added additional tests; sorted tests

tests-assets/test_uploads.py

@@ -3,51 +3,6 @@ import aiohttp
 import pytest
 
 
-@pytest.mark.asyncio
-async def test_upload_requires_multipart(http: aiohttp.ClientSession, api_base: str):
-    async with http.post(api_base + "/api/assets", json={"foo": "bar"}) as r:
-        body = await r.json()
-        assert r.status == 415
-        assert body["error"]["code"] == "UNSUPPORTED_MEDIA_TYPE"
-
-
-@pytest.mark.asyncio
-async def test_upload_missing_file_and_hash(http: aiohttp.ClientSession, api_base: str):
-    form = aiohttp.FormData(default_to_multipart=True)
-    form.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests"]))
-    form.add_field("name", "x.safetensors")
-    async with http.post(api_base + "/api/assets", data=form) as r:
-        body = await r.json()
-        assert r.status == 400
-        assert body["error"]["code"] == "MISSING_FILE"
-
-
-@pytest.mark.asyncio
-async def test_upload_models_unknown_category(http: aiohttp.ClientSession, api_base: str):
-    form = aiohttp.FormData()
-    form.add_field("file", b"A" * 128, filename="m.safetensors", content_type="application/octet-stream")
-    form.add_field("tags", json.dumps(["models", "no_such_category", "unit-tests"]))
-    form.add_field("name", "m.safetensors")
-    async with http.post(api_base + "/api/assets", data=form) as r:
-        body = await r.json()
-        assert r.status == 400
-        assert body["error"]["code"] == "INVALID_BODY"
-        assert "unknown models category" in body["error"]["message"] or "unknown model category" in body["error"]["message"]
-
-
-@pytest.mark.asyncio
-async def test_upload_tags_traversal_guard(http: aiohttp.ClientSession, api_base: str):
-    form = aiohttp.FormData()
-    form.add_field("file", b"A" * 256, filename="evil.safetensors", content_type="application/octet-stream")
-    # '..' should be rejected by destination resolver
-    form.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests", "..", "zzz"]))
-    form.add_field("name", "evil.safetensors")
-    async with http.post(api_base + "/api/assets", data=form) as r:
-        body = await r.json()
-        assert r.status == 400
-        assert body["error"]["code"] in ("BAD_REQUEST", "INVALID_BODY")
-
-
 @pytest.mark.asyncio
 async def test_upload_ok_duplicate_reference(http: aiohttp.ClientSession, api_base: str, make_asset_bytes):
     name = "dup_a.safetensors"
@@ -120,6 +75,56 @@ async def test_upload_fastpath_from_existing_hash_no_file(http: aiohttp.ClientSe
         assert b2["asset_hash"] == h
 
