udata 14.0.3.dev1__py3-none-any.whl → 14.7.3.dev4__py3-none-any.whl

udata/tests/api/test_reports_api.py

@@ -1,3 +1,5 @@
+from datetime import datetime
+
 from flask import url_for
 
 from udata.core.dataset.factories import DatasetFactory
@@ -148,6 +150,28 @@ class ReportsAPITest(APITestCase):
 
         self.assertEqual(payload["data"][1]["subject"]["id"], str(spam_reuse.id))
 
+    def test_reports_api_list_sort_by_reported_at(self):
+        user = UserFactory()
+
+        dataset1 = DatasetFactory.create(owner=user)
+        dataset2 = DatasetFactory.create(owner=user)
+        dataset3 = DatasetFactory.create(owner=user)
+
+        # Create reports with different reported_at times
+        report1 = Report(subject=dataset1, reason="spam", reported_at=datetime(2024, 1, 1)).save()
+        report2 = Report(subject=dataset2, reason="spam", reported_at=datetime(2024, 1, 3)).save()
+        report3 = Report(subject=dataset3, reason="spam", reported_at=datetime(2024, 1, 2)).save()
+
+        self.login(AdminFactory())
+
+        # Sort by -reported_at (most recent first)
+        response = self.get(url_for("api.reports", sort="-reported_at"))
+        self.assert200(response)
+        payload = response.json
+        self.assertEqual(payload["data"][0]["id"], str(report2.id))
+        self.assertEqual(payload["data"][1]["id"], str(report3.id))
+        self.assertEqual(payload["data"][2]["id"], str(report1.id))
+
     def test_reports_api_get(self):
         user = UserFactory()
 
@@ -165,3 +189,136 @@ class ReportsAPITest(APITestCase):
 
