diff_tests.patch

diff --git a/tests/conftest.py b/tests/conftest.py
index d182d2ef..dc90fda8 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -7,6 +7,7 @@ import pytest
 import pytest_asyncio
 import tempfile
 from typing import Generator
+from uuid import uuid4
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
@@ -19,7 +20,7 @@ os.environ["REDIS_URL"] = ""  # Disable Redis for most tests
 os.environ["METRICS_ENABLED"] = "false"
 os.environ["LOGGING_ENABLED"] = "false"
 os.environ["MULTI_TENANT_ENABLED"] = "true"
-os.environ["DEMO_MODE"] = "true"
+os.environ["DEMO_MODE"] = "false"
 os.environ["API_KEY_USAGE_TRACKING_ENABLED"] = "false"
 os.environ["API_KEY_ENFORCE_ROTATION"] = "false"
 
@@ -28,9 +29,9 @@ ASYNC_DATABASE_URL = "sqlite+aiosqlite:///./test_icc_rules.db"
 from app.main import app
 from app.db import get_db, get_async_db, Base
 from app.middleware.dashboard_metrics import DashboardMetricsMiddleware
-from app.middleware.api_key_security import ApiKeySecurityMiddleware
-from app.middleware.tenant import TenantMiddleware
-from app.models.rules import Rule
+from app.models.api_keys import ApiKey
+from app.models.tenants import Tenant
+from app.utils.api_key_utils import generate_api_key
 
 
 @pytest.fixture(scope="session")
@@ -105,37 +106,52 @@ def client(test_session, async_engine):
     app.dependency_overrides[get_async_db] = override_get_async_db
 
     original_logging_dispatch = DashboardMetricsMiddleware.dispatch
-    original_security_dispatch = ApiKeySecurityMiddleware.dispatch
-    original_tenant_dispatch = TenantMiddleware.dispatch
 
     async def _noop_dispatch(self, request, call_next):
         return await call_next(request)
 
-    async def _noop_security(self, request, call_next):
-        return await call_next(request)
-
-    async def _noop_tenant(self, request, call_next):
-        return await call_next(request)
-
     DashboardMetricsMiddleware.dispatch = _noop_dispatch
-    ApiKeySecurityMiddleware.dispatch = _noop_security
-    TenantMiddleware.dispatch = _noop_tenant
 
     try:
         yield TestClient(app)
     finally:
         DashboardMetricsMiddleware.dispatch = original_logging_dispatch
-        ApiKeySecurityMiddleware.dispatch = original_security_dispatch
-        TenantMiddleware.dispatch = original_tenant_dispatch
         app.dependency_overrides.clear()
 
 
+
+@pytest.fixture
+def admin_headers(test_session):
+    tenant = test_session.query(Tenant).filter_by(id="admin").first()
+    if tenant is None:
+        tenant = Tenant(
+            id="admin",
+            name="Admin Tenant",
+            plan="Bank",
+            environment="sandbox",
+            active=True,
+        )
+        test_session.add(tenant)
+
+    full_key, prefix, key_hash = generate_api_key()
+    api_key = ApiKey(
+        name=f"admin-test-{uuid4().hex[:6]}",
+        prefix=prefix,
+        key_hash=key_hash,
+        tenant_id=tenant.id,
+        active=True,
+        ip_whitelist=[],
+    )
+    test_session.add(api_key)
+    test_session.commit()
+    return {"X-API-Key": full_key}
+
 @pytest.fixture
 def sample_rule():
     """Sample rule for testing"""
     return {
         "source": "UCP600",
-        "rule_id": "TEST_RULE_001",
+        "rule_id": f"TEST_RULE_{uuid4().hex[:8]}",
         "article": "14",
         "title": "Test Rule",
         "text": "This is a test rule for validation.",
@@ -160,7 +176,7 @@ def sample_llm_rule():
     """Sample LLM rule for testing"""
     return {
         "source": "UCP600",
-        "rule_id": "TEST_LLM_RULE_001",
+        "rule_id": f"TEST_LLM_RULE_{uuid4().hex[:8]}",
         "article": "17",
         "title": "Test LLM Rule",
         "text": "Documents must be consistent on their face.",
diff --git a/tests/test_admin_async.py b/tests/test_admin_async.py
index c8b290e8..4bb9f460 100644
--- a/tests/test_admin_async.py
+++ b/tests/test_admin_async.py
@@ -1,45 +1,16 @@
 import uuid
-from typing import Callable
-
-import pytest
-from fastapi import Request
 
 from app.main import app
 from app.db import get_db
-from app.middleware.tenant_context import require_admin_role, get_current_tenant_role
 from app.models.validation_logs import ValidationLog
 
