Phase 4: contacts & fittings — reads + guarded writes (#25, #26)

Contacts: read character/corp/alliance contacts; guarded add/remove of
character contacts. Fittings: read saved fits; guarded create/delete.
EsiClient.delete now takes params. All writes go through write-safety.

Closes #25, #26. 120 tests, coverage 89%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_contacts_fittings.py

@@ -0,0 +1,97 @@
+"""Contacts and fittings: reads + guarded writes."""
+
+import asyncio
+
+import httpx
+import pytest
+
+from conftest import route
+from familiar import auth, contacts, fittings, writes
+from familiar.server import mcp
+
+CHARS = [{"character_id": 99, "character_name": "Alpha", "scopes": []}]
+
+
+@pytest.fixture
+def fake_auth(monkeypatch):
+    monkeypatch.setattr(auth, "list_characters", lambda: list(CHARS))
+
+    async def get_auth(cid, **kw):
+        return f"token-{cid}", cid
+
+    monkeypatch.setattr(auth, "get_auth", get_auth)
+    monkeypatch.setattr(auth, "resolve_character", lambda i: 99)
+    return CHARS
+
+
+@pytest.fixture
+def writes_on(tmp_path, monkeypatch):
+    monkeypatch.setenv("FAMILIAR_DATA_DIR", str(tmp_path))
+    monkeypatch.setenv("FAMILIAR_ENABLE_WRITES", "true")
+
+
+def test_get_contacts(mock_esi, fake_auth):
+    mock_esi(lambda r: route(r, {"/contacts/": [{"contact_id": 1, "standing": 5.0}]}))
+    res = asyncio.run(contacts.get_contacts())
+    assert res["characters"][0]["count"] == 1
+
+
+def test_alliance_contacts(mock_esi, fake_auth):
+    fixtures = {
+        "/characters/99/": {"corporation_id": 2000},
+        "/corporations/2000/": {"alliance_id": 3000},
+        "/alliances/": [{"contact_id": 7}],
+    }
+    mock_esi(lambda r: route(r, fixtures))
+    res = asyncio.run(contacts.get_alliance_contacts())
+    assert res["characters"][0]["alliance_id"] == 3000
+    assert res["characters"][0]["count"] == 1
+
+
+def test_add_contacts_dry_run(mock_esi, fake_auth):
+    posted = []
+    mock_esi(lambda r: (posted.append(r), httpx.Response(200, json=[1]))[1])
+    res = asyncio.run(contacts.add_contacts(99, [1, 2], standing=5.0))
+    assert res["dry_run"] is True
+    assert not posted
+
+
+def test_remove_contacts_executes(mock_esi, fake_auth, writes_on):
+    mock_esi(lambda r: httpx.Response(204, content=b""))
+    res = asyncio.run(contacts.remove_contacts(99, [1], confirm=True))
+    assert res["executed"] is True
+
+
+def test_get_fittings(mock_esi, fake_auth):
+    mock_esi(lambda r: route(r, {"/fittings/": [{"fitting_id": 1, "name": "PvP Rifter"}]}))
+    res = asyncio.run(fittings.get_fittings())
+    assert res["characters"][0]["count"] == 1
+
+
+def test_create_fitting_disabled_raises(mock_esi, fake_auth, tmp_path, monkeypatch):
+    monkeypatch.setenv("FAMILIAR_DATA_DIR", str(tmp_path))
+    monkeypatch.delenv("FAMILIAR_ENABLE_WRITES", raising=False)
+    mock_esi(lambda r: httpx.Response(201, json={"fitting_id": 5}))
+    with pytest.raises(writes.WriteDisabled):
+        asyncio.run(fittings.create_fitting(99, {"name": "x"}, confirm=True))
+
+
+def test_create_fitting_executes(mock_esi, fake_auth, writes_on):
+    mock_esi(lambda r: httpx.Response(201, json={"fitting_id": 5}))
+    res = asyncio.run(fittings.create_fitting(99, {"name": "x", "ship_type_id": 587}, confirm=True))
+    assert res["executed"] is True
+    assert res["result"]["fitting_id"] == 5
+
+
+def test_contacts_fittings_registered():
+    tools = {t.name for t in asyncio.run(mcp.list_tools())}
+    assert {
+        "get_contacts",
+        "get_corp_contacts",
+        "get_alliance_contacts",
+        "add_contacts",
+        "remove_contacts",
+        "get_fittings",
+        "create_fitting",
+        "delete_fitting",
+    } <= tools