clean remaining mock session #44973

The file-by-file list is below, scoped to SQLAlchemy session, engine, query and result doubles in api/tests/unit_tests/ on checkout 1f500e52cc. This is not a count of every Mock or ORM-model stand-in: those would include unrelated external-service tests.

I separated persistence scenarios from deliberate failure/no-DB tests so contributors do not remove useful coverage just to eliminate mocks.

Persistence scenarios to convert first

All paths below are relative to api/tests/unit_tests/.

File	Remaining double / change to make
tasks/test_remove_app_and_related_data_task.py	_FakeSessionFactory queues fabricated SQL results. Seed offload/upload records and assert deletion against SQLite; preserve the storage-outside-transaction check. [1]
services/agent/test_home_snapshot_service.py	_apply_with_client_error uses a mocked session and a SimpleNamespace lookup result. Seed the lookup record before exercising the backend error. [2]
services/agent/test_workflow_publish_service.py	Published-binding copy uses mocked scalar/scalars results and inspects session.add. Persist the agent and bindings, then query the copied binding. [3]
services/agent/test_knowledge_gateway.py	_ScalarsSession returns preloaded snapshots without executing the query. Replace it with persisted snapshots. [4]
services/test_agent_service.py	_ScriptedSession returns conversation/message/account results in call order and ignores SQL. Seed the real ownership chain. [5]
services/knowledge_fs/test_query_images.py	_Session and _install_files bypass file lookup and commit behavior. Persist upload/tool-file records instead. [6]
services/knowledge_fs/test_service_query_image_upload.py	_Session manually interprets compiled query parameters and records adds/commits. Exercise token lookup and upload persistence through SQLite. [7]
services/knowledge_fs/test_revocation_commands.py	ScriptedSession explicitly ignores statements and replays queued results. Seed authorization/revocation records. [8]
services/test_skill_management_service.py	Runtime skill listing fabricates the joined rows returned by session.execute. Seed binding, skill, version and tool-file rows. [9]
services/tools/test_mcp_tools_manage_service.py	The shared session fixture is a Mock; lookup tests inspect SQL strings. Use persisted providers and decoy tenants/identifiers to verify actual lookup behavior. [10]
services/test_app_package_service.py	Icon import captures add_all arguments from a mocked session. Query the persisted destination-owned upload instead. [11]
core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline.py	Local _Session / _Result classes return message/upload rows by call order. Replace these with persisted file associations. [12]
core/rag/retrieval/test_dataset_retrieval.py	The foreign-dataset rejection test still supplies a fabricated session.scalar result. Persist both allowed and foreign datasets. Keep deadlock injection as a separate concern. [13] [14]
core/workflow/nodes/agent/test_message_transformer.py	Tool-file lookup uses mocked Session contexts and fabricated metadata. Seed existing/missing tool-file cases. [15]
controllers/console/app/test_workflow.py	Publish/delete tests replace sessions and transaction contexts. Use real app/workflow rows and real transactions where testing persistence. [16]
controllers/console/datasets/rag_pipeline/test_rag_pipeline_workflow.py	Node-execution response construction uses a mocked session returning None. Build the response with a real session. [17]
controllers/common/test_access_response.py	MCP request cases script session.scalar responses. Seed MCP server/app records for lookup-backed cases. [18]

Additional files with DB doubles, but not blanket persistence migrations

These need a narrower decision at the individual test level:

File	Treatment
services/test_app_dsl_service.py	Mocked session verifies validation exits before mutation. Consider unbound_session, retaining the early-exit assertion. [19]
services/test_app_generate_service.py	A session mock is passed through to a mocked workflow lookup. Replace the placeholder with a real/unbound session rather than adding unnecessary persistence. [20]
services/test_snippet_service.py	Repository-delegation test installs mocked session/factory placeholders. Replace these without changing the repository-boundary scope. [21]
services/test_workflow_event_snapshot_service.py	Mock represents a legacy message with created_at=None. Preserve that compatibility case; do not force it into normal-schema persistence without checking whether that row is representable. [22]
services/enterprise/test_rbac_service.py	_RecordingSession verifies remote/commit/close ordering. A real session plus lifecycle observation could replace it, but preserve ordering coverage. [23]
services/tools/test_tools_transform_service.py	Patches db.session while mocking the provider controller. This is boundary wiring, not SQL-result fabrication. Use a real session and model if cleaning up this slice. [24]
services/rag_pipeline/test_rag_pipeline_task_proxy.py	Uses a fake engine / mocked db while FileService is mocked. Replace the engine placeholder, or expand coverage to real upload persistence as a separate change. [25] [26]
services/knowledge/segments/test_adapters.py	Autospecced session verifies an ownership mismatch does not commit. Candidate for unbound_session, not a full persistence migration. [27]
core/app/apps/agent_app/test_app_runner.py	Mocked session injects a database failure and verifies rollback. Preserve failure injection. [28]
core/workflow/nodes/agent_v2/test_validators.py	Mocked session verifies legacy agent nodes trigger no query. Candidate for unbound_session. [29]
controllers/openapi/test_app_run.py	Mocked session verifies streaming does not commit. Preserve that lifecycle invariant when replacing the mock. [30]
controllers/openapi/auth/test_router.py	_OneRowSession deliberately handles an aware-timestamp expiry case that the file documents as incompatible with SQLite timestamp round-tripping. Not a mechanical SQLite conversion. [31]
repositories/data_source/test_credential_repository.py	Autospecced session supports MySQL/PostgreSQL/SQLite SQL-compilation assertions. Keep dialect coverage separate from persistence tests. [32]

Use sqlite_session / sqlite_session_factory for real persistence, and unbound_session for paths that must not touch the database. Both are already provided centrally. [33]

This is the complete verified list from this static pass, not proof that arbitrary aliases or ORM-only stand-ins elsewhere are absent. I have not run the tests.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

Originally posted by @dosubot in #32454