 
-@pytest.fixture()
-def admin_override(client, test_session):
-    def override_admin_role(request: Request):
-        return True
-
-    def override_role(request: Request):
-        return "admin"
-
-    def override_db():
-        try:
-            yield test_session
-        finally:
-            pass
-
-    app.dependency_overrides[require_admin_role] = override_admin_role
-    app.dependency_overrides[get_current_tenant_role] = override_role
-    app.dependency_overrides[get_db] = override_db
-    yield
-    app.dependency_overrides.pop(require_admin_role, None)
-    app.dependency_overrides.pop(get_current_tenant_role, None)
-    app.dependency_overrides.pop(get_db, None)
-
-
 def test_admin_settings_requires_admin(client):
-    app.dependency_overrides.pop(require_admin_role, None)
     response = client.get("/admin/settings")
     assert response.status_code == 403
 
 
-def test_get_validation_log_with_hash_success(client, test_session, admin_override):
+def test_get_validation_log_with_hash_success(client, test_session, admin_headers):
     log = ValidationLog(
         id=str(uuid.uuid4()),
         document_id="doc-1",
@@ -49,43 +20,55 @@ def test_get_validation_log_with_hash_success(client, test_session, admin_overri
         applied_rules=["R1"],
         llm_analysis="",
         processing_time_ms=120,
-        tenant_id="tenant-1",
+        tenant_id="admin",
     )
     test_session.add(log)
     test_session.commit()
 
-    response = client.get(f"/admin/logs/{log.id}")
+    response = client.get(f"/admin/logs/{log.id}", headers=admin_headers)
     assert response.status_code == 200
     payload = response.json()
     assert payload["id"] == log.id
     assert payload["document_id"] == "doc-1"
 
 
-def test_get_validation_log_with_hash_db_error(client):
+def test_get_validation_log_with_hash_db_error(client, admin_headers):
+    class BrokenQuery:
+        def filter(self, *_, **__):
+            return self
+
+        def first(self):
+            return None
+
     class BrokenSession:
-        def query(self, *args, **kwargs):
-            raise RuntimeError("boom")
+        def __init__(self):
+            self.rolled_back = False
+
+        def query(self, *_, **__):
+            return BrokenQuery()
+
+        def add(self, *_):
+            pass
+
+        def commit(self):
+            raise RuntimeError("db failure")
 
-    def override_admin_role(request: Request):
-        return True
+        def rollback(self):
+            self.rolled_back = True
 
-    def override_role(request: Request):
-        return "admin"
+    broken = BrokenSession()
 
     def override_db():
         try:
-            yield BrokenSession()
+            yield broken
         finally:
             pass
 
-    app.dependency_overrides[require_admin_role] = override_admin_role
-    app.dependency_overrides[get_current_tenant_role] = override_role
     app.dependency_overrides[get_db] = override_db
 
     try:
-        response = client.get("/admin/logs/nonexistent")
+        response = client.get("/admin/logs/nonexistent", headers=admin_headers)
         assert response.status_code == 500
     finally:
-        app.dependency_overrides.pop(require_admin_role, None)
-        app.dependency_overrides.pop(get_current_tenant_role, None)
         app.dependency_overrides.pop(get_db, None)
+        assert broken.rolled_back
diff --git a/tests/test_settings_async.py b/tests/test_settings_async.py
index 4ddb581f..22f8170c 100644
--- a/tests/test_settings_async.py
+++ b/tests/test_settings_async.py
@@ -45,8 +45,8 @@ def _settings_payload(updated_by="config-admin"):
     }
 
 
-def test_update_settings_persists_and_audits(client, settings_db_override, test_session):
-    response = client.put("/settings/", json=_settings_payload())
+def test_update_settings_persists_and_audits(client, settings_db_override, test_session, admin_headers):
+    response = client.put("/settings/", json=_settings_payload(), headers=admin_headers)
     assert response.status_code == 200
 
     stored = test_session.query(SystemSetting).all()
@@ -57,7 +57,7 @@ def test_update_settings_persists_and_audits(client, settings_db_override, test_
     assert all(entry.changed_by == "config-admin" for entry in audit_entries)
 
 
-def test_update_settings_db_failure(client):
+def test_update_settings_db_failure(client, admin_headers):
     class BrokenQuery:
         def filter(self, *_, **__):
             return self
@@ -92,13 +92,17 @@ def test_update_settings_db_failure(client):
     app.dependency_overrides[get_db] = override_db
 
     try:
-        response = client.put("/settings/", json=_settings_payload())
+        response = client.put("/settings/", json=_settings_payload(), headers=admin_headers)
         assert response.status_code == 500
         assert broken.rolled_back
     finally:
         app.dependency_overrides.pop(get_db, None)
 
