Remediate the 2026-09-03 feature-test findings

tests/test_plugins/test_warranty_proof.py

@@ -108,3 +108,48 @@ def test_removing_clears_both_columns(client, db, auth_headers):
     body = response.get_json()['data']
     assert body['proofurl'] is None
     assert body['prooffilename'] is None
+
+
+# --- a date that is not a date -----------------------------------------------
+#
+# PUT /api/warranty/<id> with an unparseable enddate answered 200 "Warranty
+# updated" and stored NULL, which drops the record out of every expiry surface
+# it feeds. The local _parse_date swallowed the ValueError, so a typo and a
+# deliberate clear produced the same write.
+
+def _warranty_via_api(client, auth_headers, **fields):
+    payload = {'vendor': 'Acme', 'servicetag': 'WD-1', 'enddate': '2027-06-30'}
+    payload.update(fields)
+    created = client.post('/api/warranty', headers=auth_headers, json=payload)
+    assert created.status_code == 201, created.get_json()
+    return created.get_json()['data']['warrantyid']
+
+
+def test_a_mistyped_end_date_is_refused_not_stored_as_null(client, db,
+                                                           auth_headers):
+    warrantyid = _warranty_via_api(client, auth_headers)
+
+    refused = client.put(f'/api/warranty/{warrantyid}', headers=auth_headers,
+                         json={'enddate': '30-06-2027'})
+    assert refused.status_code == 400, refused.get_json()
+    assert 'enddate' in refused.get_json()['data']['error']['message']
+
+    kept = db.session.get(Warranty, warrantyid)
+    assert kept.enddate is not None, 'the stored cover date must survive a typo'
+    assert str(kept.enddate) == '2027-06-30'
+
+
+def test_an_explicitly_empty_end_date_still_clears_it(client, db, auth_headers):
+    warrantyid = _warranty_via_api(client, auth_headers, servicetag='WD-2')
+    cleared = client.put(f'/api/warranty/{warrantyid}', headers=auth_headers,
+                         json={'enddate': ''})
+    assert cleared.status_code == 200, cleared.get_json()
+    assert db.session.get(Warranty, warrantyid).enddate is None
+
+
+def test_a_mistyped_date_is_refused_at_create_too(client, db, auth_headers):
+    refused = client.post('/api/warranty', headers=auth_headers,
+                          json={'vendor': 'Acme', 'servicetag': 'WD-3',
+                                'startdate': 'yesterday'})
+    assert refused.status_code == 400, refused.get_json()
+    assert Warranty.query.filter_by(servicetag='WD-3').first() is None