Realistic test data: factory_boy fixtures + curated prod media subset

[jonfroehlich]

Context

Spinoff from #1268, which was originally bundling REST API + test-data sync. The actual driver was getting realistic content into localhost so UI/template changes can be reviewed against prod-like data. This issue tracks that work as a standalone effort with no API dependency.

Background

Current test infrastructure (landed in #1267) uses DatabaseTestCase + small make_person / make_publication / make_news_item helpers in website/tests.py. These work for unit/integration tests but:

• Don't compose well for the M2M / SortedManyToManyField / ProjectRole-through graph.
• Don't include real media files, so image_cropping / easy_thumbnails / PDF preview code paths only ever see empty file fields.
• Don't produce a coherent dev environment for visual review.

Recommendation — split into two layers

Layer 1: factory_boy + Faker (Django standard)

• Add factory_boy and Faker to requirements.txt. De-facto Django standard for ~12 years; preferred over model_bakery here because explicit factories are easier to debug with our complex relationship graph.

• Create website/tests/factories.py with PersonFactory, PublicationFactory, ProjectFactory, ProjectRoleFactory, TalkFactory, PosterFactory, VideoFactory, NewsItemFactory, AwardFactory. Pattern:

  class PublicationFactory(DjangoModelFactory):
      class Meta:
          model = Publication
      title = factory.Faker("sentence", nb_words=8)
      date = factory.Faker("date_between", start_date="-3y", end_date="today")
      pdf_file = factory.django.FileField(from_path=SEED_PDF_PATH)
  
      @factory.post_generation
      def authors(self, create, extracted, **kwargs):
          if create:
              self.authors.set(extracted or PersonFactory.create_batch(3))

• Refactor existing make_person / make_publication / make_news_item helpers in website/tests.py to thin wrappers that delegate to the new factories (keeps existing tests green).

• Add website/tests/seed_media/ with ~5 hand-curated representative files (one real PDF, a few JPGs at different aspect ratios, a project logo). Factory FileFields point at these so every test exercises real thumbnail / PDF / image-cropping code paths.

Layer 2: prod media subset + seed_dev_data command

• Add python manage.py seed_dev_data that uses the factories to build a coherent graph (~5 projects, ~15 people, ~20 pubs with cross-links, ~5 talks/posters, news items, awards). Idempotent. Run after docker-compose up for a realistic-shaped site with zero prod dependency.
• For prod-realistic media (when you actually want to see what real content looks like): add scripts/pull_prod_subset.sh that rsyncs a curated subset from recycle.

Prod media size analysis (2026-06-14)

Total media tree at /cse/web/research/makelab/www/media on recycle: 56 GB / 13,130 files.

Folder	Size
talks/	50 GB
publications/	1.7 GB
banner/	1.3 GB
person/	837 MB
posters/	719 MB
projects/	611 MB
news/	738 MB
uploads/	323 MB
others	~120 MB

Whole-tree rsync is impractical (talks alone is 50 GB, mostly slide PDFs/videos). But person/ + projects/ + publications/ + posters/ ≈ 3.9 GB is the visual core of the site and is realistic to mirror.

Optional refinement: pair the rsync with a dumpdata JSON of the matching DB rows so the local DB references real filenames. Gitignore both outputs.

Suggested first PR slice

1. Add factory_boy + Faker to requirements.txt.
2. Create website/tests/factories.py with core factories.
3. Add website/tests/seed_media/ with curated files.
4. Migrate existing make_* helpers to delegate to factories.

Subsequent PRs: seed_dev_data management command, then pull_prod_subset.sh.

Out of scope (parked in #1268)

REST API for external consumers. Conversation concluded the only known consumer is Jon's academic page ("Recent Pubs" list), which can be served by a single JsonResponse view rather than a full DRF API.