         payload = response.json
         self.assertEqual(payload["subject"]["id"], str(spam_dataset.id))
+
+    def test_reports_api_dismiss(self):
+        user = UserFactory()
+        admin = AdminFactory()
+
+        spam_dataset = DatasetFactory.create(owner=user)
+        report = Report(subject=spam_dataset, reason="spam").save()
+
+        dismiss_time = datetime.utcnow().isoformat()
+
+        # Should require admin
+        response = self.patch(url_for("api.report", report=report), {"dismissed_at": dismiss_time})
+        self.assert401(response)
+
+        self.login(user)
+        response = self.patch(url_for("api.report", report=report), {"dismissed_at": dismiss_time})
+        self.assert403(response)
+
+        self.login(admin)
+        response = self.patch(url_for("api.report", report=report), {"dismissed_at": dismiss_time})
+        self.assert200(response)
+
+        payload = response.json
+        self.assertIsNotNone(payload["dismissed_at"])
+        self.assertEqual(payload["dismissed_by"]["id"], str(admin.id))
+
+        report.reload()
+        self.assertIsNotNone(report.dismissed_at)
+        self.assertEqual(report.dismissed_by.id, admin.id)
+
+    def test_reports_api_undismiss(self):
+        user = UserFactory()
+        admin = AdminFactory()
+
+        spam_dataset = DatasetFactory.create(owner=user)
+        report = Report(
+            subject=spam_dataset,
+            reason="spam",
+            dismissed_at=datetime.utcnow(),
+            dismissed_by=admin,
+        ).save()
+
+        # Verify report is dismissed
+        self.assertIsNotNone(report.dismissed_at)
+        self.assertIsNotNone(report.dismissed_by)
+
+        # Should require admin
+        response = self.patch(url_for("api.report", report=report), {"dismissed_at": None})
+        self.assert401(response)
+
+        self.login(user)
+        response = self.patch(url_for("api.report", report=report), {"dismissed_at": None})
+        self.assert403(response)
+
+        self.login(admin)
+        response = self.patch(url_for("api.report", report=report), {"dismissed_at": None})
+        self.assert200(response)
+
+        payload = response.json
+        self.assertIsNone(payload["dismissed_at"])
+        self.assertIsNone(payload["dismissed_by"])
+
+        report.reload()
+        self.assertIsNone(report.dismissed_at)
+        self.assertIsNone(report.dismissed_by)
+
+    def test_reports_api_filter_by_handled(self):
+        user = UserFactory()
+        admin = AdminFactory()
+
+        dataset1 = DatasetFactory.create(owner=user)
+        dataset2 = DatasetFactory.create(owner=user)
+
+        # Unhandled report (not dismissed)
+        ongoing_report = Report(subject=dataset1, reason="spam").save()
+
+        # Handled report (dismissed)
+        dismissed_report = Report(
+            subject=dataset2, reason="spam", dismissed_at=datetime.utcnow(), dismissed_by=admin
+        ).save()
+
+        self.login(admin)
+
+        # Filter by unhandled
+        response = self.get(url_for("api.reports", handled="false"))
+        self.assert200(response)
+        payload = response.json
+        self.assertEqual(payload["total"], 1)
+        self.assertEqual(payload["data"][0]["id"], str(ongoing_report.id))
+
+        # Filter by handled
+        response = self.get(url_for("api.reports", handled="true"))
+        self.assert200(response)
+        payload = response.json
+        self.assertEqual(payload["total"], 1)
+        self.assertEqual(payload["data"][0]["id"], str(dismissed_report.id))
+
+        # No filter (all reports)
+        response = self.get(url_for("api.reports"))
+        self.assert200(response)
+        payload = response.json
+        self.assertEqual(payload["total"], 2)
+
+    def test_reports_api_filter_handled_with_deleted_subject(self):
+        """Reports with deleted subjects should appear when handled="true", not handled="false"."""
+        user = UserFactory()
+        admin = AdminFactory()
+
+        dataset1 = DatasetFactory.create(owner=user)
+        dataset2 = DatasetFactory.create(owner=user)
+
+        # Unhandled report (not dismissed, subject exists)
+        ongoing_report = Report(subject=dataset1, reason="spam").save()
+
+        # Report with deleted subject (should appear in "handled", not "unhandled")
+        deleted_subject_report = Report(subject=dataset2, reason="spam").save()
+        dataset2.delete()
+
+        self.login(admin)
+
+        # Filter by unhandled - should only return the report with existing subject
+        response = self.get(url_for("api.reports", handled="false"))
+        self.assert200(response)
+        payload = response.json
+        self.assertEqual(payload["total"], 1)
+        self.assertEqual(payload["data"][0]["id"], str(ongoing_report.id))
+
+        # Filter by handled - should return the report with deleted subject
+        response = self.get(url_for("api.reports", handled="true"))
+        self.assert200(response)
+        payload = response.json
+        self.assertEqual(payload["total"], 1)
+        self.assertEqual(payload["data"][0]["id"], str(deleted_subject_report.id))

udata/tests/api/test_user_api.py

@@ -382,7 +382,7 @@ class UserAPITest(APITestCase):
             response = self.delete(url_for("api.user", user=user_to_delete))
             self.assertEqual(list(storages.avatars.list_files()), [])
             self.assert204(response)
-            self.assertEquals(len(mails), 1)
+            self.assertEqual(len(mails), 1)
 
         user_to_delete.reload()
         response = self.delete(url_for("api.user", user=user_to_delete))

udata/tests/apiv2/test_dataservices.py

@@ -0,0 +1,14 @@
+from udata.core.dataservices.factories import DataserviceFactory
+from udata.tests.api import APITestCase
+
+
+class DataserviceSearchAPIV2Test(APITestCase):
+    def test_dataservice_search_with_model_query_param(self):
+        """Searching dataservices with 'model' as query param should not crash.
+
+        Regression test for: TypeError: query() got multiple values for argument 'model'
+        """
+        DataserviceFactory.create_batch(3)
+
+        response = self.get("/api/2/dataservices/search/?model=malicious")
+        self.assert200(response)

udata/tests/apiv2/test_organizations.py

@@ -4,6 +4,15 @@ from udata.core.organization.factories import Member, OrganizationFactory
 from udata.tests.api import APITestCase
 
