🐛(review) fixes

src/backend/core/tests/api/test_import_file_upload.py

@@ -33,6 +33,18 @@ def api_client(user):
 class TestTaskDetailViewPermissions:
     """Test that TaskDetailView enforces ownership checks."""
 
+    def test_api_task_detail_unknown_task_should_be_forbidden(self):
+        """Test that accessing an unknown task (not in cache) returns 403."""
+        user = factories.UserFactory()
+        client = APIClient()
+        client.force_authenticate(user=user)
+
+        # Try to access a task that was never registered
+        url = reverse("task-detail", kwargs={"task_id": "unknown-task-id"})
+        response = client.get(url)
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        assert "not found or access expired" in response.data["detail"].lower()
+
     def test_api_task_detail_other_user_should_be_forbidden(self):
         """Test that a user cannot access another user's task, but the owner can."""
 

src/backend/core/tests/api/test_messages_create.py

@@ -169,12 +169,11 @@ class TestApiDraftAndSendMessage:
         task_id = send_response.data["task_id"]
         assert task_id is not None
 
-        # Check with an unknown task_id
+        # Check with an unknown task_id - should return 403 (task not found or access expired)
         task_response = client.get(
             reverse("task-detail", kwargs={"task_id": "unknown-task-id"})
         )
-        assert task_response.status_code == status.HTTP_200_OK
-        assert task_response.data["status"] == "PENDING"
+        assert task_response.status_code == status.HTTP_403_FORBIDDEN
 
         # Call the task API
         task_response = client.get(reverse("task-detail", kwargs={"task_id": task_id}))

src/backend/messages/settings.py

@@ -1030,6 +1030,42 @@ class E2E(Development):
     # Trust X-Forwarded-* headers from nginx proxy
     USE_X_FORWARDED_HOST = True
 
+    # Use Redis for caching (required for task owner tracking)
+    CACHES = {
+        "default": {
+            "BACKEND": "django_redis.cache.RedisCache",
+            "LOCATION": values.Value(
+                "redis://redis:6379",
+                environ_name="REDIS_URL",
+                environ_prefix=None,
+            ),
+            "TIMEOUT": values.IntegerValue(
+                300,  # 5 minutes
+                environ_name="CACHES_DEFAULT_TIMEOUT",
+                environ_prefix=None,
+            ),
+            "OPTIONS": {
+                "CLIENT_CLASS": "django_redis.client.DefaultClient",
+            },
+        },
+        "session": {
+            "BACKEND": "django_redis.cache.RedisCache",
+            "LOCATION": values.Value(
+                "redis://redis:6379",
+                environ_name="REDIS_URL",
+                environ_prefix=None,
+            ),
+            "TIMEOUT": values.IntegerValue(
+                300,
+                environ_name="CACHES_DEFAULT_TIMEOUT",
+                environ_prefix=None,
+            ),
+            "OPTIONS": {
+                "CLIENT_CLASS": "django_redis.client.DefaultClient",
+            },
+        },
+    }
+
 
 class DevelopmentMinimal(Development):
     """