[jonfroehlich]

Status (2026-06-17): the suggested first PR slice is up as #1319 — factory_boy/Faker added, website/tests/factories.py with the core factories, and the DatabaseTestCase.make_* helpers rewritten to delegate to them (suite stays green, 201→211). Two deliberate choices documented there: filesystem-light factories (tiny in-memory files; curated seed_media/ deferred) and no auto-authors (artifacts authorless unless authors=[...] passed, to preserve ~200 existing call sites).

Remaining for this issue (each its own PR):

• seed_dev_data management command building a coherent graph (~5 projects / ~15 people / ~20 pubs / talks / news / awards), idempotent.
• Curated website/tests/seed_media/ (~5 real files) so seed/visual-review paths exercise real thumbnail/crop/PDF code.
• scripts/pull_prod_subset.sh (rsync the ~3.9 GB visual core: person/projects/publications/posters) — waits on a DB snapshot from CSE IT.

[jonfroehlich]

Status (2026-06-24): Layer 1 done; remaining work re-scoped around an admin "Download seed bundle" button.

Layer 1 (factories) shipped in #1319 and is the part that pays off in the test suite, so it's complete. For the remaining goal — getting fresh real prod content into a localhost dev DB — we settled on a concrete design and decided to build it on demand (i.e. when setting up a dev environment from scratch on a new machine) rather than now. The current MacOS + Win11 dev environments already have enough data to keep making progress.

Why not the originally-proposed Layer 2 mechanisms

• CSE IT DB snapshot — slow and out of our control; avoid.
• pull_prod_subset.sh (3.9 GB rsync) — too heavy for the actual need (visual review), and prod DB isn't reachable from a laptop anyway (grabthar loopback only).
• Unauthenticated API/dump endpoint — would serialize Person PII and re-create the public dumped_data.json exposure mistake. Rejected.

Agreed design — superuser-gated admin button (DB slice)

Mirror the existing data-health admin views (superuser-gated, admin_view-wrapped, streaming download, URL registered in MakeabilityLabAdminSite.get_urls()):

New website/admin/seed_export/

• export.py — build_seed_bundle(limit=10) returns a JSON string:
  • N most-recent anchor rows per model: Publication, Talk, Poster, Video, News, Award, Project (default 10, overridable via ?limit=).
  • Walks the forward relation closure explicitly (artifact → authors/projects/keywords; project → owner/ProjectRole/umbrellas; etc.) so loaddata never hits a missing FK. Explicit relation list over generic graph-walking (clarity over cleverness).
  • serializers.serialize('json', objs, use_natural_foreign_keys=True), keeping PKs so FKs resolve.
  • Strips Person PII (email + non-public fields) from the output even though the download is authenticated.
  • DB only — file/image fields keep their path strings; actual media files are not in the bundle.
• views.py — download(request): _require_superuser, calls build_seed_bundle(), returns application/json as a Content-Disposition attachment. Nothing written to disk on the server (avoids the public-path exposure footgun).

admin_site.py — register seed-export/seed-bundle.json in get_urls(), plus a small superuser-gated landing page with a "Download seed bundle" button.

website/tests/test_seed_export.py — non-superuser → 403; and build a bundle from factory data, round-trip it through deserialize/loaddata, and assert objects + their authors/projects reconstruct (proves the dependency closure is complete).

Local load: manage.py loaddata <downloaded file> into the local DB.

Follow-up slice (media)

scripts/pull_seed_media.sh — reads the filenames out of the downloaded JSON and rsyncs just those from recycle.cs.uw.edu (SSH keys make this seamless), filling in real images/PDFs so image_cropping/easy_thumbnails/PDF-preview paths get exercised. A few dozen MB, not the 3.9 GB subset.

Workflow

Develop/iterate against -test (push-deployable, DEBUG=True, fully controlled); point at prod for real pulls. Run /security-review on the endpoint before it ships to prod, since it's a data-export surface.

Plan approved; deferred to "build when a fresh dev environment is needed."