test: cover new branches to satisfy diff coverage

CI's diff-cover gate (--fail-under=90) flagged uncovered new lines:

- QueryAuthSync had no test -- added one for first-observation no-op,
  clear-on-user-change, clear-on-sign-out, and no-clear on an unchanged id.
- _retry_delay_seconds: a non-numeric X-RateLimit-Reset falls through to
  the cap instead of raising.
- scan_results_repo.list_recent's new scanned_by_user_id filter, via a
  cockpit "own" BYO-PAT-scope test.
- github_app.get_installation_token re-checks the cache after acquiring
  the per-installation mint lock (the raced-mint window).
- event_consumer._rollback_quietly on both the happy path and a
  rollback that itself raises.

Python diff coverage 97%, UI diff coverage 100%.

Author: nazarli-shabnam

apps/api/tests/test_analytics_cockpit.py

@@ -164,6 +164,39 @@ def test_cockpit_hides_score_trend_from_a_non_member_byo_pat_caller(http, db, mo
     assert body["score_trend"] == []
 
 
+def test_cockpit_shows_own_byo_pat_scans_when_caller_has_no_org_membership(http, db, mock_user):
+    # An org row for "acme" exists but the caller has no membership and no installation
+    # -- their only claim to its history is a scan they ran themselves, so
+    # _user_history_scope is "own" and only their own scan rows feed the trend.
+    # Mirrors test_analytics_history.py::test_personal_history_returns_seeded_rows_newest_first.
+    org = org_repo.get_or_create(db, github_login="acme")
+    other = User(email="other-cockpit@example.com", name=None, is_workspace_admin=False)
+    db.add(other)
+    db.flush()
+    scan_results_repo.insert(
+        db, owner="acme", score=60, total_checks=5, failed_checks=2, checks=[],
+        tenant_id=org.tenant_id, scanned_by_user_id=mock_user.id,
+    )
+    scan_results_repo.insert(
+        db, owner="acme", score=90, total_checks=5, failed_checks=0, checks=[],
+        tenant_id=org.tenant_id, scanned_by_user_id=other.id,
+    )
+
+    patchers = _patch_all()
+    _start_all(patchers)
+    try:
+        with patch("src.routers.analytics.resolve_owner_token", return_value="ghp_test"):
+            resp = http.get("/me/analytics/cockpit/acme")
+    finally:
+        _stop_all(patchers)
+
+    assert resp.status_code == 200
+    body = resp.json()
+    # Only mock_user's own scan (60), not the other user's (90).
+    assert body["latest_score"] == 60
+    assert body["score_trend"] == [60]
+
+
 def test_cockpit_no_cache_jobs_yet(http, db, mock_user):
     patchers = _patch_all()
     _start_all(patchers)

apps/api/tests/test_github_app.py

@@ -96,6 +96,24 @@ def test_expired_cache_refetches(app_configured):
     assert mock_client.post.call_count == 2
 
 
+def test_get_installation_token_rechecks_cache_after_acquiring_mint_lock(app_configured, monkeypatch):
+    # Simulates another thread minting the token in the window between the lock-free
+    # cache check and this call acquiring the per-installation mint lock: the second
+    # check must short-circuit and no HTTP mint should happen.
+    calls: list[int] = []
+
+    def fake_cached(installation_id: int):
+        calls.append(installation_id)
+        return None if len(calls) == 1 else "ghs_raced"
+
+    minted = MagicMock()
+    monkeypatch.setattr(github_app, "_cached_token", fake_cached)
+    monkeypatch.setattr(github_app, "_request_installation_token", minted)
+
+    assert github_app.get_installation_token(42) == "ghs_raced"
+    minted.assert_not_called()
+
+
 def test_not_configured_raises(monkeypatch):
     monkeypatch.setattr(settings, "github_app_id", None)
     monkeypatch.setattr(settings, "github_app_private_key", None)

