fix(vector-sync): address PR review — dict guard, symmetric backstop, metrics

- purge route: 400 (not 500) on a valid-JSON non-object body
- scanner: backstop-purge admin-disabled note/news_item/deck_card points
  (their deletion-tracking lives inside the skipped scan_* fns), mirroring the
  files path; gated on a concrete allow-set so fail-open never deletes
- processor: record_ingest_dropped("admin_disabled") so consent-skipped index
  tasks are observable/alertable
- app.py: list /api/v1/vector-sync/purge in the endpoints log line
- capabilities: drop empty-string doc types; return frozenset throughout
- purge: document the count-before-delete approximation
- tests: non-object body -> 400, ProvisioningRequiredError -> 428, cache TTL
  expiry refetch, and the scanner consent backstop

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/vector/test_purge.py

@@ -20,10 +20,12 @@ def _patch_qdrant(monkeypatch, *, counts: dict[str, int], delete_raises=None):
     def _doc_type_of(flt):
         return flt.must[0].match.value
 
-    async def fake_count(*, collection_name, count_filter, exact):
+    # Sync side_effects: AsyncMock awaits the call and returns the value, so the
+    # helpers don't need to be coroutines themselves.
+    def fake_count(*, collection_name, count_filter, exact):
         return SimpleNamespace(count=counts.get(_doc_type_of(count_filter), 0))
 
-    async def fake_delete(*, collection_name, points_selector):
+    def fake_delete(*, collection_name, points_selector):
         dt = _doc_type_of(points_selector)
         if delete_raises and dt in delete_raises:
             raise RuntimeError(f"delete failed for {dt}")
@@ -31,10 +33,9 @@ def _patch_qdrant(monkeypatch, *, counts: dict[str, int], delete_raises=None):
     client.count.side_effect = fake_count
     client.delete.side_effect = fake_delete
 
-    async def fake_get_qdrant_client():
-        return client
-
-    monkeypatch.setattr(purge_module, "get_qdrant_client", fake_get_qdrant_client)
+    monkeypatch.setattr(
+        purge_module, "get_qdrant_client", AsyncMock(return_value=client)
+    )
     monkeypatch.setattr(
         purge_module,
         "get_settings",

tests/unit/vector/test_scanner_consent_backstop.py

@@ -0,0 +1,81 @@
+"""Unit tests for the scanner's admin-consent backstop deletion.
+
+When an admin disables a text source (note/news_item/deck_card), the scanner
+skips its scan_* function, so the in-function deletion-tracking never runs. The
+backstop enqueues deletes for any indexed points of the disabled type, mirroring
+the files path — but only on a concrete allow-set (never on fail-open None).
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from typing import cast
+from unittest.mock import AsyncMock
+
+from nextcloud_mcp_server.vector import scanner as scanner_module
+from nextcloud_mcp_server.vector.queue.ports import TaskProducer
+from nextcloud_mcp_server.vector.scanner import _enqueue_deletes_for_disabled_types
+
+
+def _producer(send: AsyncMock) -> TaskProducer:
+    """A minimal stand-in for the TaskProducer protocol (only ``send`` is used)."""
+    return cast(TaskProducer, SimpleNamespace(send=send))
+
+
+def _patch_qdrant(monkeypatch, points_by_type: dict[str, list[str]]):
+    client = AsyncMock()
+
+    def fake_scroll(
+        *, collection_name, scroll_filter, with_payload, with_vectors, limit, offset
+    ):
+        # must=[user_id, doc_type] — doc_type is the second condition.
+        doc_type = scroll_filter.must[1].match.value
+        points = [
+            SimpleNamespace(payload={"doc_id": doc_id})
+            for doc_id in points_by_type.get(doc_type, [])
+        ]
+        return (points, None)
+
+    client.scroll.side_effect = fake_scroll
+    monkeypatch.setattr(
+        scanner_module, "get_qdrant_client", AsyncMock(return_value=client)
+    )
+    monkeypatch.setattr(
+        scanner_module,
+        "get_settings",
+        lambda: SimpleNamespace(get_collection_name=lambda: "c"),
+    )
+
+
+async def test_enqueues_deletes_for_disabled_text_type(monkeypatch):
+    _patch_qdrant(monkeypatch, {"note": ["n1", "n2"], "deck_card": ["d1"]})
+    sent: list = []
+    stream = _producer(AsyncMock(side_effect=lambda t: sent.append(t)))
+
+    # note disabled; news_item + deck_card still allowed.
+    allowed = frozenset({"file", "news_item", "deck_card"})
+    queued = await _enqueue_deletes_for_disabled_types("alice", stream, allowed, 1)
+
+    assert queued == 2
+    assert {t.doc_id for t in sent} == {"n1", "n2"}
+    assert all(t.operation == "delete" and t.doc_type == "note" for t in sent)
+
+
+async def test_noop_when_allowed_is_none(monkeypatch):
+    # Fail-open: a transient capability read must never trigger deletion.
+    send = AsyncMock()
+    queued = await _enqueue_deletes_for_disabled_types(
+        "alice", _producer(send), None, 1
+    )
+    assert queued == 0
+    send.assert_not_called()
+
+
+async def test_noop_when_all_text_types_allowed(monkeypatch):
+    send = AsyncMock()
+    allowed = frozenset({"note", "news_item", "deck_card", "file"})
+    queued = await _enqueue_deletes_for_disabled_types(
+        "alice", _producer(send), allowed, 1
+    )
+    assert queued == 0
+    send.assert_not_called()