 
+@pytest.mark.asyncio
+async def test_upload_fastpath_with_known_hash_and_file(
+    http: aiohttp.ClientSession, api_base: str
+):
+    # Seed
+    form1 = aiohttp.FormData()
+    form1.add_field("file", b"C" * 128, filename="seed.safetensors", content_type="application/octet-stream")
+    form1.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests", "fp"]))
+    form1.add_field("name", "seed.safetensors")
+    form1.add_field("user_metadata", json.dumps({}))
+    async with http.post(api_base + "/api/assets", data=form1) as r1:
+        b1 = await r1.json()
+        assert r1.status == 201, b1
+        h = b1["asset_hash"]
+
+    # Send both file and hash of existing content -> server must drain file and create from hash (200)
+    form2 = aiohttp.FormData()
+    form2.add_field("file", b"ignored" * 10, filename="ignored.bin", content_type="application/octet-stream")
+    form2.add_field("hash", h)
+    form2.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests", "fp"]))
+    form2.add_field("name", "copy_from_hash.safetensors")
+    form2.add_field("user_metadata", json.dumps({}))
+    async with http.post(api_base + "/api/assets", data=form2) as r2:
+        b2 = await r2.json()
+        assert r2.status == 200, b2
+        assert b2["created_new"] is False
+        assert b2["asset_hash"] == h
+
+
+@pytest.mark.asyncio
+async def test_upload_multiple_tags_fields_are_merged(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"B" * 256, filename="merge.safetensors", content_type="application/octet-stream")
+    form.add_field("tags", "models,checkpoints")  # CSV
+    form.add_field("tags", json.dumps(["unit-tests", "alpha"]))  # JSON array in second field
+    form.add_field("name", "merge.safetensors")
+    form.add_field("user_metadata", json.dumps({"u": 1}))
+    async with http.post(api_base + "/api/assets", data=form) as r1:
+        created = await r1.json()
+        assert r1.status in (200, 201), created
+        aid = created["id"]
+
+    # Verify all tags are present on the resource
+    async with http.get(f"{api_base}/api/assets/{aid}") as rg:
+        detail = await rg.json()
+        assert rg.status == 200, detail
+        tags = set(detail["tags"])
+        assert {"models", "checkpoints", "unit-tests", "alpha"}.issubset(tags)
+
+
 @pytest.mark.asyncio
 async def test_create_from_hash_endpoint_404(http: aiohttp.ClientSession, api_base: str):
     payload = {
@@ -131,3 +136,100 @@ async def test_create_from_hash_endpoint_404(http: aiohttp.ClientSession, api_ba
         body = await r.json()
         assert r.status == 404
         assert body["error"]["code"] == "ASSET_NOT_FOUND"
+
+
+@pytest.mark.asyncio
+async def test_upload_zero_byte_rejected(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"", filename="empty.safetensors", content_type="application/octet-stream")
+    form.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests", "edge"]))
+    form.add_field("name", "empty.safetensors")
+    form.add_field("user_metadata", json.dumps({}))
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] == "EMPTY_UPLOAD"
+
+
+@pytest.mark.asyncio
+async def test_upload_invalid_root_tag_rejected(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"A" * 64, filename="badroot.bin", content_type="application/octet-stream")
+    form.add_field("tags", json.dumps(["not-a-root", "whatever"]))
+    form.add_field("name", "badroot.bin")
+    form.add_field("user_metadata", json.dumps({}))
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] == "INVALID_BODY"
+
+
+@pytest.mark.asyncio
+async def test_upload_user_metadata_must_be_json(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"A" * 128, filename="badmeta.bin", content_type="application/octet-stream")
+    form.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests", "edge"]))
+    form.add_field("name", "badmeta.bin")
+    form.add_field("user_metadata", "{not json}")  # invalid
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] == "INVALID_BODY"
+
+
+@pytest.mark.asyncio
+async def test_upload_requires_multipart(http: aiohttp.ClientSession, api_base: str):
+    async with http.post(api_base + "/api/assets", json={"foo": "bar"}) as r:
+        body = await r.json()
+        assert r.status == 415
+        assert body["error"]["code"] == "UNSUPPORTED_MEDIA_TYPE"
+
+
+@pytest.mark.asyncio
+async def test_upload_missing_file_and_hash(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData(default_to_multipart=True)
+    form.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests"]))
+    form.add_field("name", "x.safetensors")
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] == "MISSING_FILE"
+
+
+@pytest.mark.asyncio
+async def test_upload_models_unknown_category(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"A" * 128, filename="m.safetensors", content_type="application/octet-stream")
+    form.add_field("tags", json.dumps(["models", "no_such_category", "unit-tests"]))
+    form.add_field("name", "m.safetensors")
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] == "INVALID_BODY"
+        assert "unknown models category" in body["error"]["message"] or "unknown model category" in body["error"]["message"]
+
+
+@pytest.mark.asyncio
+async def test_upload_models_requires_category(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"A" * 64, filename="nocat.safetensors", content_type="application/octet-stream")
+    form.add_field("tags", json.dumps(["models"]))  # missing category
+    form.add_field("name", "nocat.safetensors")
+    form.add_field("user_metadata", json.dumps({}))
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] == "INVALID_BODY"
+
+
+@pytest.mark.asyncio
+async def test_upload_tags_traversal_guard(http: aiohttp.ClientSession, api_base: str):
+    form = aiohttp.FormData()
+    form.add_field("file", b"A" * 256, filename="evil.safetensors", content_type="application/octet-stream")
+    # '..' should be rejected by destination resolver
+    form.add_field("tags", json.dumps(["models", "checkpoints", "unit-tests", "..", "zzz"]))
+    form.add_field("name", "evil.safetensors")
+    async with http.post(api_base + "/api/assets", data=form) as r:
+        body = await r.json()
+        assert r.status == 400
+        assert body["error"]["code"] in ("BAD_REQUEST", "INVALID_BODY")