apps/ui/tests/components/query-auth-sync.test.tsx

@@ -0,0 +1,73 @@
+import { cleanup, render } from "@testing-library/react"
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
+import { afterEach, describe, expect, it, vi } from "vitest"
+
+let mockUser: { id: number } | null = null
+
+vi.mock("@/lib/auth-context", () => ({
+  useAuth: () => ({ user: mockUser }),
+}))
+
+import { QueryAuthSync } from "@/components/query-auth-sync"
+
+function renderWith(qc: QueryClient) {
+  return render(
+    <QueryClientProvider client={qc}>
+      <QueryAuthSync />
+    </QueryClientProvider>,
+  )
+}
+
+describe("QueryAuthSync", () => {
+  afterEach(() => {
+    cleanup()
+    mockUser = null
+  })
+
+  it("does not clear the cache on the first observation", () => {
+    mockUser = { id: 1 }
+    const qc = new QueryClient()
+    const clear = vi.spyOn(qc, "clear")
+
+    renderWith(qc)
+
+    expect(clear).not.toHaveBeenCalled()
+  })
+
+  it("clears the cache when the signed-in user changes", () => {
+    mockUser = { id: 1 }
+    const qc = new QueryClient()
+    const clear = vi.spyOn(qc, "clear")
+    const { rerender } = renderWith(qc)
+
+    mockUser = { id: 2 }
+    rerender(
+      <QueryClientProvider client={qc}>
+        <QueryAuthSync />
+      </QueryClientProvider>,
+    )
+
+    expect(clear).toHaveBeenCalledTimes(1)
+  })
+
+  it("clears the cache on sign-out (user becomes null) but not on an unchanged id", () => {
+    mockUser = { id: 7 }
+    const qc = new QueryClient()
+    const clear = vi.spyOn(qc, "clear")
+    const { rerender } = renderWith(qc)
+
+    const redraw = () =>
+      rerender(
+        <QueryClientProvider client={qc}>
+          <QueryAuthSync />
+        </QueryClientProvider>,
+      )
+
+    redraw() // same id -> no clear
+    expect(clear).not.toHaveBeenCalled()
+
+    mockUser = null
+    redraw() // signed out -> clear
+    expect(clear).toHaveBeenCalledTimes(1)
+  })
+})

apps/worker/tests/test_event_consumer.py

@@ -583,6 +583,20 @@ def test_parse_alert_timestamp_falls_back_on_missing_or_malformed_value():
     assert event_consumer._parse_alert_timestamp("not-a-real-timestamp", fallback) == fallback
 
 
+def test_rollback_quietly_clears_the_transaction():
+    conn = MagicMock()
+    event_consumer._rollback_quietly(conn)
+    conn.rollback.assert_called_once_with()
+
+
+def test_rollback_quietly_swallows_a_failing_rollback():
+    conn = MagicMock()
+    conn.rollback.side_effect = psycopg.OperationalError("connection already gone")
+    # Must not raise -- the outer loop reconnects on a dead connection.
+    event_consumer._rollback_quietly(conn)
+    conn.rollback.assert_called_once_with()
+
+
 def _org_member(conn, tenant_id, login):
     with conn.cursor() as cur:
         cur.execute(f"SET app.tenant_id = {int(tenant_id)}")

packages/checks/tests/test_github_checks.py

@@ -203,6 +203,20 @@ def test_get_falls_back_to_ratelimit_reset_when_no_retry_after():
     assert 20 <= slept <= 30
 
 
+def test_get_ignores_a_malformed_ratelimit_reset_and_waits_the_cap():
+    # A non-numeric X-RateLimit-Reset must not raise -- it falls through to the cap
+    # (same as having no usable header at all).
+    request = httpx.Request("GET", "https://x/y")
+    rate_limited = httpx.Response(429, headers={"X-RateLimit-Reset": "soon"}, request=request)
+    ok_response = httpx.Response(200, json={"login": "acme"}, request=request)
+    responses = iter([rate_limited, ok_response])
+
+    with patch("time.sleep") as mock_sleep, patch("httpx.Client.get", side_effect=lambda url, headers: next(responses)):
+        result = _get("https://x/y", "tok")
+    assert result == {"login": "acme"}
+    mock_sleep.assert_called_once_with(_MAX_RETRY_AFTER_SECONDS)
+
+
 def test_get_waits_the_cap_for_a_ratelimit_with_no_usable_header():
     # A 429 with neither Retry-After nor X-RateLimit-Reset waits the full documented
     # minimum backoff, not a fast exponential retry into the same limit.