test(userdata): add regression tests for atomic write and invalid filename fixes

[chelsealong]

Summary

#15814 audits recent bug-fix history and lists six merged fixes that shipped
without regression tests. This PR adds tests for the two items whose commits
I could verify still exist and are still relevant on master:

• Non-atomic userdata writes (9a870b510) — POST /userdata/{file} writes
  to a temp file and os.replace()s it into place so a mid-write failure
  can't truncate the original file.
• Invalid workflow filenames (0737b7e0d) — an OSError while writing
  (e.g. a filename that's too long, or contains characters the filesystem
  rejects) is now reported as 400, not an unhandled 500.

The other four items in the issue (24dc581dc, 136c93cb4, 8e2c99e3c,
89f15894d) either already have a passing regression handled by exist_ok=True
with nothing meaningfully new to assert, or reference commit hashes that don't
exist in this repository's history — I couldn't find the code they describe,
so I left them out rather than guess.

Test plan

New tests added to tests-unit/prompt_server_test/user_manager_test.py:

• test_post_userdata_invalid_filename_returns_400
• test_post_userdata_atomic_write_preserves_original_on_failure

Verified each test fails without its corresponding fix, by checking out
app/user_manager.py from the commit before each fix and re-running:

$ git checkout 0737b7e0d^ -- app/user_manager.py
$ python -m pytest tests-unit/prompt_server_test/user_manager_test.py -k invalid_filename -v
...
FAILED ...test_post_userdata_invalid_filename_returns_400 - AssertionError: assert 500 == 400

$ git checkout 9a870b510^ -- app/user_manager.py
$ python -m pytest tests-unit/prompt_server_test/user_manager_test.py -k atomic_write -v
...
FAILED ...test_post_userdata_atomic_write_preserves_original_on_failure - AssertionError: assert 200 == 400

And that both pass, along with the full existing file, on current master:

$ python -m pytest tests-unit/prompt_server_test/user_manager_test.py -v
...
21 passed in 0.16s

Lint:

$ ruff check tests-unit/prompt_server_test/user_manager_test.py
All checks passed!

AI disclosure

This PR was prepared with the assistance of an AI coding agent (Claude),
including the analysis of which issue items were still reproducible and the
test implementation. All test runs and diffs shown above were executed and
verified directly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9a0d355b-c151-437f-a4d1-f7db37fcd950

📥 Commits

Reviewing files that changed from the base of the PR and between 3422dfd and 460e0d5.

📒 Files selected for processing (1)

• tests-unit/prompt_server_test/user_manager_test.py

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (8)

• GitHub Check: Run Pylint
• GitHub Check: test (macos-latest)
• GitHub Check: test (macos-latest)
• GitHub Check: test (ubuntu-latest)
• GitHub Check: test (ubuntu-latest)
• GitHub Check: test (windows-latest)
• GitHub Check: test (windows-2022)
• GitHub Check: test

🧰 Additional context used

📓 Path-based instructions (5)

**/*

📄 CodeRabbit inference engine (AGENTS.md)

**/*: Keep changes small, direct, and limited to the narrowest necessary code path and smallest number of files.
Prefer practical fixes, minimal dependencies, and existing repository patterns; remove obsolete, dead, unreachable, or unused code.
Preserve existing APIs, node names, model-loading behavior, file layout, and workflow compatibility unless replacement is explicitly intended.
Core ComfyUI must not add outbound internet requests, telemetry, tracking, reporting, remote configuration, or background network activity. User-authorized model downloads are limited to the requested artifact and must exclude telemetry and unrelated metadata.

