feat(5.20): US-001/002/003 schema medii per cont + disponibilitate + idempotenta env-aware

US-001: coloane accounts (rar_test/prod_enabled, rar_creds_test/prod_enc,
rar_env_default) + submissions.rar_env; migrare cu backfill din ancora globala
AUTOPASS_RAR_ENV (creds->slot, enabled doar pe mediul cu creds) + recompute
idempotency_key env-aware (AUTO-FIX G + E4/3).
US-002: app/rar_env.py — medii_disponibile + rar_env_efectiv (REQ-DISP/DEFAULT).
US-003: build_key(account_id, canon, rar_env) — test vs prod = trimiteri distincte.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/db.py

@@ -71,11 +71,26 @@ def _migrate(conn: sqlite3.Connection) -> None:
         conn.execute("ALTER TABLE submissions ADD COLUMN batch_id INTEGER")
     if "row_index" not in sub_cols:
         conn.execute("ALTER TABLE submissions ADD COLUMN row_index INTEGER")
+    if "rar_env" not in sub_cols:
+        # PRD 5.20 US-001. Mediul RAR tinta pe submission. Pe DB existent NU lasam
+        # randurile pe DEFAULT 'test': un rand prod pre-migrare etichetat 'test' ar fi
+        # reconciliat de worker (US-006) contra endpoint TEST -> no-match -> re-send prod
+        # = DUPLICAT REAL IREVERSIBIL. Backfill din AUTOPASS_RAR_ENV global (ancora de
+        # migrare) + recompute idempotency_key env-aware. Ruleaza O SINGURA DATA (in
+        # blocul de adaugare a coloanei); pe DB fresh coloana vine din schema.sql (fara rows).
+        conn.execute(
+            "ALTER TABLE submissions ADD COLUMN rar_env TEXT NOT NULL DEFAULT 'test' "
+            "CHECK (rar_env IN ('test', 'prod'))"
+        )
+        _backfill_submissions_rar_env(conn)
 
     # Coloane accounts
     acc_cols = {r["name"] for r in conn.execute("PRAGMA table_info(accounts)").fetchall()}
     if "rar_creds_enc" not in acc_cols:
         conn.execute("ALTER TABLE accounts ADD COLUMN rar_creds_enc TEXT")
+        acc_cols.add("rar_creds_enc")
+    # Medii RAR per cont (PRD 5.20 US-001): activare + slot creds + default, per mediu.
+    _migrate_accounts_medii(conn, acc_cols)
     if "active" not in acc_cols:
         # Conturi existente raman active (default 1).
         conn.execute("ALTER TABLE accounts ADD COLUMN active INTEGER NOT NULL DEFAULT 1")
@@ -164,6 +179,101 @@ def _migrate(conn: sqlite3.Connection) -> None:
         )
 
