Track bundled vendor runtime sources

vendor/ComfyUI/tests-unit/app_test/custom_node_manager_test.py

@@ -0,0 +1,147 @@
+import pytest
+from aiohttp import web
+from unittest.mock import patch
+from app.custom_node_manager import CustomNodeManager
+import json
+
+pytestmark = (
+    pytest.mark.asyncio
+)  # This applies the asyncio mark to all test functions in the module
+
+
+@pytest.fixture
+def custom_node_manager():
+    return CustomNodeManager()
+
+
+@pytest.fixture
+def app(custom_node_manager):
+    app = web.Application()
+    routes = web.RouteTableDef()
+    custom_node_manager.add_routes(
+        routes, app, [("ComfyUI-TestExtension1", "ComfyUI-TestExtension1")]
+    )
+    app.add_routes(routes)
+    return app
+
+
+async def test_get_workflow_templates(aiohttp_client, app, tmp_path):
+    client = await aiohttp_client(app)
+    # Setup temporary custom nodes file structure with 1 workflow file
+    custom_nodes_dir = tmp_path / "custom_nodes"
+    example_workflows_dir = (
+        custom_nodes_dir / "ComfyUI-TestExtension1" / "example_workflows"
+    )
+    example_workflows_dir.mkdir(parents=True)
+    template_file = example_workflows_dir / "workflow1.json"
+    template_file.write_text("")
+
+    with patch(
+        "folder_paths.folder_names_and_paths",
+        {"custom_nodes": ([str(custom_nodes_dir)], None)},
+    ):
+        response = await client.get("/workflow_templates")
+        assert response.status == 200
+        workflows_dict = await response.json()
+        assert isinstance(workflows_dict, dict)
+        assert "ComfyUI-TestExtension1" in workflows_dict
+        assert isinstance(workflows_dict["ComfyUI-TestExtension1"], list)
+        assert workflows_dict["ComfyUI-TestExtension1"][0] == "workflow1"
+
+
+async def test_build_translations_empty_when_no_locales(custom_node_manager, tmp_path):
+    custom_nodes_dir = tmp_path / "custom_nodes"
+    custom_nodes_dir.mkdir(parents=True)
+
+    with patch("folder_paths.get_folder_paths", return_value=[str(custom_nodes_dir)]):
+        translations = custom_node_manager.build_translations()
+        assert translations == {}
+
+
+async def test_build_translations_loads_all_files(custom_node_manager, tmp_path):
+    # Setup test directory structure
+    custom_nodes_dir = tmp_path / "custom_nodes" / "test-extension"
+    locales_dir = custom_nodes_dir / "locales" / "en"
+    locales_dir.mkdir(parents=True)
+
+    # Create test translation files
+    main_content = {"title": "Test Extension"}
+    (locales_dir / "main.json").write_text(json.dumps(main_content))
+
+    node_defs = {"node1": "Node 1"}
+    (locales_dir / "nodeDefs.json").write_text(json.dumps(node_defs))
+
+    commands = {"cmd1": "Command 1"}
+    (locales_dir / "commands.json").write_text(json.dumps(commands))
+
+    settings = {"setting1": "Setting 1"}
+    (locales_dir / "settings.json").write_text(json.dumps(settings))
+
+    with patch(
+        "folder_paths.get_folder_paths", return_value=[tmp_path / "custom_nodes"]
+    ):
+        translations = custom_node_manager.build_translations()
+
+        assert translations == {
+            "en": {
+                "title": "Test Extension",
+                "nodeDefs": {"node1": "Node 1"},
+                "commands": {"cmd1": "Command 1"},
+                "settings": {"setting1": "Setting 1"},
+            }
+        }
+
+
+async def test_build_translations_handles_invalid_json(custom_node_manager, tmp_path):
+    # Setup test directory structure
+    custom_nodes_dir = tmp_path / "custom_nodes" / "test-extension"
+    locales_dir = custom_nodes_dir / "locales" / "en"
+    locales_dir.mkdir(parents=True)
+
+    # Create valid main.json
+    main_content = {"title": "Test Extension"}
+    (locales_dir / "main.json").write_text(json.dumps(main_content))
+
+    # Create invalid JSON file
+    (locales_dir / "nodeDefs.json").write_text("invalid json{")
+
+    with patch(
+        "folder_paths.get_folder_paths", return_value=[tmp_path / "custom_nodes"]
+    ):
+        translations = custom_node_manager.build_translations()
