feat(imports): resume persisted address runs

tests/test_tabular_imports.py

@@ -19,6 +19,7 @@ from govoplan_addresses.backend.import_schemas import (
 from govoplan_addresses.backend.imports import (
     apply_address_import,
     create_import_profile,
+    get_import_run,
     import_run_payload,
     preview_address_import,
     rollback_address_import,
@@ -44,6 +45,12 @@ class Principal:
         }
 
 
+class OtherTenantPrincipal(Principal):
+    @property
+    def tenant_id(self) -> str:
+        return "tenant-2"
+
+
 def encoded(value: str) -> str:
     return base64.b64encode(value.encode()).decode()
 
@@ -121,11 +128,69 @@ class AddressTabularImportTests(unittest.TestCase):
             self.session,
             self.principal,
             run.id,
-            AddressImportRollbackRequest(reason="The operator selected the wrong monthly file."),
+            AddressImportRollbackRequest(
+                expected_plan_hash=run.plan_hash,
+                reason="The operator selected the wrong monthly file.",
+            ),
         )
         self.assertEqual("rolled_back", rolled_back.status)
         self.assertEqual(0, self.session.query(Contact).filter(Contact.deleted_at.is_(None)).count())
 
+    def test_rollback_rejects_a_stale_review_hash(self) -> None:
+        run = preview_address_import(
+            self.session,
+            self.principal,
+            self.book.id,
+            AddressImportPreviewRequest(
+                profile_id=self.profile.id,
+                filename="contacts.csv",
+                content_base64=encoded(
+                    "id;first;last;email;organization\n"
+                    "1;Ada;Lovelace;ada@example.test;Analysis Office\n"
+                ),
+            ),
+        )
+        apply_address_import(
+            self.session,
+            self.principal,
+            run.id,
+            expected_plan_hash=run.plan_hash,
+        )
+
+        with self.assertRaisesRegex(ValueError, "reviewed import plan changed"):
+            rollback_address_import(
+                self.session,
+                self.principal,
+                run.id,
+                AddressImportRollbackRequest(
+                    expected_plan_hash="0" * 64,
+                    reason="The operator selected the wrong monthly file.",
+                ),
+            )
+
+    def test_persisted_run_read_is_tenant_bounded_and_source_safe(self) -> None:
+        source = "id;first;last;email;organization\n1;Ada;Lovelace;ada@example.test;Analysis Office\n"
+        run = preview_address_import(
+            self.session,
+            self.principal,
+            self.book.id,
+            AddressImportPreviewRequest(
+                profile_id=self.profile.id,
+                filename="contacts.csv",
+                content_base64=encoded(source),
+            ),
+        )
+        self.session.flush()
+
+        payload = import_run_payload(get_import_run(self.session, self.principal, run.id))
+        self.assertEqual("previewed", payload["status"])
+        self.assertEqual(run.plan_hash, payload["plan_hash"])
+        self.assertNotIn("plan_data", payload)
+        self.assertNotIn(source, repr(payload))
+
+        with self.assertRaisesRegex(ValueError, "not found"):
+            get_import_run(self.session, OtherTenantPrincipal(), run.id)
+
     def test_duplicate_keys_and_changed_targets_block_apply(self) -> None:
         duplicate = preview_address_import(
             self.session,