 
+class OrganizationSearchAPIV2Test(APITestCase):
+    def test_organization_search_with_model_query_param(self):
+        """Searching organizations with 'model' as query param should not crash."""
+        OrganizationFactory.create_batch(3)
+
+        response = self.get("/api/2/organizations/search/?model=malicious")
+        self.assert200(response)
+
+
 class OrganizationExtrasAPITest(APITestCase):
     def setUp(self):
         self.login()

udata/tests/apiv2/test_reuses.py

@@ -0,0 +1,11 @@
+from udata.core.reuse.factories import ReuseFactory
+from udata.tests.api import APITestCase
+
+
+class ReuseSearchAPIV2Test(APITestCase):
+    def test_reuse_search_with_model_query_param(self):
+        """Searching reuses with 'model' as query param should not crash."""
+        ReuseFactory.create_batch(3)
+
+        response = self.get("/api/2/reuses/search/?model=malicious")
+        self.assert200(response)

udata/tests/cli/test_cli_base.py

@@ -4,7 +4,6 @@ from udata.tests import PytestOnlyTestCase
 class CliBaseTest(PytestOnlyTestCase):
     def test_cli_help(self):
         """Should display help without errors"""
-        self.cli()
         self.cli("-?")
         self.cli("-h")
         self.cli("--help")

udata/tests/dataservice/test_dataservice_tasks.py

@@ -43,3 +43,32 @@ class DataserviceTasksTest(PytestOnlyDBTestCase):
         assert Discussion.objects.filter(id=discussion.id).count() == 0
         assert Follow.objects.filter(id=follower.id).count() == 0
         assert HarvestJob.objects.filter(items__dataservice=dataservices[0].id).count() == 0
+
+    def test_purge_dataservices_cleans_all_harvest_items_references(self):
+        """Test that purging dataservices cleans all HarvestItem references in a job.
+
+        The same dataservice can appear multiple times in a job's items (e.g. if the
+        harvest source has duplicates). The $ operator only updates the first match,
+        so we need to use $[] with array_filters to update all matches.
+        """
+        dataservice_to_delete = Dataservice.objects.create(
+            title="delete me", base_api_url="https://example.com/api", deleted_at="2016-01-01"
+        )
+        dataservice_keep = Dataservice.objects.create(
+            title="keep me", base_api_url="https://example.com/api"
+        )
+
+        job = HarvestJobFactory(
+            items=[
+                HarvestItem(dataservice=dataservice_to_delete, remote_id="1"),
+                HarvestItem(dataservice=dataservice_keep, remote_id="2"),
+                HarvestItem(dataservice=dataservice_to_delete, remote_id="3"),
+            ]
+        )
+
+        tasks.purge_dataservices()
+
+        job.reload()
+        assert job.items[0].dataservice is None
+        assert job.items[1].dataservice == dataservice_keep
+        assert job.items[2].dataservice is None

udata/tests/dataset/test_dataset_model.py

@@ -1,4 +1,4 @@
-from datetime import date, datetime, timedelta
+from datetime import date, datetime, timedelta, timezone
 from uuid import uuid4
 
 import pytest
@@ -206,6 +206,18 @@ class DatasetModelTest(PytestOnlyDBTestCase):
         assert dataset.quality["update_fulfilled_in_time"] is False
         assert dataset.quality["score"] == Dataset.normalize_score(1)
 