+
+        assert translations == {
+            "en": {
+                "title": "Test Extension",
+            }
+        }
+
+
+async def test_build_translations_merges_multiple_extensions(
+    custom_node_manager, tmp_path
+):
+    # Setup test directory structure for two extensions
+    custom_nodes_dir = tmp_path / "custom_nodes"
+    ext1_dir = custom_nodes_dir / "extension1" / "locales" / "en"
+    ext2_dir = custom_nodes_dir / "extension2" / "locales" / "en"
+    ext1_dir.mkdir(parents=True)
+    ext2_dir.mkdir(parents=True)
+
+    # Create translation files for extension 1
+    ext1_main = {"title": "Extension 1", "shared": "Original"}
+    (ext1_dir / "main.json").write_text(json.dumps(ext1_main))
+
+    # Create translation files for extension 2
+    ext2_main = {"description": "Extension 2", "shared": "Override"}
+    (ext2_dir / "main.json").write_text(json.dumps(ext2_main))
+
+    with patch("folder_paths.get_folder_paths", return_value=[str(custom_nodes_dir)]):
+        translations = custom_node_manager.build_translations()
+
+        assert translations == {
+            "en": {
+                "title": "Extension 1",
+                "description": "Extension 2",
+                "shared": "Override",  # Second extension should override first
+            }
+        }

vendor/ComfyUI/tests-unit/app_test/frontend_manager_test.py

@@ -0,0 +1,289 @@
+import argparse
+import pytest
+from requests.exceptions import HTTPError
+from unittest.mock import patch, mock_open
+
+from app.frontend_management import (
+    FrontendManager,
+    FrontEndProvider,
+    Release,
+)
+from comfy.cli_args import DEFAULT_VERSION_STRING
+
+
+@pytest.fixture
+def mock_releases():
+    return [
+        Release(
+            id=1,
+            tag_name="1.0.0",
+            name="Release 1.0.0",
+            prerelease=False,
+            created_at="2022-01-01T00:00:00Z",
+            published_at="2022-01-01T00:00:00Z",
+            body="Release notes for 1.0.0",
+            assets=[{"name": "dist.zip", "url": "https://example.com/dist.zip"}],
+        ),
+        Release(
+            id=2,
+            tag_name="2.0.0",
+            name="Release 2.0.0",
+            prerelease=False,
+            created_at="2022-02-01T00:00:00Z",
+            published_at="2022-02-01T00:00:00Z",
+            body="Release notes for 2.0.0",
+            assets=[{"name": "dist.zip", "url": "https://example.com/dist.zip"}],
+        ),
+    ]
+
+
+@pytest.fixture
+def mock_provider(mock_releases):
+    provider = FrontEndProvider(
+        owner="test-owner",
+        repo="test-repo",
+    )
+    provider.all_releases = mock_releases
+    provider.latest_release = mock_releases[1]
+    FrontendManager.PROVIDERS = [provider]
+    return provider
+
+
+@pytest.fixture(autouse=True)
+def clear_cache():
+    import utils.install_util
+    import app.frontend_management
+
+    utils.install_util.PACKAGE_VERSIONS = {}
+    app.frontend_management.COMFY_PACKAGE_VERSIONS = []
+
+
+def test_get_release(mock_provider, mock_releases):
+    version = "1.0.0"
+    release = mock_provider.get_release(version)
+    assert release == mock_releases[0]
+
+
+def test_get_release_latest(mock_provider, mock_releases):
+    version = "latest"
+    release = mock_provider.get_release(version)
+    assert release == mock_releases[1]
+
+
+def test_get_release_invalid_version(mock_provider):
+    version = "invalid"
+    with pytest.raises(ValueError):
+        mock_provider.get_release(version)
+
+
+def test_init_frontend_default():
+    version_string = DEFAULT_VERSION_STRING
+    frontend_path = FrontendManager.init_frontend(version_string)
+    assert frontend_path == FrontendManager.default_frontend_path()
+
+
+def test_init_frontend_invalid_version():
+    version_string = "test-owner/test-repo@1.100.99"
+    with pytest.raises(HTTPError):
+        FrontendManager.init_frontend_unsafe(version_string)
+
+
+def test_init_frontend_invalid_provider():
+    version_string = "invalid/invalid@latest"
+    with pytest.raises(HTTPError):
