security(07.2-03): add import time + user_nbf write to admin deactivation handler; promote stubs to PASSED

backend/tests/test_admin_api.py

@@ -450,10 +450,11 @@ async def test_delete_user_no_body(admin_client):
 # user_nbf — only deactivation writes it (RESEARCH.md anti-pattern).
 
 
-@pytest.mark.xfail(strict=False, reason="Phase 7.2 Wave 2 — user_nbf write not yet added to admin deactivation handler")
 @pytest.mark.asyncio
 async def test_deactivate_user_writes_user_nbf_to_redis(admin_client):
     """PATCH /api/admin/users/{id}/status {is_active: false} must write user_nbf:{id} to Redis."""
+    from main import app
+
     client, _admin, session = admin_client
     target = await make_regular_user(session)
 
@@ -463,11 +464,11 @@ async def test_deactivate_user_writes_user_nbf_to_redis(admin_client):
     )
     assert resp.status_code == 200
 
-    # Wave 2 will add the user_nbf write; this is the target assertion:
-    assert False, "stub — Wave 2 will fill in: nbf_bytes = await app.state.redis.get(f'user_nbf:{target.id}'); assert nbf_bytes is not None"
+    nbf_bytes = await app.state.redis.get(f"user_nbf:{target.id}")
+    assert nbf_bytes is not None
+    assert int(nbf_bytes.decode() if isinstance(nbf_bytes, (bytes, bytearray)) else nbf_bytes) > 0
 
 
-@pytest.mark.xfail(strict=False, reason="Phase 7.2 Wave 2 — activation must NOT write user_nbf (invariant guard)")
 @pytest.mark.asyncio
 async def test_activate_user_does_not_write_user_nbf(admin_client):
     """PATCH /api/admin/users/{id}/status {is_active: true} must NOT write user_nbf:{id} to Redis.
@@ -498,5 +499,5 @@ async def test_activate_user_does_not_write_user_nbf(admin_client):
     )
     assert resp.status_code == 200
 
-    # Wave 2 must preserve this invariant; this is the target assertion:
-    assert False, "stub — Wave 2 will fill in: nbf_bytes = await app.state.redis.get(f'user_nbf:{target.id}'); assert nbf_bytes is None"
+    nbf_bytes = await app.state.redis.get(f"user_nbf:{target.id}")
+    assert nbf_bytes is None, "activation must NOT write user_nbf (anti-pattern guard)"