refactor(core): improve typing and test coverage

Restructure database and user CLI commands, make passwords write-only
model properties, and use the UTC datetime constant throughout the
application.

Add PEP 287-style documentation and expand receiver, scanner, sender,
and URL security tests to cover error paths and edge cases.

1 files changed, 52 insertions, 0 deletions

diff --git a/tests/tasks/test_receiver.py b/tests/tasks/test_receiver.py
index 811ab63..7e8f531 100644
--- a/tests/tasks/test_receiver.py
+++ b/tests/tasks/test_receiver.py
@@ -559,3 +559,55 @@ def test_ensure_public_request_rejects_url_without_hostname(
         receiver.ensure_public_request(httpx.Request("GET", SOURCE_URL))
 
     is_public_url.assert_called_once_with(SOURCE_URL)
+
+
+@patch("webmentions_ssg.tasks.receiver.BeautifulSoup")
+def test_html_mentions_target_ignores_non_string_attribute(
+    beautiful_soup: Mock, receiver: ModuleType
+) -> None:
+    document = beautiful_soup.return_value
+    document.select_one.return_value = None
+
+    element = Mock()
+    element.get.return_value = ["not", "a", "string"]
+    document.select.return_value = [element]
+
+    assert not receiver.html_mentions_target(b"<html></html>", SOURCE_URL, TARGET_URL)
+
+
+@patch("webmentions_ssg.tasks.receiver.httpx.Client")
+def test_fetch_source_ignores_invalid_content_length(
+    httpx_client: Mock, app: Flask, receiver: ModuleType
+) -> None:
+    response = httpx.Response(
+        200,
+        headers={"Content-Type": "text/html", "Content-Length": "invalid"},
+        content=b"<p>Document</p>",
+        request=httpx.Request("GET", SOURCE_URL),
+    )
+    set_stream_response(httpx_client, response)
+
+    with app.app_context():
+        fetched_response, body = receiver.fetch_source(SOURCE_URL)
+
+    assert fetched_response is response
+    assert body == b"<p>Document</p>"
+
+
+@patch("webmentions_ssg.tasks.receiver.fetch_source")
+def test_source_mentions_target_falls_back_for_unknown_encoding(
+    fetch_source: Mock, receiver: ModuleType
+) -> None:
+    body = f"Reply to {TARGET_URL}".encode()
+
+    response = httpx.Response(
+        200,
+        headers={"Content-Type": "text/plain"},
+        content=body,
+        request=httpx.Request("GET", SOURCE_URL),
+    )
+    response.encoding = "unknown-encoding"
+    fetch_source.return_value = response, body
+
+    assert receiver.source_mentions_target(SOURCE_URL, TARGET_URL)
+    fetch_source.assert_called_once_with(SOURCE_URL)