+        FrontendManager.init_frontend_unsafe(version_string)
+
+
+@pytest.fixture
+def mock_os_functions():
+    with (
+        patch("app.frontend_management.os.makedirs") as mock_makedirs,
+        patch("app.frontend_management.os.listdir") as mock_listdir,
+        patch("app.frontend_management.os.rmdir") as mock_rmdir,
+    ):
+        mock_listdir.return_value = []  # Simulate empty directory
+        yield mock_makedirs, mock_listdir, mock_rmdir
+
+
+@pytest.fixture
+def mock_download():
+    with patch("app.frontend_management.download_release_asset_zip") as mock:
+        mock.side_effect = Exception("Download failed")  # Simulate download failure
+        yield mock
+
+
+def test_finally_block(mock_os_functions, mock_download, mock_provider):
+    # Arrange
+    mock_makedirs, mock_listdir, mock_rmdir = mock_os_functions
+    version_string = "test-owner/test-repo@1.0.0"
+
+    # Act & Assert
+    with pytest.raises(Exception):
+        FrontendManager.init_frontend_unsafe(version_string, mock_provider)
+
+    # Assert
+    mock_makedirs.assert_called_once()
+    mock_download.assert_called_once()
+    mock_listdir.assert_called_once()
+    mock_rmdir.assert_called_once()
+
+
+def test_parse_version_string():
+    version_string = "owner/repo@1.0.0"
+    repo_owner, repo_name, version = FrontendManager.parse_version_string(
+        version_string
+    )
+    assert repo_owner == "owner"
+    assert repo_name == "repo"
+    assert version == "1.0.0"
+
+
+def test_parse_version_string_invalid():
+    version_string = "invalid"
+    with pytest.raises(argparse.ArgumentTypeError):
+        FrontendManager.parse_version_string(version_string)
+
+
+def test_init_frontend_default_with_mocks():
+    # Arrange
+    version_string = DEFAULT_VERSION_STRING
+
+    # Act
+    with (
+        patch("app.frontend_management.check_comfy_packages_versions") as mock_check,
+        patch.object(
+            FrontendManager, "default_frontend_path", return_value="/mocked/path"
+        ),
+    ):
+        frontend_path = FrontendManager.init_frontend(version_string)
+
+    # Assert
+    assert frontend_path == "/mocked/path"
+    mock_check.assert_called_once()
+
+
+def test_init_frontend_fallback_on_error():
+    # Arrange
+    version_string = "test-owner/test-repo@1.0.0"
+
+    # Act
+    with (
+        patch.object(
+            FrontendManager, "init_frontend_unsafe", side_effect=Exception("Test error")
+        ),
+        patch("app.frontend_management.check_comfy_packages_versions") as mock_check,
+        patch.object(
+            FrontendManager, "default_frontend_path", return_value="/default/path"
+        ),
+    ):
+        frontend_path = FrontendManager.init_frontend(version_string)
+
+    # Assert
+    assert frontend_path == "/default/path"
+    mock_check.assert_called_once()
+
+
+def test_get_frontend_version():
+    # Arrange
+    expected_version = "1.25.0"
+    mock_requirements_content = """torch
+torchsde
+comfyui-frontend-package==1.25.0
+other-package==1.0.0
+numpy"""
+
+    # Act
+    with patch("builtins.open", mock_open(read_data=mock_requirements_content)):
+        version = FrontendManager.get_required_frontend_version()
+
+    # Assert
+    assert version == expected_version
+
+
+def test_get_frontend_version_invalid_semver():
+    # Arrange
+    mock_requirements_content = """torch
+torchsde
+comfyui-frontend-package==1.29.3.75
+other-package==1.0.0
+numpy"""
+
+    # Act
+    with patch("builtins.open", mock_open(read_data=mock_requirements_content)):
+        version = FrontendManager.get_required_frontend_version()
+
+    # Assert
+    assert version is None
+
+
+def test_get_templates_version():
+    # Arrange
+    expected_version = "0.1.41"
+    mock_requirements_content = """torch
+torchsde
+comfyui-frontend-package==1.25.0
+comfyui-workflow-templates==0.1.41
+other-package==1.0.0
+numpy"""
+
+    # Act
+    with patch("builtins.open", mock_open(read_data=mock_requirements_content)):
+        version = FrontendManager.get_required_templates_version()
+
