tests.test_auth.TestTokenFromHeader
  ✅ test_valid_header_token
  ✅ test_invalid_header_token
tests.test_auth.TestTokenFromQuery
  ✅ test_valid_query_token
  ✅ test_invalid_query_token
tests.test_auth.TestMissingToken
  ✅ test_no_token_at_all
  ✅ test_empty_header_token
tests.test_auth.TestHeaderPrecedence
  ✅ test_header_wins_over_query
  ✅ test_invalid_header_blocks_even_with_valid_query
tests.test_config.TestLoadConfig
  ✅ test_valid_config_loads
  ✅ test_defaults_applied
  ✅ test_missing_technitium_url_fails
  ✅ test_missing_technitium_token_fails
  ✅ test_missing_technitium_section_fails
  ✅ test_file_not_found_raises
tests.test_config.TestAppConfigModel
  ✅ test_token_global_read_only_default
  ✅ test_zone_policy_defaults
tests.test_config.TestZonePolicyExpansion
  ✅ test_names_expands_to_multiple_policies
  ✅ test_names_mixed_with_name
  ✅ test_neither_name_nor_names_raises
tests.test_integration.TestAllowedRequestForwarding
  ✅ test_allowed_get_records_forwarded
  ✅ test_admin_token_substituted
tests.test_integration.TestDeniedRequestNoUpstream
  ✅ test_denied_zone_returns_403
  ✅ test_tier2_endpoint_returns_403
tests.test_integration.TestGlobalReadOnlyToken
  ✅ test_read_only_can_list_zones
  ✅ test_read_only_can_get_records
  ✅ test_read_only_cannot_add_records
  ✅ test_read_only_cannot_delete_records
tests.test_integration.TestZoneListFiltering
  ✅ test_scoped_token_sees_only_allowed_zones
  ✅ test_readonly_token_sees_all_zones
tests.test_integration.TestAuditLogging
  ✅ test_audit_log_on_allowed_request
  ✅ test_audit_log_on_denied_request
tests.test_policy.TestResolveZoneFromParam
  ✅ test_zone_param_returned_directly
  ✅ test_zone_param_takes_precedence_over_domain
  ✅ test_zone_param_not_in_configured_zones_still_returned
tests.test_policy.TestResolveZoneFromDomain
  ✅ test_exact_domain_match
  ✅ test_single_label_strip
  ✅ test_multiple_label_strip
  ✅ test_case_insensitive_matching
  ✅ test_returns_original_configured_zone_case
  ✅ test_no_match_returns_none
  ✅ test_no_domain_no_zone_returns_none
tests.test_policy.TestEvaluatePolicyZoneAllowlist
  ✅ test_allowed_zone
  ✅ test_denied_zone
  ✅ test_zone_match_case_insensitive
tests.test_policy.TestEvaluatePolicyOperations
  ✅ test_allowed_operation
  ✅ test_denied_operation
  ✅ test_empty_allowed_operations_means_all_allowed
tests.test_policy.TestEvaluatePolicyRecordTypes
  ✅ test_allowed_record_type
  ✅ test_denied_record_type
  ✅ test_record_type_case_insensitive
  ✅ test_empty_allowed_record_types_means_all_allowed
tests.test_policy.TestEvaluatePolicySubdomainFilter
  ✅ test_matching_subdomain
  ✅ test_non_matching_subdomain
  ✅ test_no_subdomain_filter_allows_all
  ✅ test_no_domain_param_skips_subdomain_check
  ✅ test_regex_pattern_multiple_subdomains
tests.test_policy.TestWildcardZone
  ✅ test_has_wildcard_zone_true
  ✅ test_has_wildcard_zone_false
  ✅ test_find_zone_policy_wildcard_fallback
  ✅ test_resolve_zone_wildcard_with_domain
  ✅ test_resolve_zone_wildcard_with_zone_param
  ✅ test_resolve_zone_wildcard_prefers_explicit_match
  ✅ test_evaluate_policy_wildcard_allows_any_zone
  ✅ test_evaluate_policy_wildcard_enforces_record_type
  ✅ test_evaluate_policy_wildcard_enforces_subdomain_filter
  ✅ test_evaluate_policy_wildcard_enforces_operations