docs(6.1-01): complete plan — promote test_shares.py stubs to real tests

- 2/2 tasks complete: second_auth_user fixture + 7 real share tests
- 7 PASSED in Docker (0 xfailed, 0 failed)
- SHARE-01..05 requirements covered

.planning/phases/06.1-close-v1-audit-gaps/06.1-01-SUMMARY.md

@@ -0,0 +1,94 @@
+---
+phase: "6.1"
+plan: "06.1-01"
+subsystem: testing
+tags: [shares, test-promotion, xfail-removal, SHARE-01, SHARE-02, SHARE-03, SHARE-04, SHARE-05]
+dependency_graph:
+  requires: [04-04]
+  provides: [SHARE-01-tests, SHARE-02-tests, SHARE-03-tests, SHARE-04-tests, SHARE-05-tests]
+  affects: [backend/tests/test_shares.py, backend/tests/conftest.py]
+tech_stack:
+  added: []
+  patterns: [pytest_asyncio fixture, ORM direct-insert helper, pytestmark module-level]
+key_files:
+  created: []
+  modified:
+    - backend/tests/test_shares.py
+    - backend/tests/conftest.py
+decisions:
+  - "second_auth_user fixture uses user2_ handle prefix to prevent collisions with auth_user's testuser_ prefix"
+  - "_make_doc() helper inserts Document row directly via ORM (no upload endpoint) — same pattern as test_documents.py"
+  - "pytestmark = pytest.mark.asyncio at module level replaces per-test decorators — consistent with other test files"
+metrics:
+  duration: "~15 minutes"
+  completed_date: "2026-05-30"
+  tasks_completed: 2
+  tasks_total: 2
+  files_modified: 2
+---
+
+# Phase 6.1 Plan 01: Promote test_shares.py stubs to real tests (SHARE-01..05) Summary
+
+**One-liner:** Seven xfail stubs replaced with real integration tests that exercise POST/GET/DELETE /api/shares via in-memory SQLite, plus a second_auth_user fixture enabling sharer/recipient scenarios.
+
+## Tasks Completed
+
+| Task | Description | Commit |
+|------|-------------|--------|
+| 1 | Add second_auth_user fixture to conftest.py | b7df971 |
+| 2 | Rewrite test_shares.py — 7 real tests replacing xfail stubs | 9973f42 |
+
+## What Was Built
+
+### Task 1 — second_auth_user fixture (conftest.py)
+
+Added `@pytest_asyncio.fixture async def second_auth_user(db_session)` immediately after `auth_user`. The fixture creates a second User with handle prefix `user2_` and email `user2_{hex8}@example.com`, plus a Quota row with limit_bytes=100MB and used_bytes=0. Returns the same `{user, token, headers}` dict shape as `auth_user`. This fixture enables sharing tests that need a distinct sharer and recipient within the same test case.
+
+### Task 2 — Real tests in test_shares.py
+
+Completely rewrote `backend/tests/test_shares.py`:
+- Removed: all 7 `@pytest.mark.xfail(strict=False)` decorators, all 7 `pytest.xfail("not implemented yet")` calls, `import os` (was unused)
+- Added: `pytestmark = pytest.mark.asyncio`, `import uuid as _uuid`, `import pytest_asyncio`
+- Added: `async def _make_doc(db_session, owner_user)` helper that inserts an uploaded Document row via ORM and returns `str(doc_id)`
+- Implemented 7 real tests:
+
+| Test | Requirement | Assertion |
+|------|-------------|-----------|
+| test_share_success | SHARE-01 | POST 201, body has id/document_id/recipient_id; recipient sees doc in /received |
+| test_share_handle_not_found | SHARE-01 | POST with nonexistent handle → 404 |
+| test_shared_with_me | SHARE-02 | /received has required fields; extracted_text absent (T-04-04-03); owner_handle correct |
+| test_share_no_quota_impact | SHARE-03 | Recipient /quota used_bytes == 0 after share (T-04-04-04) |
+| test_revoke_share | SHARE-04 | DELETE 204; doc no longer in recipient /received |
+| test_share_revoke_wrong_owner_404 | SHARE-04 | Recipient DELETE → 404 not 403 (IDOR protection T-04-04-02) |
+| test_share_duplicate | SHARE-05 | Second POST with same doc+recipient → 409 |
+
+## Verification
+
+```
+docker compose exec backend python -m pytest tests/test_shares.py -v
+```
+
+Result: **7 passed, 0 failed, 0 xfailed, 0 xpassed** (verified in Docker with pytest 9.0.3, asyncio mode=AUTO).
+
+## Deviations from Plan
+
+None — plan executed exactly as written. The second_auth_user fixture was added to the worktree conftest.py at the exact position specified (after auth_user, before admin_user). All 7 tests match the plan spec.
+
+## Known Stubs
+
+None. All 7 tests have real assertions against the live API.
+
+## Threat Flags
+
+None. No new network endpoints, auth paths, file access patterns, or schema changes introduced. This plan is test-only.
+
+## Self-Check: PASSED
+
+- [x] `backend/tests/conftest.py` contains `second_auth_user` fixture at line 229
+- [x] `backend/tests/test_shares.py` has zero `pytest.xfail` calls
+- [x] `backend/tests/test_shares.py` has zero `@pytest.mark.xfail` decorators
+- [x] `import os` is absent from test_shares.py
+- [x] `pytestmark = pytest.mark.asyncio` is present at module level
+- [x] Commit b7df971 exists (Task 1)
+- [x] Commit 9973f42 exists (Task 2)
+- [x] Docker test run: 7 passed, 0 failed