+    # Assert
+    assert version == expected_version
+
+
+def test_get_templates_version_not_found():
+    # Arrange
+    mock_requirements_content = """torch
+torchsde
+comfyui-frontend-package==1.25.0
+other-package==1.0.0
+numpy"""
+
+    # Act
+    with patch("builtins.open", mock_open(read_data=mock_requirements_content)):
+        version = FrontendManager.get_required_templates_version()
+
+    # Assert
+    assert version is None
+
+
+def test_get_templates_version_invalid_semver():
+    # Arrange
+    mock_requirements_content = """torch
+torchsde
+comfyui-workflow-templates==1.0.0.beta
+other-package==1.0.0
+numpy"""
+
+    # Act
+    with patch("builtins.open", mock_open(read_data=mock_requirements_content)):
+        version = FrontendManager.get_required_templates_version()
+
+    # Assert
+    assert version is None
+
+
+def test_get_installed_templates_version():
+    # Arrange
+    expected_version = "0.1.40"
+
+    # Act
+    with patch("app.frontend_management.version", return_value=expected_version):
+        version = FrontendManager.get_installed_templates_version()
+
+    # Assert
+    assert version == expected_version
+
+
+def test_get_installed_templates_version_not_installed():
+    # Act
+    with patch(
+        "app.frontend_management.version", side_effect=Exception("Package not found")
+    ):
+        version = FrontendManager.get_installed_templates_version()
+
+    # Assert
+    assert version is None

vendor/ComfyUI/tests-unit/app_test/model_manager_test.py

@@ -0,0 +1,62 @@
+import pytest
+import base64
+import json
+import struct
+from io import BytesIO
+from PIL import Image
+from aiohttp import web
+from unittest.mock import patch
+from app.model_manager import ModelFileManager
+
+pytestmark = (
+    pytest.mark.asyncio
+)  # This applies the asyncio mark to all test functions in the module
+
+@pytest.fixture
+def model_manager():
+    return ModelFileManager()
+
+@pytest.fixture
+def app(model_manager):
+    app = web.Application()
+    routes = web.RouteTableDef()
+    model_manager.add_routes(routes)
+    app.add_routes(routes)
+    return app
+
+async def test_get_model_preview_safetensors(aiohttp_client, app, tmp_path):
+    img = Image.new('RGB', (100, 100), 'white')
+    img_byte_arr = BytesIO()
+    img.save(img_byte_arr, format='PNG')
+    img_byte_arr.seek(0)
+    img_b64 = base64.b64encode(img_byte_arr.getvalue()).decode('utf-8')
+
+    safetensors_file = tmp_path / "test_model.safetensors"
+    header_bytes = json.dumps({
+        "__metadata__": {
+            "ssmd_cover_images": json.dumps([img_b64])
+        }
+    }).encode('utf-8')
+    length_bytes = struct.pack('<Q', len(header_bytes))
+    with open(safetensors_file, 'wb') as f:
+        f.write(length_bytes)
+        f.write(header_bytes)
+
+    with patch('folder_paths.folder_names_and_paths', {
+        'test_folder': ([str(tmp_path)], None)
+    }):
+        client = await aiohttp_client(app)
+        response = await client.get('/experiment/models/preview/test_folder/0/test_model.safetensors')
+
+        # Verify response
+        assert response.status == 200
+        assert response.content_type == 'image/webp'
+
+        # Verify the response contains valid image data
+        img_bytes = BytesIO(await response.read())
+        img = Image.open(img_bytes)
+        assert img.format
+        assert img.format.lower() == 'webp'
+
+        # Clean up
+        img.close()

vendor/ComfyUI/tests-unit/app_test/node_replace_manager_test.py

@@ -0,0 +1,90 @@
+"""Tests for NodeReplaceManager registration behavior."""
+import importlib
+import sys
+import types
+
+import pytest
+
+
+@pytest.fixture
+def NodeReplaceManager(monkeypatch):
+    """Provide NodeReplaceManager with `nodes` stubbed.
+
+    `app.node_replace_manager` does `import nodes` at module level, which pulls in
+    torch + the full ComfyUI graph. register() doesn't actually need it, so we
+    stub `nodes` per-test (via monkeypatch so it's torn down) and reload the
+    module so it picks up the stub instead of any cached real import.