 
-def test_reset_setting_not_found(client, settings_db_override):
-    response = client.post("/settings/setting/does-not-exist/reset", json={"updated_by": "tester"})
+def test_reset_setting_not_found(client, settings_db_override, admin_headers):
+    response = client.post(
+        "/settings/setting/does-not-exist/reset",
+        json={"updated_by": "tester"},
+        headers=admin_headers,
+    )
     assert response.status_code == 404
diff --git a/tests/test_validation.py b/tests/test_validation.py
index 94fef936..5b3f9375 100644
--- a/tests/test_validation.py
+++ b/tests/test_validation.py
@@ -1,25 +1,23 @@
 """
 Tests for validation endpoints and LLM functionality
 """
-import pytest
 import os
 from unittest.mock import patch, Mock
 from fastapi.testclient import TestClient
 
 
-def test_validate_deterministic_rule(client: TestClient, sample_rule, sample_document, sample_ruleset):
+def test_validate_deterministic_rule(client: TestClient, sample_rule, sample_document, sample_ruleset, admin_headers):
     """Test validation with deterministic rule"""
-    # Create a rule
-    response = client.post("/rules/", json=sample_rule)
+    rule_payload = dict(sample_rule)
+    response = client.post("/rules/", json=rule_payload, headers=admin_headers)
     assert response.status_code == 200
 
-    # Validate document
     validation_request = {
         "document": sample_document,
-        "ruleset": sample_ruleset
+        "ruleset": sample_ruleset,
     }
 
-    response = client.post("/validate/", json=validation_request)
+    response = client.post("/validate/", json=validation_request, headers=admin_headers)
     assert response.status_code == 200
 
     result = response.json()
@@ -30,24 +28,22 @@ def test_validate_deterministic_rule(client: TestClient, sample_rule, sample_doc
     assert "applied_rules" in result
     assert "logs_id" in result
 
-    # Should pass since document matches rule condition
     assert result["ok"] is True
     assert result["score"] == 1.0
 
 
-def test_validate_llm_fallback_no_api_key(client: TestClient, sample_llm_rule, sample_document):
+def test_validate_llm_fallback_no_api_key(client: TestClient, sample_llm_rule, sample_document, admin_headers):
     """Test LLM validation fallback when no API key is set"""
-    # Create an LLM rule
-    response = client.post("/rules/", json=sample_llm_rule)
+    rule_payload = dict(sample_llm_rule)
+    response = client.post("/rules/", json=rule_payload, headers=admin_headers)
     assert response.status_code == 200
 
-    # Validate document (should fail gracefully)
     validation_request = {
         "document": sample_document,
-        "ruleset": {"source": "UCP600", "article": "17"}
+        "ruleset": {"source": "UCP600", "article": "17"},
     }
 
-    response = client.post("/validate/", json=validation_request)
+    response = client.post("/validate/", json=validation_request, headers=admin_headers)
     assert response.status_code == 200
 
     result = response.json()
@@ -60,23 +56,21 @@ def test_validate_llm_fallback_no_api_key(client: TestClient, sample_llm_rule, s
     assert "LLM service not available" in violation["details"]["error"]
 
 
-def test_validate_batch_endpoint(client: TestClient, sample_rule, sample_document, sample_ruleset):
+def test_validate_batch_endpoint(client: TestClient, sample_rule, sample_document, sample_ruleset, admin_headers):
     """Test batch validation endpoint"""
-    # Create a rule
-    response = client.post("/rules/", json=sample_rule)
+    response = client.post("/rules/", json=dict(sample_rule), headers=admin_headers)
     assert response.status_code == 200
 
-    # Test batch validation
     batch_request = {
         "documents": [
             {"id": "doc1", "payload": sample_document},
-            {"id": "doc2", "payload": {**sample_document, "document_type": "invoice"}}
+            {"id": "doc2", "payload": {**sample_document, "document_type": "invoice"}},
         ],
         "ruleset": sample_ruleset,
-        "parallel": True
+        "parallel": True,
     }
 
-    response = client.post("/validate/batch", json=batch_request)
+    response = client.post("/validate/batch", json=batch_request, headers=admin_headers)
     assert response.status_code == 200
 
     result = response.json()
@@ -86,107 +80,93 @@ def test_validate_batch_endpoint(client: TestClient, sample_rule, sample_documen
 
     summary = result["summary"]
     assert summary["count"] == 2
-    assert summary["ok"] == 1  # Only first document should pass
+    assert summary["ok"] == 1
     assert summary["failed"] == 1
 