+    def test_quality_frequency_update_with_harvest_timezone_aware(self):
+        """Test that update_fulfilled_in_time works with timezone-aware harvest dates."""
+        dataset = DatasetFactory(
+            description="",
+            frequency=UpdateFrequency.DAILY,
+            harvest=HarvestDatasetMetadata(
+                modified_at=datetime.now(timezone.utc) - timedelta(hours=1),
+            ),
+        )
+        assert dataset.quality["update_frequency"] is True
+        assert dataset.quality["update_fulfilled_in_time"] is True
+
     def test_quality_description_length(self):
         dataset = DatasetFactory(
             description="a" * (current_app.config.get("QUALITY_DESCRIPTION_LENGTH") - 1)

udata/tests/dataset/test_dataset_rdf.py

@@ -518,6 +518,22 @@ class RdfToDatasetTest(PytestOnlyDBTestCase):
         assert isinstance(dataset, Dataset)
         assert dataset.harvest.modified_at is None
 
+    def test_unparseable_modified_at(self):
+        """Regression test: template strings like {{modified:toISO}} should not crash parsing."""
+        node = BNode()
+        g = Graph()
+
+        g.add((node, RDF.type, DCAT.Dataset))
+        g.add((node, DCT.identifier, Literal(faker.uuid4())))
+        g.add((node, DCT.title, Literal(faker.sentence())))
+        g.add((node, DCT.modified, Literal("{{modified:toISO}}")))
+
+        dataset = dataset_from_rdf(g)
+        dataset.validate()
+
+        assert isinstance(dataset, Dataset)
+        assert dataset.harvest.modified_at is None
+
     def test_contact_point_individual_vcard(self):
         g = Graph()
         node = URIRef("https://test.org/dataset")
@@ -643,10 +659,10 @@ class RdfToDatasetTest(PytestOnlyDBTestCase):
 
         assert len(dataset.contact_points) == 1
         assert dataset.contact_points[0].role == "contact"
-        assert dataset.contact_points[0].name == "foo"
+        assert dataset.contact_points[0].name == "foo (bar)"
         assert dataset.contact_points[0].email == "foo@example.com"
 
-    def test_contact_point_organization_member_foaf(self):
+    def test_contact_point_organization_member_foaf_both_mails(self):
         g = Graph()
         node = URIRef("https://test.org/dataset")
         g.set((node, RDF.type, DCAT.Dataset))
@@ -673,10 +689,10 @@ class RdfToDatasetTest(PytestOnlyDBTestCase):
 
         assert len(dataset.contact_points) == 1
         assert dataset.contact_points[0].role == "creator"
-        assert dataset.contact_points[0].name == "foo"
+        assert dataset.contact_points[0].name == "foo (bar)"
         assert dataset.contact_points[0].email == "foo@example.com"
 
-    def test_contact_point_organization_member_foaf_no_mail(self):
+    def test_contact_point_organization_member_foaf_no_org_mail(self):
         g = Graph()
         node = URIRef("https://test.org/dataset")
         g.set((node, RDF.type, DCAT.Dataset))
@@ -703,9 +719,39 @@ class RdfToDatasetTest(PytestOnlyDBTestCase):
 
         assert len(dataset.contact_points) == 1
         assert dataset.contact_points[0].role == "creator"
-        assert dataset.contact_points[0].name == "foo"
+        assert dataset.contact_points[0].name == "foo (bar)"
         assert dataset.contact_points[0].email == "foo@example.com"
 
+    def test_contact_point_organization_member_foaf_no_agent_mail(self):
+        g = Graph()
+        node = URIRef("https://test.org/dataset")
+        g.set((node, RDF.type, DCAT.Dataset))
+        g.set((node, DCT.identifier, Literal(faker.uuid4())))
+        g.set((node, DCT.title, Literal(faker.sentence())))
+
+        org = BNode()
+        g.add((org, RDF.type, FOAF.Organization))
+        g.add((org, FOAF.name, Literal("bar")))
+        g.add((org, FOAF.mbox, Literal("bar@example.com")))
+        contact = BNode()
+        g.add((contact, RDF.type, FOAF.Person))
+        g.add((contact, FOAF.name, Literal("foo")))
+        # no agent email
+        g.add((contact, ORG.memberOf, org))
+        g.add((node, DCT.creator, contact))
+
+        # Dataset needs an owner/organization for contact_points_from_rdf() to work
+        d = DatasetFactory.build()
+        d.organization = OrganizationFactory(name="organization")
+
+        dataset = dataset_from_rdf(g, d)
+        dataset.validate()
+
+        assert len(dataset.contact_points) == 1
+        assert dataset.contact_points[0].role == "creator"
+        assert dataset.contact_points[0].name == "foo (bar)"
+        assert dataset.contact_points[0].email == "bar@example.com"
+
     def test_theme_and_tags(self):
         node = BNode()
         g = Graph()
@@ -725,6 +771,22 @@ class RdfToDatasetTest(PytestOnlyDBTestCase):
         assert isinstance(dataset, Dataset)
         assert set(dataset.tags) == set(tags + themes)
 