+    """
+    fake_nodes = types.ModuleType("nodes")
+    fake_nodes.NODE_CLASS_MAPPINGS = {}
+    monkeypatch.setitem(sys.modules, "nodes", fake_nodes)
+    monkeypatch.delitem(sys.modules, "app.node_replace_manager", raising=False)
+    module = importlib.import_module("app.node_replace_manager")
+    yield module.NodeReplaceManager
+    # Drop the freshly-imported module so the next test (or a later real import
+    # of `nodes`) starts from a clean slate.
+    sys.modules.pop("app.node_replace_manager", None)
+
+
+class FakeNodeReplace:
+    """Lightweight stand-in for comfy_api.latest._io.NodeReplace."""
+    def __init__(self, new_node_id, old_node_id, old_widget_ids=None,
+                 input_mapping=None, output_mapping=None):
+        self.new_node_id = new_node_id
+        self.old_node_id = old_node_id
+        self.old_widget_ids = old_widget_ids
+        self.input_mapping = input_mapping
+        self.output_mapping = output_mapping
+
+
+def test_register_adds_replacement(NodeReplaceManager):
+    manager = NodeReplaceManager()
+    manager.register(FakeNodeReplace(new_node_id="NewNode", old_node_id="OldNode"))
+    assert manager.has_replacement("OldNode")
+    assert len(manager.get_replacement("OldNode")) == 1
+
+
+def test_register_allows_multiple_alternatives_for_same_old_node(NodeReplaceManager):
+    """Different new_node_ids for the same old_node_id should all be kept."""
+    manager = NodeReplaceManager()
+    manager.register(FakeNodeReplace(new_node_id="AltA", old_node_id="OldNode"))
+    manager.register(FakeNodeReplace(new_node_id="AltB", old_node_id="OldNode"))
+    replacements = manager.get_replacement("OldNode")
+    assert len(replacements) == 2
+    assert {r.new_node_id for r in replacements} == {"AltA", "AltB"}
+
+
+def test_register_is_idempotent_for_duplicate_pair(NodeReplaceManager):
+    """Re-registering the same (old_node_id, new_node_id) should be a no-op."""
+    manager = NodeReplaceManager()
+    manager.register(FakeNodeReplace(new_node_id="NewNode", old_node_id="OldNode"))
+    manager.register(FakeNodeReplace(new_node_id="NewNode", old_node_id="OldNode"))
+    manager.register(FakeNodeReplace(new_node_id="NewNode", old_node_id="OldNode"))
+    assert len(manager.get_replacement("OldNode")) == 1
+
+
+def test_register_idempotent_preserves_first_registration(NodeReplaceManager):
+    """First registration wins; later duplicates with different mappings are ignored."""
+    manager = NodeReplaceManager()
+    first = FakeNodeReplace(
+        new_node_id="NewNode", old_node_id="OldNode",
+        input_mapping=[{"new_id": "a", "old_id": "x"}],
+    )
+    second = FakeNodeReplace(
+        new_node_id="NewNode", old_node_id="OldNode",
+        input_mapping=[{"new_id": "b", "old_id": "y"}],
+    )
+    manager.register(first)
+    manager.register(second)
+    replacements = manager.get_replacement("OldNode")
+    assert len(replacements) == 1
+    assert replacements[0] is first
+
+
+def test_register_dedupe_does_not_affect_other_old_nodes(NodeReplaceManager):
+    manager = NodeReplaceManager()
+    manager.register(FakeNodeReplace(new_node_id="NewA", old_node_id="OldA"))
+    manager.register(FakeNodeReplace(new_node_id="NewA", old_node_id="OldA"))
+    manager.register(FakeNodeReplace(new_node_id="NewB", old_node_id="OldB"))
+    assert len(manager.get_replacement("OldA")) == 1
+    assert len(manager.get_replacement("OldB")) == 1

vendor/ComfyUI/tests-unit/app_test/test_migrations.py

@@ -0,0 +1,57 @@
+"""Test that Alembic migrations run cleanly on a file-backed SQLite DB.
+
+This catches problems like unnamed FK constraints that prevent batch-mode
+drop_constraint from working on real SQLite files (see MB-2).
+
+Migrations 0001 and 0002 are already shipped, so we only exercise
+upgrade/downgrade for 0003+.
