8b1de6e258
- 5 new pytest covering paths the code-reviewer flagged as un-asserted:
* `test_seed_refuses_file_url` — `file://` scheme rejected before I/O
(was the SSRF-to-local-FS vector).
* `test_seed_refuses_disallowed_https_host` — non-allowlisted HTTPS
host rejected with `MitreSourceForbidden`.
* `test_seed_refuses_custom_url_without_sha` — end-to-end guard that
`seed_mitre(source=<custom URL>, expected_sha256=None,
allow_unverified=False)` raises `MitreSeedError`.
* `test_dotted_id_fallback_resolves_orphan_subtechnique` — STIX bundle
without `relationship[subtechnique-of]` still attaches T1059.001 to
T1059 via the dotted-id convention.
* `test_seed_clears_version_when_source_is_not_default` — seed from a
local path leaves `settings.mitre_version` NULL (no stale pin).
- Existing `test_checksum_mismatch_aborts` reworked to monkey-patch
`_ensure_host_allowed` so `file://` can drive the test past the allowlist
gate (was relying on file:// being accepted before CR1).
- Removed unused `uuid` import.
- e2e: assertions on `tactics_upserted`/`techniques_upserted`/
`subtechniques_upserted` switched from `>= 14/180/400` thresholds to
`=== 15/222/475` exact counts pinned to MITRE Enterprise v19.0 + 0
orphans. Catches parser regressions that would silently include revoked
rows. Bump alongside MITRE_VERSION when re-pinning.
- e2e: `Math.random()` → `crypto.randomUUID().slice(0, 8)` for unique
test-run emails (collision-safe across parallel CI workers).
DoD: 58 pytest pass (was 53), 34 Playwright pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Metamorph backend
Flask 3 API. See repo root README.md for the big picture.
Layout
app/
├── api/ # HTTP layer (blueprints), versioned under /api/v1
├── core/ # config (env-driven), structured logging
├── db/ # SQLAlchemy session + Alembic (M1+)
├── models/ # ORM models (M1+)
├── services/ # domain logic (M2+)
└── i18n/ # message catalogs (M13)
tests/ # pytest
Local dev
Requires uv and a reachable Postgres (M1+; not needed yet for /health).
uv sync # install deps from pyproject.toml
uv run flask --app app.main run --debug --port 8000
curl http://localhost:8000/api/v1/health
Tests
uv run pytest
Lint
uv run ruff check .
uv run ruff format .