 
+def _migrate_accounts_medii(conn: sqlite3.Connection, acc_cols: set[str]) -> None:
+    """PRD 5.20 US-001: coloane medii RAR per cont + backfill din ancora globala.
+
+    Adauga (idempotent): rar_test_enabled/rar_prod_enabled (bife activare),
+    rar_creds_test_enc/rar_creds_prod_enc (sloturi creds), rar_env_default.
+
+    Backfill (O SINGURA DATA, cand coloanele tocmai au fost adaugate pe DB existent):
+    creds-ul legacy `rar_creds_enc` apartine mediului `AUTOPASS_RAR_ENV` global de la
+    momentul migrarii (ancora) — il copiem in slotul acelui mediu, activam DOAR acel
+    mediu (celalalt dezactivat) si fixam default-ul pe el. Conturile fara creds raman
+    pe default-urile coloanei (prod on / test off). Migrarea NU presupune env-ul; se
+    bazeaza pe ancora globala, exact cum opera contul inainte de 5.20.
+    """
+    newly_added = "rar_env_default" not in acc_cols
+    if "rar_test_enabled" not in acc_cols:
+        conn.execute(
+            "ALTER TABLE accounts ADD COLUMN rar_test_enabled INTEGER NOT NULL DEFAULT 0 "
+            "CHECK (rar_test_enabled IN (0, 1))"
+        )
+    if "rar_prod_enabled" not in acc_cols:
+        conn.execute(
+            "ALTER TABLE accounts ADD COLUMN rar_prod_enabled INTEGER NOT NULL DEFAULT 1 "
+            "CHECK (rar_prod_enabled IN (0, 1))"
+        )
+    if "rar_creds_test_enc" not in acc_cols:
+        conn.execute("ALTER TABLE accounts ADD COLUMN rar_creds_test_enc TEXT")
+    if "rar_creds_prod_enc" not in acc_cols:
+        conn.execute("ALTER TABLE accounts ADD COLUMN rar_creds_prod_enc TEXT")
+    if "rar_env_default" not in acc_cols:
+        # ALTER nu poate adauga CHECK pe coloana noua in SQLite -> validarea ('test'/'prod')
+        # se face in cod (rar_env.py / rutele de cont). DEFAULT 'prod' (cont client nou).
+        conn.execute("ALTER TABLE accounts ADD COLUMN rar_env_default TEXT NOT NULL DEFAULT 'prod'")
+
+    if not newly_added:
+        return  # coloanele existau deja -> backfill-ul a rulat la o pornire anterioara
+
+    # Are coloana legacy rar_creds_enc randuri de migrat? (Pe DB foarte nou, e absenta.)
+    if "rar_creds_enc" not in acc_cols:
+        return
+    env = get_settings().rar_env if get_settings().rar_env in ("test", "prod") else "test"
+    other = "prod" if env == "test" else "test"
+    slot = f"rar_creds_{env}_enc"
+    conn.execute(
+        f"UPDATE accounts SET {slot} = rar_creds_enc, "
+        f"rar_{env}_enabled = 1, rar_{other}_enabled = 0, rar_env_default = ? "
+        f"WHERE rar_creds_enc IS NOT NULL AND TRIM(rar_creds_enc) <> '' AND {slot} IS NULL",
+        (env,),
+    )
+
+
+def _backfill_submissions_rar_env(conn: sqlite3.Connection) -> None:
+    """PRD 5.20 US-001 (AUTO-FIX G + E4/3): backfill rar_env + recompute idempotency_key.
+
+    Ruleaza O SINGURA DATA, imediat dupa ce coloana `submissions.rar_env` a fost adaugata
+    pe un DB existent. Toate randurile pre-migrare au fost trimise (sau urmeaza) catre
+    mediul `AUTOPASS_RAR_ENV` global — le etichetam cu acel env (NU DEFAULT 'test'), altfel
+    reconcilierea worker-ului ar lovi endpoint-ul gresit -> duplicat ireversibil.
+
+    Recompute `idempotency_key` la forma env-aware (`build_key(account_id, canon, rar_env)`):
+    altfel un re-POST al unui rand legacy (cheie env-less) ar rata randul existent ->
+    duplicat. Recompute-ul e consistent (acelasi env pe toate randurile pre-migrare) deci
+    nu poate crea coliziuni intre randuri care erau deja distincte.
+    """
+    import json as _json
+
+    from .idempotency import build_key, canonicalize_row
+
+    env = get_settings().rar_env if get_settings().rar_env in ("test", "prod") else "test"
+    conn.execute("UPDATE submissions SET rar_env = ?", (env,))
+
+    rows = conn.execute(
+        "SELECT id, account_id, idempotency_key, payload_json FROM submissions"
+    ).fetchall()
+    for r in rows:
+        try:
+            content = _json.loads(r["payload_json"])
+        except (ValueError, TypeError):
+            continue
+        canon = canonicalize_row(content)
+        # Pastreaza prestatiile rezolvate (cod_prestatie/cod_op_service) pentru _op_identity.
+        canon["prestatii"] = content.get("prestatii") or []
+        new_key = build_key(r["account_id"], canon, env)
+        if new_key == r["idempotency_key"]:
+            continue
+        try:
+            conn.execute(
+                "UPDATE submissions SET idempotency_key = ? WHERE id = ?",
+                (new_key, r["id"]),
+            )
+        except sqlite3.IntegrityError:
+            # Coliziune improbabila pe UNIQUE(idempotency_key): lasa cheia veche (no-op),
+            # randul ramane gasibil prin dual-lookup legacy.
+            continue
+
+
 def _now_iso() -> str:
     return datetime.now(timezone.utc).isoformat(timespec="seconds")
 

app/idempotency.py

@@ -70,17 +70,23 @@ def canonicalize_row(raw: dict[str, Any]) -> dict[str, Any]:
     }
 
 
-def build_key(account_id: int | None, canon: dict[str, Any]) -> str:
+def build_key(account_id: int | None, canon: dict[str, Any], rar_env: str = "test") -> str:
-    """SHA-256 partajat canal-API + canal-import.
+    """SHA-256 partajat canal-API + canal-import, env-aware (PRD 5.20 US-003).
 