+"""
+
+import os
+
+import pytest
+from alembic import command
+from alembic.config import Config
+
+
+# Oldest shipped revision — we upgrade to here as a baseline and never
+# downgrade past it.
+_BASELINE = "0002_merge_to_asset_references"
+
+
+def _make_config(db_path: str) -> Config:
+    root = os.path.join(os.path.dirname(__file__), "../..")
+    config_path = os.path.abspath(os.path.join(root, "alembic.ini"))
+    scripts_path = os.path.abspath(os.path.join(root, "alembic_db"))
+
+    cfg = Config(config_path)
+    cfg.set_main_option("script_location", scripts_path)
+    cfg.set_main_option("sqlalchemy.url", f"sqlite:///{db_path}")
+    return cfg
+
+
+@pytest.fixture
+def migration_db(tmp_path):
+    """Yield an alembic Config pre-upgraded to the baseline revision."""
+    db_path = str(tmp_path / "test_migration.db")
+    cfg = _make_config(db_path)
+    command.upgrade(cfg, _BASELINE)
+    yield cfg
+
+
+def test_upgrade_to_head(migration_db):
+    """Upgrade from baseline to head must succeed on a file-backed DB."""
+    command.upgrade(migration_db, "head")
+
+
+def test_downgrade_to_baseline(migration_db):
+    """Upgrade to head then downgrade back to baseline."""
+    command.upgrade(migration_db, "head")
+    command.downgrade(migration_db, _BASELINE)
+
+
+def test_upgrade_downgrade_cycle(migration_db):
+    """Full cycle: upgrade → downgrade → upgrade again."""
+    command.upgrade(migration_db, "head")
+    command.downgrade(migration_db, _BASELINE)
+    command.upgrade(migration_db, "head")

vendor/ComfyUI/tests-unit/app_test/user_manager_system_user_test.py

@@ -0,0 +1,193 @@
+"""Tests for System User Protection in user_manager.py
+
+Tests cover:
+- get_request_user_id(): 1st defense layer - blocks System Users from HTTP headers
+- get_request_user_filepath(): 2nd defense layer - structural blocking via get_public_user_directory()
+- add_user(): 3rd defense layer - prevents creation of System User names
+- Defense layers integration tests
+"""
+
+import pytest
+from unittest.mock import MagicMock, patch
+import tempfile
+
+import folder_paths
+from app.user_manager import UserManager
+
+
+@pytest.fixture
+def mock_user_directory():
+    """Create a temporary user directory."""
+    with tempfile.TemporaryDirectory() as temp_dir:
+        original_dir = folder_paths.get_user_directory()
+        folder_paths.set_user_directory(temp_dir)
+        yield temp_dir
+        folder_paths.set_user_directory(original_dir)
+
+
+@pytest.fixture
+def user_manager(mock_user_directory):
+    """Create a UserManager instance for testing."""
+    with patch('app.user_manager.args') as mock_args:
+        mock_args.multi_user = True
+        manager = UserManager()
+        # Add a default user for testing
+        manager.users = {"default": "default", "test_user_123": "Test User"}
+        yield manager
+
+
+@pytest.fixture
+def mock_request():
+    """Create a mock request object."""
+    request = MagicMock()
+    request.headers = {}
+    return request
+
+
+class TestGetRequestUserId:
+    """Tests for get_request_user_id() - 1st defense layer.
+
+    Verifies:
+    - System Users (__ prefix) in HTTP header are rejected with KeyError
+    - Public Users pass through successfully
+    """
+
+    def test_system_user_raises_error(self, user_manager, mock_request):
+        """Test System User in header raises KeyError."""
+        mock_request.headers = {"comfy-user": "__system"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            with pytest.raises(KeyError, match="Unknown user"):
+                user_manager.get_request_user_id(mock_request)
+
+    def test_system_user_cache_raises_error(self, user_manager, mock_request):
+        """Test System User cache raises KeyError."""
+        mock_request.headers = {"comfy-user": "__cache"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            with pytest.raises(KeyError, match="Unknown user"):
+                user_manager.get_request_user_id(mock_request)
+
+    def test_normal_user_works(self, user_manager, mock_request):
+        """Test normal user access works."""
