From f6b0dcbe58b7745cd6cc8646bcc4b574d279563f Mon Sep 17 00:00:00 2001
From: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com>
Date: Tue, 2 Jun 2026 05:15:22 +0100
Subject: [PATCH] Tests: companion model JSON resilience

---
 tests/test_companion_readonly.py | 47 ++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/tests/test_companion_readonly.py b/tests/test_companion_readonly.py
index 357cbab..3dd7e68 100644
--- a/tests/test_companion_readonly.py
+++ b/tests/test_companion_readonly.py
@@ -291,6 +291,53 @@ def test_models_route_filters_hidden_models_and_secret_fields(monkeypatch):
     assert "super-secret" not in repr(returned)
 
 
+def test_models_route_tolerates_invalid_cached_models_json(monkeypatch):
+    endpoint = _ep(1, "alice-endpoint", "alice")
+    endpoint.cached_models = "{not-json"
+    rows = [endpoint]
+    monkeypatch.setattr(companion_routes, "get_current_user", lambda request: "alice")
+
+    endpoints = _call_models_route(
+        monkeypatch,
+        rows,
+        _request(api_token=False, current_user="alice"),
+    )
+
+    assert len(endpoints) == 1
+    returned = endpoints[0]
+    assert returned["name"] == "alice-endpoint"
+    assert returned["models"] == []
+    assert "api_key" not in returned
+    assert "headers" not in returned
+    assert "base_url" not in returned
+
+
+def test_models_route_tolerates_invalid_hidden_models_json(monkeypatch):
+    endpoint = _ep(
+        1,
+        "alice-endpoint",
+        "alice",
+        cached_models=["visible-model"],
+    )
+    endpoint.hidden_models = "{not-json"
+    rows = [endpoint]
+    monkeypatch.setattr(companion_routes, "get_current_user", lambda request: "alice")
+
+    endpoints = _call_models_route(
+        monkeypatch,
+        rows,
+        _request(api_token=False, current_user="alice"),
+    )
+
+    assert len(endpoints) == 1
+    returned = endpoints[0]
+    assert returned["name"] == "alice-endpoint"
+    assert returned["models"] == ["visible-model"]
+    assert "api_key" not in returned
+    assert "headers" not in returned
+    assert "base_url" not in returned
+
+
 def test_models_route_filters_disabled_and_non_llm_endpoints(monkeypatch):
     rows = [
         _ep(1, "enabled-llm", "alice", is_enabled=True, model_type="llm"),