fix(graphql): lowercase status/role enum + OTP test mock

.github/workflows/ci.yml

@@ -63,4 +63,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Build production image
-        run: docker build -t ev-backend:ci ev_backend
+        # The workflow default working-directory is already `ev_backend`, so the
+        # build context is `.` (using `ev_backend` here resolved to
+        # ev_backend/ev_backend, which has no Dockerfile).
+        run: docker build -t ev-backend:ci .

ev_backend/accounts/schema.py

@@ -23,6 +23,10 @@ class UserType(DjangoObjectType):
     class Meta:
         model = User
         exclude = ("password",)  # credential hash is never exposed
+        # Return `role` as its raw lowercase value ("user", "station_owner",
+        # "admin") rather than graphene-django's UPPERCASE choice enum — the
+        # mobile client parses the lowercase strings.
+        convert_choices_to_enum = False
 
     favorites = graphene.List(lambda: StationType)
 

ev_backend/accounts/tests.py

@@ -6,6 +6,7 @@
 and the guarantee that credentials/OTPs are hashed and never exposed.
 """
 
+import secrets
 from datetime import timedelta
 from unittest import mock
 
@@ -183,7 +184,19 @@ def setUp(self):
         self.user = make_user("fay", "fay@x.com")
 
     def test_generation_is_hashed_random_and_emailed(self):
-        with mock.patch("accounts.models.secrets.choice", side_effect=list("246810")):
+        # Make only the OTP-code digits deterministic. `secrets` is a shared
+        # module, so patching its `choice` also intercepts Django's
+        # make_password() salt generation — delegate any non-digit alphabet
+        # (i.e. the salt) back to the real RNG so it isn't starved.
+        real_choice = secrets.choice
+        digits = iter("246810")
+
+        def fake_choice(alphabet):
+            if alphabet == "0123456789":
+                return next(digits)
+            return real_choice(alphabet)
+
+        with mock.patch("accounts.models.secrets.choice", side_effect=fake_choice):
             otp = PasswordResetOTP.generate_for_user(self.user)
         # Stored value is a hash, not the code; the code verifies against it.
         self.assertNotEqual(otp.otp_hash, "246810")

ev_backend/bookings/schema.py

@@ -16,6 +16,10 @@ class BookingType(DjangoObjectType):
     class Meta:
         model = Booking
         fields = "__all__"
+        # Return `status` as its raw lowercase value ("pending", "approved", …)
+        # instead of graphene-django's auto-generated UPPERCASE choice enum.
+        # The mobile client and these tests depend on the lowercase contract.
+        convert_choices_to_enum = False
 
 
 class BookingPage(graphene.ObjectType):