06/16 Phase 6 (continue)

tests/test_smoke.py

@@ -657,17 +657,24 @@ def _phase6(app):
 
     # non-admin gets 403
     login("t@example.com", "NewPass456")
-    for path in ("/admin", "/admin/listings", "/admin/reports"):
+    for path in ("/admin", "/admin/listings", "/admin/reports", "/admin/settings",
+                 "/admin/categories", "/admin/plans", "/admin/transactions",
+                 "/admin/audit"):
         assert c.get(path, base_url=B).status_code == 403
     print("non-admin /admin* -> 403: ok")
     c.get("/auth/logout", base_url=B)
 
-    # admin gets 200 on dashboard/users/user_detail/listings/reports
+    # admin gets 200 on all admin pages
     login("admin@example.com", "AdminPass123")
     with app.app_context():
         target_id = User.query.filter_by(email="t@example.com").first().id
+        cat_id = Category.query.filter_by(parent_id=None).first().id
+        plan_id = Plan.query.filter_by(slug="free").first().id
     for path in ("/admin", "/admin/users", f"/admin/users/{target_id}",
-                "/admin/listings", "/admin/reports"):
+                "/admin/listings", "/admin/reports", "/admin/settings",
+                "/admin/categories", f"/admin/categories/{cat_id}/schema",
+                "/admin/plans", f"/admin/plans/{plan_id}",
+                "/admin/transactions", "/admin/audit"):
         code = c.get(path, base_url=B).status_code
         assert code == 200, f"{path} -> {code}"
         print(f"{code}  {path}")
@@ -715,6 +722,76 @@ def _phase6(app):
     assert "HTTP Report Test" not in r2.get_data(as_text=True)
     print("report dismiss hides from open queue: ok")
 
+    # --- contact_density_threshold: configurable via settings ---
+    from app.services.contact import contact_density, contact_revealed
+    with app.app_context():
+        body = "Call me at 555-123-4567"
+        assert contact_density(body) == 1
+        set_setting("contact_density_threshold", 1)
+        db.session.commit()
+        assert contact_density(body) >= get_setting("contact_density_threshold", 3)
+        set_setting("contact_density_threshold", 3)
+        db.session.commit()
+        assert not (contact_density(body) >= get_setting("contact_density_threshold", 3))
+    print("contact_density_threshold configurable: ok")
+
+    # --- new_user_trust_gate_days: blocks reveal even for trusted+verified ---
+    with app.app_context():
+        buyer = User.query.filter_by(email="buyer@example.com").first()
+        assert contact_revealed(buyer)
+        set_setting("new_user_trust_gate_days", 9999)
+        db.session.commit()
+        assert not contact_revealed(buyer)
+        set_setting("new_user_trust_gate_days", 0)
+        db.session.commit()
+        assert contact_revealed(buyer)
+    print("new_user_trust_gate_days gates contact reveal: ok")
+
+    # --- ads_enabled: short-circuits inject_ads() ---
+    from app.blueprints.ads.routes import inject_ads
+    with app.app_context():
+        set_setting("ads_enabled", False)
+        db.session.commit()
+    with app.test_request_context("/"):
+        assert inject_ads() == {"ads": {}, "show_ads": False}
+    with app.app_context():
+        set_setting("ads_enabled", True)
+        db.session.commit()
+    print("ads_enabled short-circuits inject_ads: ok")
+
+    # --- registration_open: blocks new registrations when closed ---
+    c.get("/auth/logout", base_url=B)
+    with app.app_context():
+        set_setting("registration_open", False)
+        db.session.commit()
+    tok = csrf(c.get("/auth/register", base_url=B).get_data(as_text=True))
+    r = c.post("/auth/register", base_url=B,
+              data={"csrf_token": tok, "display_name": "Blocked",
+                    "email": "blocked@example.com", "password": "BlockedPass123",
+                    "confirm": "BlockedPass123"},
+              headers={"Referer": B + "/auth/register"}, follow_redirects=True)
+    assert "closed" in r.get_data(as_text=True).lower()
+    with app.app_context():
+        assert User.query.filter_by(email="blocked@example.com").first() is None
+        set_setting("registration_open", True)
+        db.session.commit()
+    print("registration_open blocks new registrations: ok")
+
+    # --- maintenance_mode: 503 for non-admin, admin bypasses ---
+    with app.app_context():
+        set_setting("maintenance_mode", True)
+        db.session.commit()
+    c.get("/auth/logout", base_url=B)
+    assert c.get("/", base_url=B).status_code == 503
+    login("admin@example.com", "AdminPass123")
+    assert c.get("/admin", base_url=B).status_code == 200
+    c.get("/auth/logout", base_url=B)
+    with app.app_context():
+        set_setting("maintenance_mode", False)
+        db.session.commit()
+    assert c.get("/", base_url=B).status_code == 200
+    print("maintenance_mode blocks non-admins, admin bypasses: ok")
+
     # restore target to active for cleanliness (not strictly needed, smoke ends here)
     with app.app_context():
         u = User.query.filter_by(email="t@example.com").first()