     Aplica account_or_default inainte de hash: None si 1 colapseaza la aceeasi
     cheie => acelasi rand logic din canale diferite nu se trimite de doua ori.
+
+    `rar_env` ('test'|'prod') intra in cheie: aceeasi prezentare la test si apoi la
+    prod sunt DOUA trimiteri reale distincte (sisteme RAR separate), nu un duplicat.
+    Default 'test' = back-compat cu apelantii care nu paseaza inca env-ul; toate
+    rutele de ingestie paseaza env-ul rezolvat explicit.
     """
     # Import local ca sa evitam import circular (mapping importa din idempotency via validator)
     from .mapping import account_or_default
     acct = account_or_default(account_id)
     canonic = {
         "account_id": acct,
+        "rar_env": rar_env,
         "vin": canon.get("vin", ""),
         "nr_inmatriculare": canon.get("nr_inmatriculare", ""),
         "data_prestatie": canon.get("data_prestatie"),
@@ -91,8 +97,8 @@ def build_key(account_id: int | None, canon: dict[str, Any]) -> str:
     return hashlib.sha256(blob.encode("utf-8")).hexdigest()
 
 
-def idempotency_key(account_id: int | None, prezentare: dict[str, Any]) -> str:
+def idempotency_key(account_id: int | None, prezentare: dict[str, Any], rar_env: str = "test") -> str:
-    """SHA-256 peste (account_id + campurile semnificative ale prezentarii).
+    """SHA-256 peste (account_id + rar_env + campurile semnificative ale prezentarii).
 
     Wrapper backward-compat peste canonicalize_row + build_key.
     Exclude obs si b64Image (cosmetice, nu definesc unicitatea declaratiei).
@@ -102,7 +108,7 @@ def idempotency_key(account_id: int | None, prezentare: dict[str, Any]) -> str:
     acoperite automat — dual-lookup sau recompute-keys la migrare productie.
     """
     canon = canonicalize_row(prezentare)
-    return build_key(account_id, canon)
+    return build_key(account_id, canon, rar_env)
 
 
 def build_key_legacy(account_id: int | None, prezentare: dict[str, Any]) -> str:

