Update testing docs, copilot docs and minor fix to servers/ also offering a servers (no /) endpoint

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

Update testing docs, copilot docs and minor fix to servers/ also offering a servers (no /) endpoint

Update testing docs, copilot docs and minor fix to servers/ also offering a servers (no /) endpoint
Signed-off-by: Vicky Kuo <vicky.kuo@ibm.com>

1. Fix broken imports (Issue #1):
   - Change from ..database to ..db
   - Fix unified_pdp imports to use plugins.unified_pdp
   - Update in routes, services, schemas, and tests

2. Register sandbox router in main.py (Issue IBM#2):
   - Add import and app.include_router call

3. Fix XSS vulnerability (Issue IBM#3):
   - Replace f-string HTML with Jinja2 template
   - Create sandbox_simulate_results.html template
   - Add Request parameter for template access

4. Add authentication (Issue IBM#4):
   - Add Depends(get_current_user) to simulate endpoint

5. Remove scratch files (Issue IBM#5):
   - Delete sandbox_header.txt and sandbox_new_header.txt

6. Resolve schemas conflict (Issue IBM#6):
   - Merge schemas/sandbox.py into schemas.py
   - Remove conflicting schemas/ directory
   - Update imports in routes and services

All changes tested and ready for review.

Related to IBM#2226

Signed-off-by: hughhennelly <hughhennelly06@gmail.com>

)

Address code review suggestion from @jonpspri:

Problem: Subject, Resource, Context, and AccessDecision used manual
__init__ methods with mutable default arguments and no type validation.

Solution:
- Converted all 4 data models to @DataClass
- Used field(default_factory=list/dict) for mutable defaults
- Added __post_init__ to Context for default timestamp
- Renamed Resource parameters: resource_type→type, resource_id→id

Benefits:
- Type validation via dataclass
- Immutable defaults (no mutable default argument bugs)
- Cleaner, more Pythonic code
- Better serialization support
- Protection against common pitfalls

All 262 tests passing with dataclass models.

Related: PR IBM#2682 Phase 1 Code Review Item IBM#6
Signed-off-by: yiannis2804 <yiannis2804@gmail.com>

Address code review suggestions from @jonpspri (minor items):

1. ✅ Lazy logging format:
   - Changed logger.debug(f'msg: {var}') to logger.debug('msg: %s', var)
   - Avoids f-string evaluation when debug logging is disabled
   - Applied to _log_decision and check_access methods

2. ✅ Documented per-request instantiation:
   - Added NOTE about PolicyEngine(db) created on every request
   - Acceptable for Phase 1 (stateless, simple)
   - Can be optimized in Phase 2+ with caching/pooling

3. ✅ Improved test DB mocking:
   - Changed db_session fixture from next(get_db()) to MagicMock
   - More portable unit tests without real DB dependency
   - Cleaner test isolation

Additional fixes:
- Updated all test Resource() calls to use type= and id= parameters
- Updated all test AccessDecision() calls to use resource_type= and resource_id=
- Maintains consistency after dataclass conversion in Issue IBM#6

All 21 PolicyEngine tests passing.

Related: PR IBM#2682 Phase 1 Code Review Item IBM#9
Signed-off-by: yiannis2804 <yiannis2804@gmail.com>

Address code review suggestion from @jonpspri:

Problem: Subject, Resource, Context, and AccessDecision used manual
__init__ methods with mutable default arguments and no type validation.

Solution:
- Converted all 4 data models to @DataClass
- Used field(default_factory=list/dict) for mutable defaults
- Added __post_init__ to Context for default timestamp
- Renamed Resource parameters: resource_type→type, resource_id→id

Benefits:
- Type validation via dataclass
- Immutable defaults (no mutable default argument bugs)
- Cleaner, more Pythonic code
- Better serialization support
- Protection against common pitfalls

All 262 tests passing with dataclass models.

Related: PR #2682 Phase 1 Code Review Item #6
Signed-off-by: yiannis2804 <yiannis2804@gmail.com>

Address code review suggestions from @jonpspri (minor items):

1. ✅ Lazy logging format:
   - Changed logger.debug(f'msg: {var}') to logger.debug('msg: %s', var)
   - Avoids f-string evaluation when debug logging is disabled
   - Applied to _log_decision and check_access methods

2. ✅ Documented per-request instantiation:
   - Added NOTE about PolicyEngine(db) created on every request
   - Acceptable for Phase 1 (stateless, simple)
   - Can be optimized in Phase 2+ with caching/pooling

3. ✅ Improved test DB mocking:
   - Changed db_session fixture from next(get_db()) to MagicMock
   - More portable unit tests without real DB dependency
   - Cleaner test isolation

Additional fixes:
- Updated all test Resource() calls to use type= and id= parameters
- Updated all test AccessDecision() calls to use resource_type= and resource_id=
- Maintains consistency after dataclass conversion in Issue #6

All 21 PolicyEngine tests passing.

Related: PR #2682 Phase 1 Code Review Item #9
Signed-off-by: yiannis2804 <yiannis2804@gmail.com>

1. Fix broken imports (Issue #1):
   - Change from ..database to ..db
   - Fix unified_pdp imports to use plugins.unified_pdp
   - Update in routes, services, schemas, and tests

2. Register sandbox router in main.py (Issue #2):
   - Add import and app.include_router call

3. Fix XSS vulnerability (Issue #3):
   - Replace f-string HTML with Jinja2 template
   - Create sandbox_simulate_results.html template
   - Add Request parameter for template access

4. Add authentication (Issue #4):
   - Add Depends(get_current_user) to simulate endpoint

5. Remove scratch files (Issue #5):
   - Delete sandbox_header.txt and sandbox_new_header.txt

6. Resolve schemas conflict (Issue #6):
   - Merge schemas/sandbox.py into schemas.py
   - Remove conflicting schemas/ directory
   - Update imports in routes and services

All changes tested and ready for review.

Related to #2226

Signed-off-by: hughhennelly <hughhennelly06@gmail.com>

CYFR-280 adding first smoke tests