fix(tests): isolate session route import stubs

Keeps src.request_models real and restores both sys.modules and parent routes.session_routes package attributes after temporary test stubs. Restores one focused part of the Python CI baseline tracked in #2580.

tests/test_security_regressions.py

@@ -1015,50 +1015,37 @@ def test_gmail_mcp_preset_uses_contained_oauth_paths():
 
 # -- export/gallery filename hardening ----------------------------------------
 
-def _install_route_import_stubs(monkeypatch):
-    core_mod = types.ModuleType("core")
-    core_mod.__path__ = []
-
-    db_mod = types.ModuleType("core.database")
-    db_mod.SessionLocal = lambda: None
-    for name in (
-        "Session",
-        "Document",
-        "GalleryImage",
-        "GalleryAlbum",
-        "ModelEndpoint",
-    ):
-        setattr(db_mod, name, type(name, (), {}))
-
-    session_manager_mod = types.ModuleType("core.session_manager")
-    session_manager_mod.SessionManager = type("SessionManager", (), {})
-
-    models_mod = types.ModuleType("core.models")
-    models_mod.ChatMessage = type("ChatMessage", (), {})
-
-    monkeypatch.setitem(sys.modules, "core", core_mod)
-    monkeypatch.setitem(sys.modules, "core.database", db_mod)
-    monkeypatch.setitem(sys.modules, "core.session_manager", session_manager_mod)
-    monkeypatch.setitem(sys.modules, "core.models", models_mod)
+def _drop_route_module_cache(dotted_name):
+    """Evict a cached route module from both sys.modules and the parent package
+    attribute. The next import then re-binds against the live core.database
+    instead of reusing a stale (possibly stub-polluted) module object — Python
+    can reach a module via either path, so both must be cleared."""
+    sys.modules.pop(dotted_name, None)
+    pkg_name, _, attr = dotted_name.rpartition(".")
+    pkg = sys.modules.get(pkg_name)
+    if pkg is not None and hasattr(pkg, attr):
+        delattr(pkg, attr)
 
 
-def _import_session_routes_for_filename(monkeypatch):
-    _install_route_import_stubs(monkeypatch)
-    monkeypatch.delitem(sys.modules, "routes.session_routes", raising=False)
-    from routes import session_routes
-    return session_routes
+def _import_session_routes_for_filename():
+    # Only the pure _sanitize_export_filename helper is exercised here, so import
+    # against the REAL core.database. Importing under a stub Session class would
+    # leak a stub-bound DbSession into the cached module and break later tests
+    # that reuse routes.session_routes (e.g. the archived-sessions filter).
+    _drop_route_module_cache("routes.session_routes")
+    return importlib.import_module("routes.session_routes")
 
 
-def _import_gallery_routes_for_filename(monkeypatch):
-    _install_route_import_stubs(monkeypatch)
-    monkeypatch.delitem(sys.modules, "routes.gallery_helpers", raising=False)
-    monkeypatch.delitem(sys.modules, "routes.gallery_routes", raising=False)
-    from routes import gallery_routes
-    return gallery_routes
+def _import_gallery_routes_for_filename():
+    # Same rationale as the session route helper: import _sanitize_gallery_filename
+    # against the real core.database and leave a clean, real module cached.
+    _drop_route_module_cache("routes.gallery_routes")
+    _drop_route_module_cache("routes.gallery_helpers")
+    return importlib.import_module("routes.gallery_routes")
 
 
-def test_export_filename_sanitizer_blocks_header_and_path_chars(monkeypatch):
-    mod = _import_session_routes_for_filename(monkeypatch)
+def test_export_filename_sanitizer_blocks_header_and_path_chars():
+    mod = _import_session_routes_for_filename()
 
     out = mod._sanitize_export_filename('chat.md\r\nX-Test: yes/..\\evil;quote".txt\x00')
 
@@ -1068,15 +1055,15 @@ def test_export_filename_sanitizer_blocks_header_and_path_chars(monkeypatch):
         assert ch not in out
 
 
-def test_export_filename_sanitizer_preserves_safe_names(monkeypatch):
-    mod = _import_session_routes_for_filename(monkeypatch)
+def test_export_filename_sanitizer_preserves_safe_names():
+    mod = _import_session_routes_for_filename()
 
     assert mod._sanitize_export_filename("conversation_20260602.md") == "conversation_20260602.md"
     assert mod._sanitize_export_filename("") == ""
 
 
-def test_gallery_replace_filename_sanitizer_uses_basename(monkeypatch):
-    mod = _import_gallery_routes_for_filename(monkeypatch)
+def test_gallery_replace_filename_sanitizer_uses_basename():
+    mod = _import_gallery_routes_for_filename()
 
     out = mod._sanitize_gallery_filename("../../etc/cron.d/evil image.png")
 
@@ -1086,7 +1073,7 @@ def test_gallery_replace_filename_sanitizer_uses_basename(monkeypatch):
 
 
 def test_gallery_replace_filename_sanitizer_falls_back_when_empty(monkeypatch):
-    mod = _import_gallery_routes_for_filename(monkeypatch)
+    mod = _import_gallery_routes_for_filename()
     monkeypatch.setattr(mod.uuid, "uuid4", lambda: types.SimpleNamespace(hex="abcdef1234567890"))
 
     assert mod._sanitize_gallery_filename("../") == "abcdef123456"