    @pytest.mark.asyncio
+    async def test_deletes_by_id_or_followup_email(self):
+        col = make_collection()
+        col.delete_many = AsyncMock(return_value=MagicMock(deleted_count=2))
+        count = await ReportSubmissionRepository(col).delete_by_reporter(
+            USER_OID, "user@example.com"
+        )
+        col.delete_many.assert_awaited_once_with(
+            {
+                "$or": [
+                    {"reporter_id": USER_OID},
+                    {"reporter_email": "user@example.com"},
+                ]
+            }
+        )
+        assert count == 2

tests/unit/repositories/test_url_repository.py

@@ -655,3 +655,18 @@ async def test_iter_by_owner_refuses_anonymous_sentinel(self):
             async for _ in self._repo(col).iter_by_owner(ANONYMOUS_OWNER_ID):
                 pass
         col.find.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_iter_by_owner_propagates_pymongo_error(self):
+        class _DeadCursor:
+            def __aiter__(self):
+                return self
+
+            async def __anext__(self):
+                raise OperationFailure("cursor died mid-stream")
+
+        col = make_collection()
+        col.find = MagicMock(return_value=_DeadCursor())
+        with pytest.raises(OperationFailure):
+            async for _ in self._repo(col).iter_by_owner(USER_OID):
+                pass

tests/unit/repositories/test_user_repository.py

@@ -255,6 +255,17 @@ async def test_find_purge_due_empty(self):
             == []
         )
 
+    @pytest.mark.asyncio
+    async def test_find_purge_due_propagates_pymongo_error(self):
+        col = make_collection()
+        col.find.return_value.to_list = AsyncMock(
+            side_effect=OperationFailure("conn lost")
+        )
+        with pytest.raises(OperationFailure):
+            await self._repo(col).find_purge_due(
+                now=datetime.now(timezone.utc), limit=25
+            )
+
     @pytest.mark.asyncio
     async def test_delete_hard_removes_doc(self):
         col = make_collection()

tests/unit/routes/test_account_deletion.py

@@ -422,3 +422,13 @@ async def test_request_deletion_computes_deadline_when_readback_races():
     )
 
     assert purge_after >= before + timedelta(days=GRACE_DAYS, seconds=-5)
+
+
+def test_get_account_deletion_service_reads_app_state():
+    """The real dependency (overridden everywhere above) resolves from
+    app.state, where wire_services parks the singleton."""
+    from unittest.mock import MagicMock
+
+    request = MagicMock()
+    resolved = get_account_deletion_service(request)
+    assert resolved is request.app.state.account_deletion_service

tests/unit/test_erasure_wiring.py

@@ -3,29 +3,56 @@
 ``build_erasure_mailer`` / ``build_posthog_eraser`` pick the real
 integration when its settings are configured and the Noop otherwise —
 AppSettings is env-only, so both branches are probed via env vars.
+``build_account_erasure_service`` (the worker-side composition of the
+same cascade) is probed the same way: env decides which side-effect
+clients get wired, primitives are fakes.
 """
 
 from unittest.mock import MagicMock
 
 import pytest
 
 from config import AppSettings
-from dependencies.wiring import build_erasure_mailer, build_posthog_eraser
+from dependencies.wiring import (
+    build_account_erasure_service,
+    build_erasure_mailer,
+    build_posthog_eraser,
+)
+from infrastructure.cloudflare_kv import CloudflareKVClient
 from infrastructure.email.zeptomail import ZeptoMailProvider
 from infrastructure.posthog_erasure import HttpPostHogEraser
+from infrastructure.storage.r2 import R2StorageClient
 from services.account_erasure_service import (
+    AccountErasureService,
     NoopErasureMailer,
     NoopPostHogEraser,
 )
+from services.cf_saas_backend import CfSaasBackend
+from services.edge_cache.og_writethrough import OgEdgeWritethrough
+from services.mock_dcv_backend import MockDcvBackend
+
+_SIDE_EFFECT_ENV = (
+    "ZEPTO_API_TOKEN",
+    "POSTHOG_ERASURE_API_KEY",
+    "POSTHOG_ERASURE_PROJECT_ID",
+    "POSTHOG_ERASURE_HOST",
+    "EDGE_CACHE_CF_ACCOUNT_ID",
+    "EDGE_CACHE_CF_API_TOKEN",
+    "EDGE_CACHE_KV_NAMESPACE_ID",
+    "R2_ACCOUNT_ID",
+    "R2_ACCESS_KEY_ID",
+    "R2_SECRET_ACCESS_KEY",
+    "R2_BUCKET",
+    "R2_PUBLIC_BASE_URL",
+    "CUSTOM_DOMAINS_MOCK_DCV",
+)
 
