fix(tests): DPDP PII export assertion checks field key name instead of field value, testing nothing meaningful #270

Summary

tests/test_documents_endpoint.py asserts 'Warranty' not in entry['field'] for a DPDP PII export test. This checks whether the string 'Warranty' appears in the field key name (e.g., 'title', 'summary') — which is never 'Warranty'. A bug leaking actual PII content into a value key would be completely invisible to this assertion.

Root Cause

tests/test_documents_endpoint.py around line 232:

for entry in pii_entries:
    assert 'Warranty' not in entry['field']   # ← 'field' is the key name like 'title'
    # This assertion is trivially True — 'title' doesn't contain 'Warranty'
    # The actual PII values in entry['value'] are never checked

The test is asserting that a schema key name (e.g., 'title', 'description') doesn't happen to be named 'Warranty' — which is never the case. The actual compliance check should verify that 'Warranty' does NOT appear in the field VALUES that get exported.

Failure Scenario

1. A bug causes PII content 'Warranty Deed' to appear in entry['value'] when it should be redacted.
2. 'Warranty' not in entry['field'] → 'Warranty' not in 'description' → True.
3. Test passes. The DPDP PII leakage is undetected.
4. Audit finds that warranty-deed information is included in PII export responses — DPDP violation.

Proposed Fix

for entry in pii_entries:
    # Check that sensitive Warranty content does not appear in exported values:
    assert 'Warranty' not in (entry.get('value') or ''), (
        f"PII export leaked sensitive content in field '{entry['field']}': {entry.get('value')}"
    )
    # Also verify field names are from the expected schema:
    assert entry['field'] in ('name', 'email', 'phone', 'address'), (
        f"Unexpected PII field exported: {entry['field']}"
    )