test: cover access-policy RBAC deny-path and circuit-breaker probe guard

[seonghobae]

Description

Closes three untested branches on two backend security/resilience primitives, bringing both modules to 100% line coverage. Tests only — no production behavior changes.

• services/access_policy.py:130 — the final rbac_denied deny-path in evaluate_access, reached when a non-admin owns (or is delegated) a resource but their role and group both fail the permit set. This pins the invariant that ownership is necessary but not sufficient: a stray refactor that returned allowed after the ownership gate would silently widen access, and this test now catches it.
• services/access_policy.py:77 — the _equivalent_roles fallback that maps an unrecognised role to only itself (no accidental alias expansion for unknown roles).
• services/circuit_breaker.py:72 — the half-open concurrency guard that rejects a second probe while the lone half-open probe is still in flight, so a provider that may still be down is not hit twice at once. Driven with an asyncio.Event so the in-flight slot is genuinely claimed before the second call arrives.

Type of change

• Bug fix (non-breaking change which fixes an issue) — test coverage of existing security branches
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project (ruff clean)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (n/a — tests only)
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Verification

$ python3 -m pytest tests/test_access_policy.py tests/test_circuit_breaker.py \
    --cov=services.access_policy --cov=services.circuit_breaker --cov-report=term-missing
services/access_policy.py     63   0   100%
services/circuit_breaker.py   54   0   100%
42 passed
$ python3 -m ruff check tests/test_access_policy.py tests/test_circuit_breaker.py
All checks passed!

🤖 Generated with Claude Code

---

Generated by Claude Code

Summary by CodeRabbit

• Tests
  • Added coverage for role-based access controls, including role aliases and denied access scenarios.
  • Added coverage confirming that circuit-breaker recovery permits only one half-open probe at a time and handles concurrent requests safely.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fe539b43-579f-4fd9-bc61-9e4743830cc5

📥 Commits

Reviewing files that changed from the base of the PR and between 0dc9fd1 and 2241f1d.

📒 Files selected for processing (1)

• backend/tests/test_access_policy_delegated_rbac.py

📝 Walkthrough

Walkthrough

The changes expand tests for access-policy role handling, RBAC denial, and circuit-breaker half-open probe concurrency.

Changes

Access policy test coverage

Layer / File(s)	Summary
RBAC and role alias validation backend/tests/test_access_policy.py	The tests cover RBAC denial when role and group access do not match. They also verify known role aliases and unknown-role fallback behavior.

Circuit breaker test coverage

Layer / File(s)	Summary
Half-open probe concurrency backend/tests/test_circuit_breaker.py	The asynchronous test verifies that one half-open probe runs, a concurrent probe fails fast, and the original probe completes successfully.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the added access-policy and circuit-breaker tests.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/bandscope-pr-audit-ci-zgl127

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing after Loop drain: permanently blocked — branch was updated onto develop for mergeability, which cleared prior APPROVED robot evidence; re-review (CodeRabbit/OpenCode) and/or central gate jobs (metadata-only gate evaluation, coverage-evidence) remained pending/stuck without a re-runnable workflow handle. Not force-merging (merge-gate policy). Re-open a focused PR when robot capacity is available. Related product security fixes that reimplemented cleanly remain on branch goal/carddav-path-traversal-decode (#1206) for relaunch.

[github-actions]

PR governance metadata gate update for 2241f1d79ef0a11a55a567454a8258b67efee121: no current blocking failures remain.

PR governance metadata gate is ready; all current-head requirements passed.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/tests/test_access_policy.py`:
- Around line 320-344: Update
test_owner_without_role_or_group_permission_is_rbac_denied to match its
coverage: either add a separate focused case where a non-owner is included in
delegated_user_ids and still receives rbac_denied, or remove the
delegated-access wording from the docstring. Keep the existing owner scenario
focused on ownership.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c3ecc81-1f87-4e19-be43-330363ede07b

📥 Commits

Reviewing files that changed from the base of the PR and between 9769bec and 0dc9fd1.

📒 Files selected for processing (2)

• backend/tests/test_access_policy.py
• backend/tests/test_circuit_breaker.py

[seonghobae]

Maintenance revalidation completed for current head 2241f1d79ef0a11a55a567454a8258b67efee121: required GitHub Actions workflows are green, the CodeRabbit finding is resolved, and the added tests are scoped to existing security/resilience behavior. Triggering the central review scheduler to refresh the required opencode-review evidence.

[seonghobae]

Current head 2241f1d79ef0a11a55a567454a8258b67efee121 remains immutable, all repository-local required workflows are successful, and the review finding is addressed. Re-triggering the central review/merge scheduler for current-head opencode-review evidence.