+    def test_keyword_as_uriref(self):
+        """Regression test: keywords can be URIRef instead of Literal in some DCAT feeds."""
+        node = BNode()
+        g = Graph()
+
+        g.add((node, RDF.type, DCAT.Dataset))
+        g.add((node, DCT.title, Literal(faker.sentence())))
+        g.add((node, DCAT.keyword, Literal("literal-tag")))
+        g.add((node, DCAT.keyword, URIRef("http://example.org/keyword/uriref-tag")))
+
+        dataset = dataset_from_rdf(g)
+        dataset.validate()
+
+        assert isinstance(dataset, Dataset)
+        assert "literal-tag" in dataset.tags
+
     def test_parse_null_frequency(self):
         assert frequency_from_rdf(None) is None
 
@@ -818,6 +880,39 @@ class RdfToDatasetTest(PytestOnlyDBTestCase):
         assert resource.harvest.modified_at.date() == modified.date()
         assert resource.format == "csv"
 
+    def test_resource_future_modified_at(self):
+        node = BNode()
+        g = Graph()
+
+        modified = faker.future_datetime()
+
+        g.add((node, RDF.type, DCAT.Distribution))
+        g.add((node, DCT.title, Literal(faker.sentence())))
+        g.add((node, DCAT.downloadURL, Literal(faker.uri())))
+        g.add((node, DCT.modified, Literal(modified)))
+
+        resource = resource_from_rdf(g)
+        resource.validate()
+
+        assert isinstance(resource, Resource)
+        assert resource.harvest.modified_at is None
+
+    def test_resource_unparseable_modified_at(self):
+        """Regression test: template strings like {{modified:toISO}} should not crash parsing."""
+        node = BNode()
+        g = Graph()
+
+        g.add((node, RDF.type, DCAT.Distribution))
+        g.add((node, DCT.title, Literal(faker.sentence())))
+        g.add((node, DCAT.downloadURL, Literal(faker.uri())))
+        g.add((node, DCT.modified, Literal("{{modified:toISO}}")))
+
+        resource = resource_from_rdf(g)
+        resource.validate()
+
+        assert isinstance(resource, Resource)
+        assert resource.harvest.modified_at is None
+
     def test_download_url_over_access_url(self):
         node = BNode()
         g = Graph()
@@ -1364,6 +1459,70 @@ class DatasetRdfViewsTest(PytestOnlyAPITestCase):
         assert200(response)
         assert response.content_type == mime
 
