Clean Access audit and test resources

src/govoplan_access/backend/admin/service.py

@@ -31,7 +31,7 @@ from govoplan_access.backend.permissions.catalog import (
     validate_tenant_permissions,
     role_templates_for_level,
 )
-from govoplan_core.tenancy.service import tenant_counts  # re-exported compatibility helper
+from govoplan_core.tenancy.service import tenant_counts  # noqa: F401 - re-exported compatibility helper
 
 _TEMP_PASSWORD_ALPHABET = string.ascii_letters + string.digits + "-_!@#"
 

src/govoplan_access/backend/api/v1/admin_schemas.py

@@ -714,7 +714,7 @@ class ConfigurationSafetyFieldItem(BaseModel):
     storage: str
     ui_managed: bool
     risk: Literal["low", "medium", "high", "destructive"]
-    secret_handling: Literal["none", "reference_only", "env_only"] = "none"
+    secret_handling: Literal["none", "reference_only", "env_only"] = "none"  # noqa: S105 - policy vocabulary.
     required_scopes: list[str] = Field(default_factory=list)
     dry_run_required: bool = False
     validation_required: bool = True

src/govoplan_access/backend/api/v1/routes.py

@@ -200,7 +200,6 @@ from govoplan_access.backend.semantic import collect_external_function_roles, co
 from govoplan_access.backend.security.sessions import collect_user_groups, collect_user_roles, collect_user_scopes
 from govoplan_core.db.session import get_session
 from govoplan_access.backend.permissions.catalog import (
-    normalize_email,
     permission_catalog as access_permission_catalog,
     scopes_grant,
 )

tests/test_admin_batch_helpers.py

@@ -22,12 +22,15 @@ class AdminBatchHelperTests(unittest.TestCase):
         self.engine = create_engine("sqlite:///:memory:")
         Base.metadata.create_all(bind=self.engine)
         self.Session = sessionmaker(bind=self.engine)
+        self.session = self.Session()
 
     def tearDown(self) -> None:
+        self.session.close()
         Base.metadata.drop_all(bind=self.engine)
+        self.engine.dispose()
 
     def test_access_admin_batch_maps_related_rows(self) -> None:
-        session = self.Session()
+        session = self.session
         account = Account(id="account-1", email="ada@example.test", normalized_email="ada@example.test")
         user = User(id="user-1", tenant_id="tenant-1", account_id=account.id, email=account.email)
         group = Group(id="group-1", tenant_id="tenant-1", slug="clerks", name="Clerks")