 
-def test_batch_validation_sequential(client: TestClient, sample_rule, sample_document, sample_ruleset):
+def test_batch_validation_sequential(client: TestClient, sample_rule, sample_document, sample_ruleset, admin_headers):
     """Test batch validation with sequential processing"""
-    # Create a rule
-    response = client.post("/rules/", json=sample_rule)
+    response = client.post("/rules/", json=dict(sample_rule), headers=admin_headers)
     assert response.status_code == 200
 
-    # Test sequential batch validation
     batch_request = {
         "documents": [
             {"id": "doc1", "payload": sample_document},
-            {"id": "doc2", "payload": sample_document}
+            {"id": "doc2", "payload": sample_document},
         ],
         "ruleset": sample_ruleset,
-        "parallel": False
+        "parallel": False,
     }
 
-    response = client.post("/validate/batch", json=batch_request)
+    response = client.post("/validate/batch", json=batch_request, headers=admin_headers)
     assert response.status_code == 200
 
     result = response.json()
     assert len(result["results"]) == 2
-    assert result["summary"]["ok"] == 2  # Both should pass
+    assert result["summary"]["ok"] == 2
 
 
-def test_batch_validation_limits(client: TestClient):
+def test_batch_validation_limits(client: TestClient, admin_headers):
     """Test batch validation safety limits"""
-    # Test empty documents
     batch_request = {
         "documents": [],
         "ruleset": {"source": "UCP600"},
-        "parallel": True
+        "parallel": True,
     }
 
-    response = client.post("/validate/batch", json=batch_request)
+    response = client.post("/validate/batch", json=batch_request, headers=admin_headers)
     assert response.status_code == 400
     assert "No documents provided" in response.json()["detail"]
 
-    # Test too many documents
     large_batch = {
         "documents": [{"id": f"doc{i}", "payload": {}} for i in range(101)],
         "ruleset": {"source": "UCP600"},
-        "parallel": True
+        "parallel": True,
     }
 
-    response = client.post("/validate/batch", json=large_batch)
+    response = client.post("/validate/batch", json=large_batch, headers=admin_headers)
     assert response.status_code == 400
     assert "Maximum 100 documents" in response.json()["detail"]
 
 
 @patch('app.services.llm_helper.llm_helper.run_llm_check')
-def test_llm_validation_with_api_key(mock_llm_check, client: TestClient, sample_llm_rule, sample_document):
+def test_llm_validation_with_api_key(mock_llm_check: Mock, client: TestClient, sample_llm_rule, sample_document, admin_headers):
     """Test LLM validation when API key is available"""
-    # Mock LLM response
     mock_llm_check.return_value = (True, {"reason": "Documents are consistent", "model": "gpt-3.5-turbo"})
 
-    # Set API key for this test
     with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
-        # Create an LLM rule
-        response = client.post("/rules/", json=sample_llm_rule)
+        response = client.post("/rules/", json=dict(sample_llm_rule), headers=admin_headers)
         assert response.status_code == 200
 
-        # Validate document
         validation_request = {
             "document": sample_document,
-            "ruleset": {"source": "UCP600", "article": "17"}
+            "ruleset": {"source": "UCP600", "article": "17"},
         }
 
-        response = client.post("/validate/", json=validation_request)
+        response = client.post("/validate/", json=validation_request, headers=admin_headers)
         assert response.status_code == 200
 
         result = response.json()
         assert result["ok"] is True
         assert result["score"] == 1.0
-
-        # Verify LLM was called
         mock_llm_check.assert_called_once()
 
 
 @patch('app.services.llm_helper.llm_helper.run_llm_check')
-def test_llm_validation_failure(mock_llm_check, client: TestClient, sample_llm_rule, sample_document):
+def test_llm_validation_failure(mock_llm_check: Mock, client: TestClient, sample_llm_rule, sample_document, admin_headers):
     """Test LLM validation when LLM returns failure"""
-    # Mock LLM failure response
     mock_llm_check.return_value = (False, {"reason": "Documents contain inconsistent dates", "model": "gpt-3.5-turbo"})
 
-    # Set API key for this test
     with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
-        # Create an LLM rule
-        response = client.post("/rules/", json=sample_llm_rule)
+        response = client.post("/rules/", json=dict(sample_llm_rule), headers=admin_headers)
         assert response.status_code == 200
 
-        # Validate document
         validation_request = {
             "document": sample_document,
-            "ruleset": {"source": "UCP600", "article": "17"}
+            "ruleset": {"source": "UCP600", "article": "17"},
         }
 