app/rar_env.py

@@ -0,0 +1,91 @@
+"""Medii RAR per cont (PRD 5.20): disponibilitate + default efectiv.
+
+Sursa UNICA de adevar pentru REQ-DISP / REQ-DEFAULT: vizibilitatea selector/toggle
+in UI, validarea tintei in API si decizia worker-ului citesc TOATE de aici, ca sa
+decida identic.
+
+Un mediu ('test'|'prod') e *disponibil* pentru un cont daca e activat (bifa) SI are
+credentiale (slot per-mediu non-gol). Din disponibilitate decurge tot UX-ul:
+  - 0 medii  -> nicio tinta; trimiterea web e blocata, API cade pe ancora globala.
+  - 1 mediu  -> tinta implicita (acel mediu), fara selector.
+  - 2 medii  -> selector la import + toggle in statusbar + alegere in API.
+
+Functii PURE (fara DB) peste un rand de cont (sqlite3.Row sau dict). Helperele cu
+`conn` incarca randul si deleaga.
+"""
+
+from __future__ import annotations
+
+import sqlite3
+from typing import Any
+
+VALID_ENVS: tuple[str, str] = ("test", "prod")
+
+
+def _field(account: Any, key: str, default: Any = None) -> Any:
+    """Citire toleranta a unui camp de cont (dict sau sqlite3.Row, camp posibil absent)."""
+    if account is None:
+        return default
+    if isinstance(account, dict):
+        return account.get(key, default)
+    try:
+        return account[key]  # sqlite3.Row
+    except (IndexError, KeyError):
+        return default
+
+
+def _are_creds(account: Any, env: str) -> bool:
+    creds = _field(account, f"rar_creds_{env}_enc", None)
+    return bool(creds and str(creds).strip())
+
+
+def _enabled(account: Any, env: str) -> bool:
+    return int(_field(account, f"rar_{env}_enabled", 0) or 0) == 1
+
+
+def medii_disponibile(account: Any) -> list[str]:
+    """Subset din ('test','prod') = activat AND creds prezente. Ordine stabila test<prod."""
+    return [env for env in VALID_ENVS if _enabled(account, env) and _are_creds(account, env)]
+
+
+def rar_env_efectiv(account: Any) -> str | None:
+    """Mediul tinta implicit al contului (REQ-DEFAULT).
+
+    Mereu unul din mediile disponibile: default-ul contului daca inca e disponibil,
+    altfel singurul disponibil; daca 0 disponibile -> None (nicio tinta).
+    """
+    disp = medii_disponibile(account)
+    if not disp:
+        return None
+    default = _field(account, "rar_env_default", "prod")
+    if default in disp:
+        return default
+    return disp[0]
+
+
+# --------------------------------------------------------------------------- #
+# Helpere cu conexiune                                                         #
+# --------------------------------------------------------------------------- #
+
+_ACCOUNT_ENV_COLS = (
+    "id, rar_test_enabled, rar_prod_enabled, "
+    "rar_creds_test_enc, rar_creds_prod_enc, rar_env_default"
+)
+
+
+def load_account_env(conn: sqlite3.Connection, account_id: int) -> sqlite3.Row | None:
+    """Randul de cont cu exact coloanele de mediu (pentru medii_disponibile/rar_env_efectiv)."""
+    from .mapping import account_or_default
+
+    return conn.execute(
+        f"SELECT {_ACCOUNT_ENV_COLS} FROM accounts WHERE id=?",
+        (account_or_default(account_id),),
+    ).fetchone()
+
+
+def medii_disponibile_cont(conn: sqlite3.Connection, account_id: int) -> list[str]:
+    return medii_disponibile(load_account_env(conn, account_id))
+
+
+def rar_env_efectiv_cont(conn: sqlite3.Connection, account_id: int) -> str | None:
+    return rar_env_efectiv(load_account_env(conn, account_id))

app/schema.sql

@@ -19,7 +19,15 @@ CREATE TABLE IF NOT EXISTS accounts (
     -- vezi accounts.delete_account — randul ramane doar pentru audit).
     status          TEXT NOT NULL DEFAULT 'active'
                        CHECK (status IN ('pending','active','blocked','archived','deleted')),
-    rar_creds_enc   TEXT,       -- creds RAR criptate (Fernet) durabile per-cont (D4/Eng#1)
+    rar_creds_enc   TEXT,       -- LEGACY (PRD 5.20 US-013 dropeaza coloana): creds RAR durabile env-less
+    -- Medii RAR per cont (PRD 5.20 US-001). Fiecare mediu = bifa de activare + slot creds.
+    -- medii_disponibile = enabled AND creds prezente (app/rar_env.py). Cont client nou =
+    -- Productie on / Testare off (clientii declara real); contul operator se pune manual pe Testare.
+    rar_test_enabled INTEGER NOT NULL DEFAULT 0 CHECK (rar_test_enabled IN (0, 1)),
+    rar_prod_enabled INTEGER NOT NULL DEFAULT 1 CHECK (rar_prod_enabled IN (0, 1)),
+    rar_creds_test_enc TEXT,    -- creds RAR criptate (Fernet) pentru mediul Testare
+    rar_creds_prod_enc TEXT,    -- creds RAR criptate (Fernet) pentru mediul Productie
+    rar_env_default TEXT NOT NULL DEFAULT 'prod' CHECK (rar_env_default IN ('test', 'prod')),
     -- Comportament implicit la cod prestatie necunoscut/nemapat pe canalul API:
     -- 0 (default, non-distructiv: submission 'needs_mapping', intra in editorul de mapare) sau
     -- 1 (respinge cererea fara enqueue). Override per-cerere via PrezentareRequest.on_unmapped_error.
@@ -88,6 +96,10 @@ CREATE TABLE IF NOT EXISTS submissions (
     status           TEXT NOT NULL DEFAULT 'queued'
                        CHECK (status IN ('queued','sending','sent','needs_mapping','needs_data','error')),
     payload_json     TEXT NOT NULL,
+    -- Mediul RAR tinta al acestei trimiteri (PRD 5.20 US-001). DEFAULT 'test' e doar plasa
+    -- pentru randuri net-noi care nu seteaza explicit; fiecare INSERT (API/import/web) seteaza
+    -- rar_env explicit. Backfill din AUTOPASS_RAR_ENV global la migrare (NU lasa pe DEFAULT).
+    rar_env          TEXT NOT NULL DEFAULT 'test' CHECK (rar_env IN ('test', 'prod')),
     rar_creds_enc    TEXT,                   -- creds RAR criptate (Fernet), sterse dupa primul login reusit
     rar_status_code  INTEGER,
     rar_error        TEXT,

