harden deploy reports and admin alerts

tests/test_admin_control_center.py

@@ -247,3 +247,54 @@ async def test_pending_sto_queue_and_approve_audit(
     assert approved.status_code == 200
     assert approved.json()["verification_status"] == "approved"
     assert any(item["action"] == "service_center.verify" for item in audit.json())
+
+
+@pytest.mark.asyncio
+async def test_blocked_ocr_upload_creates_admin_notification(
+    client, auth_headers, admin_auth_headers, internal_headers
+) -> None:
+    await ensure_admin(client, internal_headers)
+
+    response = await client.post(
+        "/api/ocr/vin",
+        headers=auth_headers,
+        files={"file": ("invoice.exe", b"not an image", "image/jpeg")},
+    )
+    notifications = await client.get("/api/admin/notifications?limit=100", headers=admin_auth_headers)
+
+    assert response.status_code == 415
+    assert any(item["event_type"] == "upload_blocked" for item in notifications.json()["rows"])
+
+
+@pytest.mark.asyncio
+async def test_rate_limit_creates_admin_notification(
+    client, auth_headers, admin_auth_headers, internal_headers
+) -> None:
+    await ensure_admin(client, internal_headers)
+
+    last_response = None
+    for index in range(9):
+        last_response = await client.post(
+            "/api/ocr/vin",
+            headers=auth_headers,
+            files={"file": (f"vin-{index}.txt", b"VIN KMHCT41BAHU123456", "text/plain")},
+        )
+    notifications = await client.get("/api/admin/notifications?limit=100", headers=admin_auth_headers)
+
+    assert last_response is not None
+    assert last_response.status_code == 429
+    assert any(item["event_type"] == "rate_limit_exceeded" for item in notifications.json()["rows"])
+
+
+@pytest.mark.asyncio
+async def test_admin_can_retry_notification_queues(
+    client, admin_auth_headers, internal_headers
+) -> None:
+    await ensure_admin(client, internal_headers)
+
+    response = await client.post("/api/admin/notifications/retry", headers=admin_auth_headers)
+    audit = await client.get("/api/admin/audit-log?action=admin.notifications.retry", headers=admin_auth_headers)
+
+    assert response.status_code == 200
+    assert {"service_delivered", "admin_delivered", "limit"} <= response.json().keys()
+    assert any(item["action"] == "admin.notifications.retry" for item in audit.json())