Files:

• tests-unit/prompt_server_test/user_manager_test.py

**/*.py

📄 CodeRabbit inference engine (AGENTS.md)

**/*.py: Keep state and capability flags on the object that owns the behavior. Prefer explicit parent-owned attributes over probing child objects with getattr; use child checks only when the child owns the delegated behavior.
Preserve shared method signatures, argument order, return shapes, side effects, and error behavior unless every affected caller and interface is intentionally updated.
Do not add unused compatibility parameters, flags, attributes, constructor options, or model-specific options to shared helpers; keep one-off behavior at the integration boundary.
Normalize third-party return conventions at integration boundaries so core code receives the expected type and shape; avoid undocumented caller-side unwrapping.
Do not add torch.no_grad, torch.inference_mode, or inference-mode wrappers. Do not add model freeze/unfreeze toggles; only disable globally enabled inference mode when a training path requires gradients.
Remove inference-only training behavior such as dropout while preserving checkpoint and state-dict compatibility; use nn.Identity when deleting a module would alter keys or ordering.
Keep imports at module scope except established optional-backend probes or imports required to avoid cycles; avoid unnecessary try/except blocks and use specific exceptions with useful fallbacks.
Do not add workarounds for unsupported library versions, especially PyTorch exception-and-float-cast retries, unless a comment names the exact versions still requiring them.
Let unsupported model formats, invalid quantization metadata, and bad states fail with clear errors instead of silently degrading output.
Match local style, keep comments sparse and useful, and remove comments that merely restate obvious code.
Treat dtype, device placement, VRAM use, and offloading as correctness concerns across CPU, CUDA, ROCm, MPS, DirectML, XPU, NPU, and low-VRAM environments.
Prefer existing ComfyUI and Comfy Kitchen operations, quantization helpers, cast/offload helpe...

Files:

• tests-unit/prompt_server_test/user_manager_test.py

**/*.{py,json}

📄 CodeRabbit inference engine (AGENTS.md)

Treat legacy combo, io.Combo, and io.DynamicCombo values affecting filesystem access as untrusted; revalidate them at load/save boundaries with folder_paths, containment checks, or fixed allowlists.

Files:

• tests-unit/prompt_server_test/user_manager_test.py

**/*.{py,md,txt,json}

📄 CodeRabbit inference engine (AGENTS.md)

Keep warning and info messages short and actionable, remove noisy or misleading logging, and make documentation edits concise, factual, and tied to changed behavior.

Files:

• tests-unit/prompt_server_test/user_manager_test.py

**

⚙️ CodeRabbit configuration file

**: IMPORTANT: Only comment on issues directly introduced by this PR's code changes.
Treat AGENTS.md as mandatory repository policy, not optional style guidance.
Flag PR changes that violate AGENTS.md even when the code is otherwise functional.
In particular, enforce architecture boundaries, dtype/device/memory rules,
interface contracts, import style, no unnecessary try/except blocks, no inline
imports, no outbound internet paths in core ComfyUI, and narrow scoped fixes.
Prefer direct findings over suggestions when a rule is violated. Only ignore
AGENTS.md when it clearly conflicts with a newer explicit maintainer instruction
in the PR.
Do NOT flag pre-existing issues in code that was merely moved, re-indented,
de-indented, or reformatted without logic changes. If code appears in the diff
only due to whitespace or structural reformatting (e.g., removing a with: block),
treat it as unchanged. Contributors should not feel obligated to address
pre-existing issues outside the scope of their contribution.

Files:

• tests-unit/prompt_server_test/user_manager_test.py

🪛 ast-grep (0.45.1)

tests-unit/prompt_server_test/user_manager_test.py

[warning] 290-290: File path is request-/variable-derived; validate and normalize to prevent path traversal.
Context: open(tmp_path / "test.txt", "w")
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(open-filename-from-request)

---

[warning] 300-300: File path is request-/variable-derived; validate and normalize to prevent path traversal.
Context: open(tmp_path / "test.txt", "r")
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(open-filename-from-request)

🔇 Additional comments (2)

tests-unit/prompt_server_test/user_manager_test.py (2)

279-287: LGTM!

---

290-303: LGTM!

---

📝 Walkthrough

Walkthrough

Added unit tests for user manager write failures. The tests verify that overlong filenames return HTTP 400 without creating a file. They also verify that failed atomic replacement returns HTTP 400, preserves the original file contents, and removes temporary files.

Merge Risk: ⚪ Minimal · up to 460e0

This change adds focused regression coverage without modifying production behavior, so no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the two regression-test areas: atomic writes and invalid filenames.
Description check	✅ Passed	The description directly explains the regression tests, their scope, verification steps, and test results.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}