tests/test_idempotency.py

@@ -0,0 +1,28 @@
+"""US-003 (PRD 5.20): build_key incorporeaza rar_env."""
+
+from __future__ import annotations
+
+from app.idempotency import build_key, canonicalize_row
+
+
+def _canon():
+    raw = {
+        "vin": "WVWZZZ1JZXW000001", "nr_inmatriculare": "B 123 ABC",
+        "data_prestatie": "2026-01-10", "odometru_final": "123456.0",
+        "prestatii": [{"cod_prestatie": "OE-1"}],
+    }
+    canon = canonicalize_row(raw)
+    canon["prestatii"] = raw["prestatii"]
+    return canon
+
+
+def test_key_difera_intre_test_si_prod():
+    canon = _canon()
+    assert build_key(1, canon, "test") != build_key(1, canon, "prod")
+
+
+def test_key_stabil_pe_env():
+    canon = _canon()
+    assert build_key(1, canon, "prod") == build_key(1, canon, "prod")
+    # None si 1 colapseaza la aceeasi cheie (account_or_default), pe acelasi env
+    assert build_key(None, canon, "test") == build_key(1, canon, "test")

tests/test_rar_env_disponibil.py

@@ -0,0 +1,50 @@
+"""US-002 (PRD 5.20): medii_disponibile + rar_env_efectiv (REQ-DISP / REQ-DEFAULT)."""
+
+from __future__ import annotations
+
+from app.rar_env import medii_disponibile, rar_env_efectiv
+
+
+def _cont(**kw):
+    base = {
+        "rar_test_enabled": 0, "rar_prod_enabled": 0,
+        "rar_creds_test_enc": None, "rar_creds_prod_enc": None,
+        "rar_env_default": "prod",
+    }
+    base.update(kw)
+    return base
+
+
+def test_doar_prod_cu_creds():
+    c = _cont(rar_prod_enabled=1, rar_creds_prod_enc="TOK")
+    assert medii_disponibile(c) == ["prod"]
+    assert rar_env_efectiv(c) == "prod"
+
+
+def test_ambele():
+    c = _cont(
+        rar_test_enabled=1, rar_creds_test_enc="T",
+        rar_prod_enabled=1, rar_creds_prod_enc="P",
+        rar_env_default="test",
+    )
+    assert medii_disponibile(c) == ["test", "prod"]
+    assert rar_env_efectiv(c) == "test"
+
+
+def test_zero_cand_lipsesc_creds():
+    # activat dar fara creds -> nu e disponibil
+    c = _cont(rar_test_enabled=1, rar_prod_enabled=1)
+    assert medii_disponibile(c) == []
+    assert rar_env_efectiv(c) is None
+
+
+def test_default_cade_pe_singurul_disponibil():
+    # default='prod' dar prod nu e disponibil; doar test e -> efectiv = test
+    c = _cont(rar_test_enabled=1, rar_creds_test_enc="T", rar_env_default="prod")
+    assert medii_disponibile(c) == ["test"]
+    assert rar_env_efectiv(c) == "test"
+
+
+def test_enabled_fara_creds_nu_e_disponibil():
+    c = _cont(rar_prod_enabled=1, rar_creds_prod_enc="  ")  # whitespace = gol
+    assert medii_disponibile(c) == []