+    @pytest.mark.parametrize(
+        "fmt,mime",
+        [
+            ("n3", "text/n3"),
+            ("nt", "application/n-triples"),
+            ("ttl", "application/x-turtle"),
+            ("xml", "application/rdf+xml"),
+            ("rdf", "application/rdf+xml"),
+            ("owl", "application/rdf+xml"),
+            ("trig", "application/trig"),
+        ],
+    )
+    def test_dont_fail_with_invalid_uri(self, client, fmt, mime):
+        """Invalid URIs (with spaces or curly brackets) shouldn't make rdf export fail in any format"""
+        invalid_uri_with_quote = 'https://test.org/dataset_with"quote"'
+        invalid_uri_with_curly_bracket = 'http://opendata-sig.saintdenis.re/datasets/identifiant.kml?outSR={"latestWkid":2975,"wkid":2975}'
+        invalid_uri_with_space = "https://catalogue.opendata-ligair.fr/geonetwork/srv/60678572-36e5-4e78-9af3-48f726670dfd fr-modelisation-sirane-vacarm_no2"
+        dataset = DatasetFactory(
+            resources=[
+                ResourceFactory(url=invalid_uri_with_quote),
+                ResourceFactory(url=invalid_uri_with_curly_bracket),
+            ],
+            harvest=HarvestDatasetMetadata(uri=invalid_uri_with_space),
+        )
+
+        url = url_for("api.dataset_rdf_format", dataset=dataset, _format=fmt)
+        response = client.get(url, headers={"Accept": mime})
+        assert200(response)
+
+    @pytest.mark.parametrize(
+        "fmt,mime",
+        [
+            ("n3", "text/n3"),
+            ("nt", "application/n-triples"),
+            ("ttl", "application/x-turtle"),
+            ("trig", "application/trig"),
+        ],
+    )
+    def test_invalid_uri_escape_in_n3_turtle_format(self, client, fmt, mime):
+        """Invalid URIs (with spaces or curly brackets) should be escaped in N3/turtle formats"""
+        invalid_uri_with_quote = 'https://test.org/dataset_with"quote"'
+        invalid_uri_with_curly_bracket = 'http://opendata-sig.saintdenis.re/datasets/identifiant.kml?outSR={"latestWkid":2975,"wkid":2975}'
+        invalid_uri_with_space = "https://catalogue.opendata-ligair.fr/geonetwork/srv/60678572-36e5-4e78-9af3-48f726670dfd fr-modelisation-sirane-vacarm_no2"
+        dataset = DatasetFactory(
+            resources=[
+                ResourceFactory(url=invalid_uri_with_quote),
+                ResourceFactory(url=invalid_uri_with_curly_bracket),
+            ],
+            harvest=HarvestDatasetMetadata(uri=invalid_uri_with_space),
+        )
+
+        url = url_for("api.dataset_rdf_format", dataset=dataset, _format=fmt)
+        response = client.get(url, headers={"Accept": mime})
+        assert200(response)
+        assert "https://test.org/dataset_with%22quote%22" in response.text
+        assert (
+            "http://opendata-sig.saintdenis.re/datasets/identifiant.kml?outSR=%7B%22latestWkid%22:2975,%22wkid%22:2975%7D"
+            in response.text
+        )
+        assert (
+            "https://catalogue.opendata-ligair.fr/geonetwork/srv/60678572-36e5-4e78-9af3-48f726670dfd%20fr-modelisation-sirane-vacarm_no2"
+            in response.text
+        )
+
 
 class DatasetFromRdfUtilsTest(PytestOnlyTestCase):
     def test_licenses_from_rdf(self):

udata/tests/dataset/test_dataset_tasks.py

@@ -60,6 +60,31 @@ class DatasetTasksTest(PytestOnlyDBTestCase):
         assert HarvestJob.objects.filter(items__dataset=datasets[0].id).count() == 0
         assert Dataservice.objects.filter(datasets=datasets[0].id).count() == 0
 
+    def test_purge_datasets_cleans_all_harvest_items_references(self):
+        """Test that purging datasets cleans all HarvestItem references in a job.
+
+        The same dataset can appear multiple times in a job's items (e.g. if the
+        harvest source has duplicates). The $ operator only updates the first match,
+        so we need to use $[] with array_filters to update all matches.
+        """
+        dataset_to_delete = Dataset.objects.create(title="delete me", deleted="2016-01-01")
+        dataset_keep = Dataset.objects.create(title="keep me")
+
+        job = HarvestJobFactory(
+            items=[
+                HarvestItem(dataset=dataset_to_delete, remote_id="1"),
+                HarvestItem(dataset=dataset_keep, remote_id="2"),
+                HarvestItem(dataset=dataset_to_delete, remote_id="3"),
+            ]
+        )
+
+        tasks.purge_datasets()
+
+        job.reload()
+        assert job.items[0].dataset is None
+        assert job.items[1].dataset == dataset_keep
+        assert job.items[2].dataset is None
+
     def test_purge_datasets_community(self):
         dataset = Dataset.objects.create(title="delete me", deleted="2016-01-01")
         community_resource1 = CommunityResourceFactory()

