fix: close search API review findings

tests/api/test_jobs.py

@@ -70,3 +70,36 @@ def test_collection_reindex_includes_departed_rule_path(
             break
         time.sleep(0.01)
     assert any(str(file) in batch for batch in engine.forced_paths)
+
+
+def test_unfiltered_reindex_includes_document_root_after_rule_change(
+    authenticated: tuple[TestClient, str], tmp_path: Path
+) -> None:
+    client, csrf = authenticated
+    root = tmp_path / "docs"
+    books = root / "books"
+    books.mkdir()
+    (books / "a.txt").write_text("a")
+    headers = {"X-CSRF-Token": csrf}
+    collection_id = client.post(
+        "/collections", headers=headers, json={"name": "Books"}
+    ).json()["id"]
+    created = client.post(
+        f"/collections/{collection_id}/memberships", headers=headers,
+        json={"sources": [{"type": "directory", "path": "books", "mode": "persistent"}]},
+    )
+    job_id = created.json()["job"]["id"]
+    for _ in range(100):
+        if client.get(f"/jobs/{job_id}").json()["job"]["state"] == "completed":
+            break
+        time.sleep(0.01)
+    engine = cast(FastAPI, client.app).state.engine
+    engine.forced_paths.clear()
+    (books / "b.txt").write_text("b")
+    refreshed = client.post("/jobs/reindex", headers=headers, json={})
+    refresh_id = refreshed.json()["job"]["id"]
+    for _ in range(100):
+        if client.get(f"/jobs/{refresh_id}").json()["job"]["state"] == "completed":
+            break
+        time.sleep(0.01)
+    assert any(str(root) in batch for batch in engine.forced_paths)

tests/api/test_root_path.py

@@ -9,6 +9,9 @@ from recoll_modern.engine.fake import FakeEngine
 
 
 def test_cookie_and_openapi_honor_root_path(prefixed_client: TestClient) -> None:
+    anonymous = prefixed_client.get("/recoll/openapi.json")
+    assert anonymous.status_code == 401
+    assert anonymous.json()["error"]["code"] == "unauthenticated"
     response = prefixed_client.post(
         "/recoll/auth/login", json={"username": "admin", "password": "secret-password"}
     )
@@ -18,6 +21,15 @@ def test_cookie_and_openapi_honor_root_path(prefixed_client: TestClient) -> None
     assert prefixed_client.get("/auth/login").status_code == 404
 
 
+@pytest.mark.parametrize(
+    "path", ["/openapi.json", "/docs", "/docs/oauth2-redirect", "/redoc"]
+)
+def test_api_documentation_requires_session(app_client: TestClient, path: str) -> None:
+    response = app_client.get(path)
+    assert response.status_code == 401
+    assert response.json()["error"]["code"] == "unauthenticated"
+
+
 def test_trusted_forwarded_prefix_routes_request(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None: