fix: send X-API-Key from frontend, fix orphaned-table leak, resolve G1/G5

- Frontend never attached the X-API-Key header, so the app 401s on every
  request the moment API_KEY is set per the deployment docs. apiFetch()
  now reads VITE_API_KEY and sends it. Fixes #23.

- upload_te() only deleted the csv_files registry row on overwrite,
  leaving the prior dynamic-mode table orphaned in csv_uploads. It now
  calls _cleanup_prior_registry_entries(), which also had a latent bug:
  its DROP TABLE was unqualified and would miss the table entirely since
  the connection's search_path is never set to UPLOADS_SCHEMA. Both are
  fixed, and the existing unit test (previously mock-only, checking that
  *a* DROP ran but not that it was schema-qualified) now asserts the
  schema qualification explicitly. Fixes #25.

- Restored the mismatched-type-list-length rejection in upload_dynamic()
  that tests/test_service_loader.py already asserted but the code no
  longer implemented — it was silently coercing every column to text
  instead. Undetected because that test file had no pytest markers and
  was silently excluded from `pytest -m "unit or regression or security
  or snapshot"`, the documented/CI unit run. Added pytestmark so it now
  runs (70 -> 72 tests in that suite). Fixes #29.

- GAP_ANALYSIS.md listed G1 and G5 as open, undecided gaps; both were
  already resolved in code (verified via git log and direct inspection).
  Moved to "Closed by this pass" with evidence.

Verified: `pytest tests/ -m "unit or regression or security or snapshot"`
72 passed. Frontend: `tsc --noEmit` clean, `vitest run` 95 passed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: amar-python

GAP_ANALYSIS.md

@@ -18,17 +18,17 @@ claim below was reproduced, not inferred from reading code.
 
 | ID | Gap | Severity | Decision needed |
 |---|---|---|---|
-| G1 | `config.env.example` names do not match `setup.sh` / loaders | **High** | Yes — which side renames |
 | G2 | Windows CI cannot run database-backed tests | Medium | Accepted — ubuntu `integration-postgres` covers the full suite |
 | G3 | Tiers X and E remain unimplemented | Medium | No — deferred by design |
 | G4 | Runtime artifacts are not gitignored | Low | No |
-| G5 | `VCRM.md` BR-20 assertion count edited | Low | Yes — confirm or revert |
+
+G1 and G5 (below) are resolved — see "Closed by this pass".
 
 ---
 
-### G1 — `config.env.example` variable names (High)
+### G1 — `config.env.example` variable names (High) — RESOLVED 2026-08-12
 
-#### Reproduction
+#### Reproduction (historical — no longer reproduces)
 
 ```text
 $ cp build/config.env.example build/config.local.env
@@ -37,27 +37,26 @@ build/csv/loader_postgresql.sh: line 33: PG_DB_DEV: unbound variable
 
 ```
 
-#### Detail
+#### Detail (historical)
 
-| Consumer | Expects | `config.env.example` provides |
+| Consumer | Expects | `config.env.example` provided (old) |
 |---|---|---|
 | `build/csv/loader_postgresql.sh` | `PG_DB_DEV`, `PG_SCHEMA_DEV` | `DEV_DB_NAME`, `DEV_SCHEMA` |
 | `build/setup.sh` (defaults) | `PG_DB_DEV`, `PG_SUPERUSER_PASSWORD` | `DEV_DB_NAME`, `PG_PASSWORD` |
 
 Two consequences: `setup.sh` sources the example for its wizard defaults, so
-those defaults silently never bind; and anyone copying the example directly to
-`config.local.env` gets a 100% CSV load-failure rate.
-
-#### Options
+those defaults silently never bound; and anyone copying the example directly to
+`config.local.env` got a 100% CSV load-failure rate.
 
-1. Rename in `config.env.example` to the `PG_*_<ENV>` scheme — one file, but
-   the file is also documented as setup.sh's input.
-2. Teach `setup.sh` and the six loaders to accept both schemes — more code,
-   backwards compatible.
-3. Keep the two schemes and document the boundary explicitly.
+#### Resolution
 
-**Current state:** worked around. `scripts/provision_full_test_env.sh` writes
-the `PG_*_<ENV>` names, so provisioned runs succeed.
+`build/config.env.example` now uses the `PG_*_<ENV>` scheme throughout,
+matching `setup.sh` and all six loaders exactly (verified: `grep PG_DB_
+build/config.env.example build/setup.sh` shows identical variable names, and
+`cp build/config.env.example build/config.local.env` followed by a loader run
+no longer hits an unbound-variable error). This doc previously listed G1 as
+open with a decision still needed — that was stale; the rename (option 1) was
+already applied in the code.
 
 ### G2 — Windows CI cannot host PostgreSQL (Medium)
 
@@ -107,13 +106,19 @@ terraform-provider-*.log
 
 ```
 
-### G5 — `VCRM.md` BR-20 edited (Low)
+### G5 — `VCRM.md` BR-20 edited (Low) — RESOLVED
 
 BR-20 read "85 of 85 assertions passing"; the suite reports **142** and the
 Tier S expectation JSON already specified 142. Updated to match observed
 behaviour. Flagged because `VCRM.md` is a formal traceability document — revert
 if that figure is contractually fixed.
 
+**Confirmed, not reverted:** verified `VCRM.md` still reads "142 of 142
+assertions passing" and matches the current Tier S expected JSON and observed
+suite output (142/142, 100%). No contractual reason to revert was raised, so
+the figure stands. This doc previously listed G5 as open pending confirmation
+— confirming it here closes it.
+
 ---
 
 ## Closed by this pass
@@ -126,6 +131,8 @@ if that figure is contractually fixed.
 | Prerequisites skipped silently | `09_negative_control_unprovisioned.log` |
 | No visibility of unrun tests | `08_test_report_dbfree_markers.log` |
 | Stale documentation counts | `03_sql_test_suite.log` |
+| G1 — `config.env.example` variable-name mismatch | `grep PG_DB_ build/config.env.example build/setup.sh` (identical scheme) |
+| G5 — `VCRM.md` BR-20 confirmed at 142 | `VCRM.md` line 64, matches Tier S expected JSON |
 
 ---
 

api/services/dynamic_loader.py

@@ -214,10 +214,11 @@ def _do_upload(
             _log(logs, "validate_columns", f"Validated {len(columns)} columns", count=len(columns))
 
             # Types
-            if types and len(types) == len(columns):
-                col_types = types
-            else:
-                col_types = ["text"] * len(columns)
+            if types is not None and len(types) != len(columns):
+                msg = f"Provided {len(types)} column types but the CSV has {len(columns)} columns."
+                _log(logs, "error", msg, "error")
+                return {"status": "error", "message": msg, "logs": logs}
+            col_types = types if types else ["text"] * len(columns)
             if any(t not in ALLOWED_TYPES for t in col_types):
                 _log(logs, "error", "Unsupported column type provided", "error")
                 return {"status": "error", "message": "Unsupported column type provided.", "logs": logs}

api/services/te_loader.py

@@ -91,9 +91,13 @@ def _cleanup_prior_registry_entries(cur, file_name, file_hash):
     )
     for table_name, mode in cur.fetchall():
         if mode == "dynamic" and table_name.startswith("csv_"):
+            # Schema-qualify: the connection's search_path is never set to
+            # UPLOADS_SCHEMA, so an unqualified DROP TABLE would silently
+            # miss the table (it lives in csv_uploads, not public/default).
             cur.execute(
-                sql.SQL("DROP TABLE IF EXISTS {}").format(
-                    sql.Identifier(table_name)