udata/tests/frontend/test_auth.py

@@ -1,7 +1,7 @@
 from flask import current_app, url_for
 from flask_security.utils import hash_data
 
-from udata.core.user.factories import AdminFactory
+from udata.core.user.factories import AdminFactory, UserFactory
 from udata.tests.api import APITestCase
 
 
@@ -22,3 +22,60 @@ class AuthTest(APITestCase):
 
         user.reload()
         assert user.email == new_email
+
+    def test_change_mail_already_taken(self):
+        """Should not allow changing email to one already taken by another user"""
+        user = self.login(AdminFactory())
+        original_email = user.email
+
+        # Create another user with the target email
+        existing_user = UserFactory(email="taken@example.com")
+        new_email = existing_user.email
+
+        security = current_app.extensions["security"]
+
+        data = [str(user.fs_uniquifier), hash_data(user.email), new_email]
+        token = security.confirm_serializer.dumps(data)
+        confirmation_link = url_for("security.confirm_change_email", token=token)
+
+        resp = self.get(confirmation_link)
+        assert resp.status_code == 302
+        assert "change_email_already_taken" in resp.location
+
+        # Email should not have changed
+        user.reload()
+        assert user.email == original_email
+
+    def test_change_mail_after_password_change(self):
+        """Changing password rotates fs_uniquifier and invalidates email change token"""
+        user = UserFactory(password="Password123")
+        self.login(user)
+        old_uniquifier = user.fs_uniquifier
+
+        new_email = "new@example.com"
+
+        security = current_app.extensions["security"]
+
+        data = [str(user.fs_uniquifier), hash_data(user.email), new_email]
+        token = security.confirm_serializer.dumps(data)
+        confirmation_link = url_for("security.confirm_change_email", token=token)
+
+        # Change password via API
+        resp = self.post(
+            url_for("security.change_password"),
+            {
+                "password": "Password123",
+                "new_password": "NewPassword456",
+                "new_password_confirm": "NewPassword456",
+                "submit": True,
+            },
+        )
+        assert resp.status_code == 200, f"Password change failed: {resp.data}"
+
+        user.reload()
+        assert user.fs_uniquifier != old_uniquifier, "fs_uniquifier should have changed"
+
+        # Now try to use the email change link - should fail
+        resp = self.get(confirmation_link)
+        assert resp.status_code == 302
+        assert "change_email_invalid" in resp.location

udata/tests/frontend/test_csv.py

@@ -269,7 +269,6 @@ class CsvTest(APITestCase):
 
         self.assert200(response)
         self.assertEqual(response.mimetype, "text/csv")
-        self.assertEqual(response.charset, "utf-8")
 
         csvfile = StringIO(response.data.decode("utf8"))
         reader = csv.get_reader(csvfile)
@@ -327,7 +326,6 @@ class CsvTest(APITestCase):
 
         self.assert200(response)
         self.assertEqual(response.mimetype, "text/csv")
-        self.assertEqual(response.charset, "utf-8")
 
         csvfile = StringIO(response.data.decode("utf8"))
         reader = csv.get_reader(csvfile)
@@ -349,7 +347,6 @@ class CsvTest(APITestCase):
 
         self.assert200(response)
         self.assertEqual(response.mimetype, "text/csv")
-        self.assertEqual(response.charset, "utf-8")
 
         csvfile = StringIO(response.data.decode("utf8"))
         reader = csv.get_reader(csvfile)