-        response = client.post("/validate/", json=validation_request)
+        response = client.post("/validate/", json=validation_request, headers=admin_headers)
         assert response.status_code == 200
 
         result = response.json()
@@ -196,4 +176,4 @@ def test_llm_validation_failure(mock_llm_check, client: TestClient, sample_llm_r
 
         violation = result["violations"][0]
         assert violation["llm_based"] is True
-        assert violation["details"]["reason"] == "Documents contain inconsistent dates"
\ No newline at end of file
+        assert violation["details"]["reason"] == "Documents contain inconsistent dates"
diff --git a/tests/test_versions_async.py b/tests/test_versions_async.py
index ae2a5f11..7d979259 100644
--- a/tests/test_versions_async.py
+++ b/tests/test_versions_async.py
@@ -1,38 +1,11 @@
 import json
 import uuid
 
-import pytest
-from fastapi import Request
-
 from app.main import app
 from app.db import get_db
-from app.middleware.tenant_context import require_admin_role, get_current_tenant_role
 from app.models.versions import RulebookVersion
 
 
-@pytest.fixture()
-def versions_admin_override(client, test_session):
-    def override_admin_role(request: Request):
-        return True
-
-    def override_role(request: Request):
-        return "admin"
-
-    def override_db():
-        try:
-            yield test_session
-        finally:
-            pass
-
-    app.dependency_overrides[require_admin_role] = override_admin_role
-    app.dependency_overrides[get_current_tenant_role] = override_role
-    app.dependency_overrides[get_db] = override_db
-    yield
-    app.dependency_overrides.pop(require_admin_role, None)
-    app.dependency_overrides.pop(get_current_tenant_role, None)
-    app.dependency_overrides.pop(get_db, None)
-
-
 def _version_payload():
     unique = uuid.uuid4().hex[:8]
     return {
@@ -45,10 +18,10 @@ def _version_payload():
     }
 
 
-def test_create_version_success(client, versions_admin_override, test_session):
+def test_create_version_success(client, admin_headers, test_session):
     payload = _version_payload()
 
-    response = client.post("/versions/", data=payload)
+    response = client.post("/versions/", data=payload, headers=admin_headers)
     assert response.status_code == 201
     body = response.json()
     assert body["name"] == payload["name"]
@@ -58,27 +31,27 @@ def test_create_version_success(client, versions_admin_override, test_session):
     assert stored.name == payload["name"]
 
 
-def test_create_version_duplicate_conflict(client, versions_admin_override):
+def test_create_version_duplicate_conflict(client, admin_headers):
     payload = _version_payload()
-    first = client.post("/versions/", data=payload)
+    first = client.post("/versions/", data=payload, headers=admin_headers)
     assert first.status_code == 201
 
-    second = client.post("/versions/", data=payload)
+    second = client.post("/versions/", data=payload, headers=admin_headers)
     assert second.status_code == 409
 
 
-def test_list_versions_returns_created(client, versions_admin_override):
+def test_list_versions_returns_created(client, admin_headers):
     payload = _version_payload()
-    client.post("/versions/", data=payload)
+    client.post("/versions/", data=payload, headers=admin_headers)
 
-    response = client.get("/versions/")
+    response = client.get("/versions/", headers=admin_headers)
     assert response.status_code == 200
     body = response.json()
     assert body["total"] >= 1
     assert any(v["name"] == payload["name"] for v in body["versions"])
 
 
-def test_create_version_db_failure(client):
+def test_create_version_db_failure(client, admin_headers):
     class BrokenQuery:
         def filter(self, *_, **__):
             return self
@@ -102,12 +75,6 @@ def test_create_version_db_failure(client):
         def rollback(self):
             self.rolled_back = True
 
-    def override_admin_role(request: Request):
-        return True
-
-    def override_role(request: Request):
-        return "admin"
-
     broken = BrokenSession()
 
     def override_db():
@@ -116,15 +83,11 @@ def test_create_version_db_failure(client):
         finally:
             pass
 
-    app.dependency_overrides[require_admin_role] = override_admin_role
-    app.dependency_overrides[get_current_tenant_role] = override_role
     app.dependency_overrides[get_db] = override_db
 
     try:
-        response = client.post("/versions/", data=_version_payload())
+        response = client.post("/versions/", data=_version_payload(), headers=admin_headers)
         assert response.status_code == 500
     finally:
-        app.dependency_overrides.pop(require_admin_role, None)
-        app.dependency_overrides.pop(get_current_tenant_role, None)
         app.dependency_overrides.pop(get_db, None)
         assert broken.rolled_back