test: align memory guards with share-aware lookup

Author: erichare

src/backend/tests/unit/services/authorization/test_route_ceiling_guards.py

@@ -11,9 +11,8 @@
 These tests drive the real route handlers with the data services mocked,
 verifying two invariants for each newly-guarded action:
 
-1. A viewer-ceiling caller is denied with HTTP 403 *before* the data service is
-   touched (the deny-only ceiling fires ahead of owner-override and the
-   ``AUTHZ_ENABLED`` gate).
+1. A viewer-ceiling caller is denied *before* the mutating data service is
+   touched (normally with HTTP 403; UUID-private resources may mask it as 404).
 2. With no ceiling installed, the owner-override path returns early and the
    route proceeds to the underlying service — preserving feature-off behavior.
 """
@@ -281,7 +280,7 @@ async def test_memory_delete_viewer_denied(monkeypatch, owner):
     from langflow.api.v1 import memories
 
     delete_spy = AsyncMock(return_value=True)
-    mb = SimpleNamespace(user_id=owner.id, kb_name="kb")
+    mb = SimpleNamespace(id=uuid4(), user_id=owner.id, kb_name="kb")
     _install_memory_service(monkeypatch, delete=delete_spy, get=AsyncMock(return_value=mb))
 
     set_current_external_access_context(_viewer_ceiling())
@@ -291,7 +290,7 @@ async def test_memory_delete_viewer_denied(monkeypatch, owner):
     finally:
         set_current_external_access_context(None)
 
-    assert exc_info.value.status_code == 403
+    assert exc_info.value.status_code == 404
     delete_spy.assert_not_awaited()
 
 
@@ -300,7 +299,7 @@ async def test_memory_flush_viewer_denied(monkeypatch, owner):
     from langflow.api.v1 import memories
 
     trigger_spy = AsyncMock(return_value=uuid4())
-    mb = SimpleNamespace(user_id=owner.id, kb_name="kb")
+    mb = SimpleNamespace(id=uuid4(), user_id=owner.id, kb_name="kb")
     _install_memory_service(monkeypatch, trigger_ingestion=trigger_spy, get=AsyncMock(return_value=mb))
 
     set_current_external_access_context(_viewer_ceiling())
@@ -312,7 +311,7 @@ async def test_memory_flush_viewer_denied(monkeypatch, owner):
     finally:
         set_current_external_access_context(None)
 
-    assert exc_info.value.status_code == 403
+    assert exc_info.value.status_code == 404
     trigger_spy.assert_not_awaited()
 
 
@@ -321,7 +320,7 @@ async def test_memory_regenerate_viewer_denied(monkeypatch, owner):
     from langflow.api.v1 import memories
 
     regen_spy = AsyncMock(return_value=[])
-    mb = SimpleNamespace(user_id=owner.id, kb_name="kb")
+    mb = SimpleNamespace(id=uuid4(), user_id=owner.id, kb_name="kb")
     _install_memory_service(monkeypatch, regenerate=regen_spy, get=AsyncMock(return_value=mb))
 
     set_current_external_access_context(_viewer_ceiling())
@@ -331,7 +330,7 @@ async def test_memory_regenerate_viewer_denied(monkeypatch, owner):
     finally:
         set_current_external_access_context(None)
 
-    assert exc_info.value.status_code == 403
+    assert exc_info.value.status_code == 404
     regen_spy.assert_not_awaited()
 
 
@@ -341,7 +340,7 @@ async def test_memory_delete_owner_proceeds(monkeypatch, owner):
     from langflow.api.v1 import memories
 
     delete_spy = AsyncMock(return_value=True)
-    mb = SimpleNamespace(user_id=owner.id, kb_name="kb")
+    mb = SimpleNamespace(id=uuid4(), user_id=owner.id, kb_name="kb")
     _install_memory_service(monkeypatch, delete=delete_spy, get=AsyncMock(return_value=mb))
 
     set_current_external_access_context(ExternalAccessContext(provider="openrag", subject="s-1", level="editor"))