+        mock_request.headers = {"comfy-user": "default"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            user_id = user_manager.get_request_user_id(mock_request)
+            assert user_id == "default"
+
+    def test_unknown_user_raises_error(self, user_manager, mock_request):
+        """Test unknown user raises KeyError."""
+        mock_request.headers = {"comfy-user": "unknown_user"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            with pytest.raises(KeyError, match="Unknown user"):
+                user_manager.get_request_user_id(mock_request)
+
+
+class TestGetRequestUserFilepath:
+    """Tests for get_request_user_filepath() - 2nd defense layer.
+
+    Verifies:
+    - Returns None when get_public_user_directory() returns None (System User)
+    - Acts as backup defense if 1st layer is bypassed
+    """
+
+    def test_system_user_returns_none(self, user_manager, mock_request, mock_user_directory):
+        """Test System User returns None (structural blocking)."""
+        # First, we need to mock get_request_user_id to return System User
+        # But actually, get_request_user_id will raise KeyError first
+        # So we test via get_public_user_directory returning None
+        mock_request.headers = {"comfy-user": "default"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            # Patch get_public_user_directory to return None for testing
+            with patch.object(folder_paths, 'get_public_user_directory', return_value=None):
+                result = user_manager.get_request_user_filepath(mock_request, "test.txt")
+                assert result is None
+
+    def test_normal_user_gets_path(self, user_manager, mock_request, mock_user_directory):
+        """Test normal user gets valid filepath."""
+        mock_request.headers = {"comfy-user": "default"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            path = user_manager.get_request_user_filepath(mock_request, "test.txt")
+            assert path is not None
+            assert "default" in path
+            assert path.endswith("test.txt")
+
+
+class TestAddUser:
+    """Tests for add_user() - 3rd defense layer (creation-time blocking).
+
+    Verifies:
+    - System User name (__ prefix) creation is rejected with ValueError
+    - Sanitized usernames that become System User are also rejected
+    """
+
+    def test_system_user_prefix_name_raises(self, user_manager):
+        """Test System User prefix in name raises ValueError."""
+        with pytest.raises(ValueError, match="System User prefix not allowed"):
+            user_manager.add_user("__system")
+
+    def test_system_user_prefix_cache_raises(self, user_manager):
+        """Test System User cache prefix raises ValueError."""
+        with pytest.raises(ValueError, match="System User prefix not allowed"):
+            user_manager.add_user("__cache")
+
+    def test_sanitized_system_user_prefix_raises(self, user_manager):
+        """Test sanitized name becoming System User prefix raises ValueError (bypass prevention)."""
+        # "__test" directly starts with System User prefix
+        with pytest.raises(ValueError, match="System User prefix not allowed"):
+            user_manager.add_user("__test")
+
+    def test_normal_user_creation(self, user_manager, mock_user_directory):
+        """Test normal user creation works."""
+        user_id = user_manager.add_user("Normal User")
+        assert user_id is not None
+        assert not user_id.startswith("__")
+        assert "Normal-User" in user_id or "Normal_User" in user_id
+
+    def test_empty_name_raises(self, user_manager):
+        """Test empty name raises ValueError."""
+        with pytest.raises(ValueError, match="username not provided"):
+            user_manager.add_user("")
+
+    def test_whitespace_only_raises(self, user_manager):
+        """Test whitespace-only name raises ValueError."""
+        with pytest.raises(ValueError, match="username not provided"):
+            user_manager.add_user("   ")
+
+
+class TestDefenseLayers:
+    """Integration tests for all three defense layers.
+
+    Verifies:
+    - Each defense layer blocks System Users independently
+    - System User bypass is impossible through any layer
+    """
+
+    def test_layer1_get_request_user_id(self, user_manager, mock_request):
+        """Test 1st defense layer blocks System Users."""
+        mock_request.headers = {"comfy-user": "__system"}
+
+        with patch('app.user_manager.args') as mock_args:
+            mock_args.multi_user = True
+            with pytest.raises(KeyError):
+                user_manager.get_request_user_id(mock_request)
+
+    def test_layer2_get_public_user_directory(self):
+        """Test 2nd defense layer blocks System Users."""
+        result = folder_paths.get_public_user_directory("__system")
+        assert result is None
+
+    def test_layer3_add_user(self, user_manager):
+        """Test 3rd defense layer blocks System User creation."""
+        with pytest.raises(ValueError):
+            user_manager.add_user("__system")