 
 @pytest.fixture
 def base_env(monkeypatch):
     monkeypatch.setenv("MONGODB_URI", "mongodb://localhost:27017/")
-    monkeypatch.delenv("ZEPTO_API_TOKEN", raising=False)
-    monkeypatch.delenv("POSTHOG_ERASURE_API_KEY", raising=False)
-    monkeypatch.delenv("POSTHOG_ERASURE_PROJECT_ID", raising=False)
-    monkeypatch.delenv("POSTHOG_ERASURE_HOST", raising=False)
+    for var in _SIDE_EFFECT_ENV:
+        monkeypatch.delenv(var, raising=False)
     return monkeypatch
 
 
@@ -81,3 +108,54 @@ def test_host_override(self, base_env):
         eraser = build_posthog_eraser(AppSettings(), MagicMock())
         assert isinstance(eraser, HttpPostHogEraser)
         assert eraser._host == "https://us.posthog.com"
+
+
+class TestBuildAccountErasureService:
+    """Worker-side composition root: same env gates as the app wiring."""
+
+    def _build(self):
+        # Mock db mapping, inert http client, redis None (cache
+        # invalidation degrades to no-ops, as in workers without Redis).
+        return build_account_erasure_service(
+            MagicMock(), AppSettings(), MagicMock(), None
+        )
+
+    def test_minimal_env_wires_disabled_side_effects(self, base_env):
+        service = self._build()
+        assert isinstance(service, AccountErasureService)
+        # Edge cache + R2 unconfigured ⇒ no KV purge, no og write-through,
+        # no R2 sweep.
+        assert service._r2_storage is None
+        assert service._url_service._edge_kv is None
+        assert service._url_service._og_writethrough is None
+        assert service._url_service._r2_storage is None
+        # Unconfigured mail/PostHog degrade to Noops, as in the app.
+        assert isinstance(service._mailer, NoopErasureMailer)
+        assert isinstance(service._posthog, NoopPostHogEraser)
+
+    def test_default_dcv_selects_cf_saas_backend(self, base_env):
+        service = self._build()
+        assert isinstance(service._domain_service._edge, CfSaasBackend)
+
+    def test_mock_dcv_selects_mock_backend(self, base_env):
+        base_env.setenv("CUSTOM_DOMAINS_MOCK_DCV", "true")
+        service = self._build()
+        assert isinstance(service._domain_service._edge, MockDcvBackend)
+
+    def test_configured_edge_and_r2_wire_real_clients(self, base_env):
+        base_env.setenv("EDGE_CACHE_CF_ACCOUNT_ID", "acct")
+        base_env.setenv("EDGE_CACHE_CF_API_TOKEN", "kv-token")
+        base_env.setenv("EDGE_CACHE_KV_NAMESPACE_ID", "ns")
+        base_env.setenv("R2_ACCOUNT_ID", "acct")
+        base_env.setenv("R2_ACCESS_KEY_ID", "key")
+        base_env.setenv("R2_SECRET_ACCESS_KEY", "secret")
+        base_env.setenv("R2_BUCKET", "og-images")
+        base_env.setenv("R2_PUBLIC_BASE_URL", "https://og.spoo.me")
+        service = self._build()
+        url_service = service._url_service
+        assert isinstance(url_service._edge_kv, CloudflareKVClient)
+        assert isinstance(url_service._og_writethrough, OgEdgeWritethrough)
+        assert isinstance(url_service._r2_storage, R2StorageClient)
+        # The erasure R2 sweep and the URL service delete path must share
+        # ONE client — a split here would orphan uploaded og:images.
+        assert service._r2_storage is url_service._r2_storage