test(unit): convert source-scrape tests to behavioral — batch F (#800)

[hellodk]

Summary

Closes / contributes to #800 (TST-4 — eliminate source-scrape unit tests).

Reviewed all six batch-F files against the triage rubric. Five files were already
fully behavioralized by batch B; one file had a remaining vacuous inline pattern
that is fixed here.

---

Per-file breakdown

test_salt_master_probe_517.py — no changes needed

All assertions were already behavioral (mocked socket/requests/DB, asserting
returned dicts). Zero inspect.getsource / source-string patterns found.

test_salt_master_ssot_562.py — no changes needed

The AST source-scanning TestGrepGuardSaltTasks (which used ast.parse /
node.s to scan salt_tasks.py for SALT_API_* literals) was converted in
batch B to behavioral tests that set SALT_API_* env vars, call _run_salt_api
with a DB-credential stub, and assert the actual URL/username/password used.
The _get_bootstrap_settings SALT_MASTER guard was converted to an
instrumented mock DB that records queried keys.

test_promote_topology_560.py — no changes needed

Route auth checks already use inspect.signature + FastAPI Depends
introspection (not source text). All topology/minion tests drive live async
route handlers against mock DB sessions.

test_provision_master_557.py — no changes needed

OS detection, SSH-unreachable, success, exception, and reaper tests all call
provision_master / reap_orphaned_master_provisions with mocked
ansible_runner / run_probe. Route auth check uses signature introspection.

test_provision_status_endpoint_558.py — no changes needed

Route registration, GET method, auth guard, and four endpoint behavior tests all
call get_provision_status directly via mocked async DB. The TypeScript
provisionRefetchInterval helper is exercised via node --experimental-strip-types.

test_sre_hardening.py — converted 1 vacuous test

Test	Action
test_login_route_source_contains_must_change_password_gate	Removed in batch B (used inspect.getsource(login))
test_login_route_checks_must_change_password_flag	Converted — was a self-referential inline that simply raised + caught HTTPException without ever calling the login route. Replaced with test_login_route_returns_token_for_valid_credentials which drives the unwrapped login handler with a user having must_change_password=False, mocks DB + audit, and asserts access_token + refresh_token are returned. Complements the adjacent test_login_route_raises_403_for_must_change_password.
All other tests	Kept — already behavioral (middleware, metrics auth, rate-limiter key, seeding guards, User model, Settings fields)

Test results

142 passed, 4 warnings in 2.45s

No source-scrape patterns (inspect.getsource, ast.parse/node.s, "X" in source) remain in any of the six files.

Made with Cursor

[github-actions]

Coverage Report

✅ fleet_platform/services/ 85.0% (gate: 80%)

✅ fleet_platform/agent/ 94.8% (gate: 80%)

Gate passed

[github-actions]

Coverage Report

✅ fleet_platform/services/ 85.0% (gate: 80%)

✅ fleet_platform/agent/ 94.8% (gate: 80%)

Gate passed

[github-actions]

Coverage Report

✅ fleet_platform/services/ 85.0% (gate: 80%)

✅ fleet_platform/agent/ 94.8% (gate: 80%)

Gate passed