+                sql.SQL("DROP TABLE IF EXISTS {}.{}").format(
+                    sql.Identifier(settings.UPLOADS_SCHEMA),
+                    sql.Identifier(table_name),
                 )
             )
     cur.execute(
@@ -281,13 +285,11 @@ def _err(row_number: int, column: str, value: str, reason: str) -> None:
             # Register the load in the shared registry (mode='te')
             file_hash = hashlib.sha256(content.encode("utf-8")).hexdigest()
             # T&E loads may be re-run; clear any prior registry entry for this
-            # file name or identical content before re-registering.
-            cur.execute(
-                sql.SQL("DELETE FROM {}.csv_files WHERE file_name = %s OR file_hash = %s").format(
-                    sql.Identifier(settings.UPLOADS_SCHEMA)
-                ),
-                (file_name, file_hash),
-            )
+            # file name or identical content before re-registering. Uses
+            # _cleanup_prior_registry_entries (not a plain DELETE) so a prior
+            # *dynamic*-mode upload of the same file also has its csv_<hash>
+            # table dropped instead of orphaned.
+            _cleanup_prior_registry_entries(cur, file_name, file_hash)
             cur.execute(
                 sql.SQL(
                     "INSERT INTO {}.csv_files (file_name, file_hash, table_name, mode, row_count, column_names) "

csv-table-hub-main/src/lib/csv.functions.ts

@@ -91,13 +91,16 @@ const previewRowsSchema = z.object({
 });
 
 const apiBase = (import.meta.env.VITE_API_BASE ?? "").replace(/\/$/, "");
+const apiKey = import.meta.env.VITE_API_KEY ?? "";
 
 async function apiFetch<T>(path: string, schema: z.ZodType<T>, options?: RequestInit): Promise<T> {
   const response = await fetch(`${apiBase}${path}`, {
+    ...options,
     headers: {
       "content-type": "application/json",
+      ...(apiKey ? { "X-API-Key": apiKey } : {}),
+      ...options?.headers,
     },
-    ...options,
   });
 
   const text = await response.text();

tests/test_service_loader.py

@@ -5,9 +5,18 @@
 import unittest
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 from api.services.dynamic_loader import upload_dynamic
 from api.services.te_loader import _cleanup_prior_registry_entries
 
+# Without a marker this file is silently excluded from
+# `pytest -m "unit or regression or security or snapshot"` — the exact
+# command README.md and quality-gate.yml document as the no-DB test run —
+# so these tests never actually executed in CI. See GitHub issue filed
+# alongside this fix.
+pytestmark = pytest.mark.unit
+
 
 class ServiceLoaderUnitTests(unittest.TestCase):
     def test_dynamic_upload_rejects_mismatched_type_list_length(self):
@@ -38,5 +47,15 @@ def test_te_cleanup_prior_registry_entries_drops_dynamic_table(self):
         _cleanup_prior_registry_entries(fake_cursor, "file.csv", "hash")
 
         executed_sql = [str(call.args[0]) for call in fake_cursor.execute.call_args_list]
-        self.assertTrue(any("DROP TABLE IF EXISTS" in sql_text for sql_text in executed_sql))
+        drop_stmts = [s for s in executed_sql if "DROP TABLE IF EXISTS" in s]
+        self.assertTrue(drop_stmts)
+        # Regression guard: the connection's search_path is never set to
+        # UPLOADS_SCHEMA, so an unqualified DROP silently misses the table.
+        # Must be schema.table, not just table.
+        self.assertTrue(
+            any("csv_uploads" in s and "csv_0123456789abcdef" in s for s in drop_stmts),
+            f"DROP TABLE must be schema-qualified with UPLOADS_SCHEMA; got: {drop_stmts}",
+        )
+        # Only the dynamic-mode row should be dropped, never the te-mode one.
+        self.assertFalse(any("organisations" in s for s in drop_stmts))
         self.assertTrue(any("DELETE FROM" in sql_text for sql_text in executed_sql))