tests/test_schema_migrate.py

@@ -0,0 +1,145 @@
+"""US-001 (PRD 5.20): schema medii per cont + env pe submission + migrare/backfill."""
+
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import tempfile
+
+import pytest
+
+
+@pytest.fixture()
+def fresh_conn(monkeypatch):
+    """DB nou cu schema curenta (init_db)."""
+    tmp = tempfile.mkdtemp()
+    monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "t.db"))
+    from app.config import get_settings
+    get_settings.cache_clear()
+    from app.db import get_connection, init_db
+    init_db()
+    c = get_connection()
+    yield c
+    c.close()
+    get_settings.cache_clear()
+
+
+def _old_db(path: str) -> sqlite3.Connection:
+    """Construieste un DB in forma PRE-5.20 (fara coloanele de mediu)."""
+    conn = sqlite3.connect(path, isolation_level=None)
+    conn.row_factory = sqlite3.Row
+    conn.execute(
+        "CREATE TABLE accounts (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, "
+        "cui TEXT, rar_creds_enc TEXT)"
+    )
+    conn.execute(
+        "CREATE TABLE submissions (id INTEGER PRIMARY KEY AUTOINCREMENT, "
+        "idempotency_key TEXT NOT NULL UNIQUE, account_id INTEGER, status TEXT, "
+        "payload_json TEXT NOT NULL)"
+    )
+    return conn
+
+
+def _migrate_old(path: str, env: str, monkeypatch) -> sqlite3.Connection:
+    monkeypatch.setenv("AUTOPASS_RAR_ENV", env)
+    from app.config import get_settings
+    get_settings.cache_clear()
+    conn = sqlite3.connect(path, isolation_level=None)
+    conn.row_factory = sqlite3.Row
+    from app.db import _migrate
+    _migrate(conn)
+    return conn
+
+
+def test_coloane_medii_pe_cont(fresh_conn):
+    acc = {r["name"] for r in fresh_conn.execute("PRAGMA table_info(accounts)").fetchall()}
+    assert {
+        "rar_test_enabled", "rar_prod_enabled",
+        "rar_creds_test_enc", "rar_creds_prod_enc", "rar_env_default",
+    } <= acc
+    sub = {r["name"] for r in fresh_conn.execute("PRAGMA table_info(submissions)").fetchall()}
+    assert "rar_env" in sub
+
+
+def test_default_client_prod_on_test_off(fresh_conn):
+    from app.accounts import create_account
+    aid = create_account(fresh_conn, "Service X")
+    row = fresh_conn.execute(
+        "SELECT rar_test_enabled, rar_prod_enabled, rar_env_default FROM accounts WHERE id=?",
+        (aid,),
+    ).fetchone()
+    assert row["rar_prod_enabled"] == 1
+    assert row["rar_test_enabled"] == 0
+    assert row["rar_env_default"] == "prod"
+
+
+@pytest.mark.parametrize("env,slot,other", [
+    ("test", "rar_creds_test_enc", "rar_creds_prod_enc"),
+    ("prod", "rar_creds_prod_enc", "rar_creds_test_enc"),
+])
+def test_migrare_creds_in_slotul_env_global(tmp_path, monkeypatch, env, slot, other):
+    path = str(tmp_path / "old.db")
+    old = _old_db(path)
+    old.execute(
+        "INSERT INTO accounts (id, name, rar_creds_enc) VALUES (5, 'Legacy', 'TOKEN_CREDS')"
+    )
+    old.close()
+    conn = _migrate_old(path, env, monkeypatch)
+    row = conn.execute("SELECT * FROM accounts WHERE id=5").fetchone()
+    assert row[slot] == "TOKEN_CREDS"
+    assert row[other] is None
+    assert row[f"rar_{env}_enabled"] == 1
+    assert row[f"rar_{'prod' if env == 'test' else 'test'}_enabled"] == 0
+    assert row["rar_env_default"] == env
+    conn.close()
+
+
+def test_migrare_cont_fara_creds_ramane_pe_default(tmp_path, monkeypatch):
+    path = str(tmp_path / "old.db")
+    old = _old_db(path)
+    old.execute("INSERT INTO accounts (id, name, rar_creds_enc) VALUES (6, 'NoCreds', NULL)")
+    old.close()
+    conn = _migrate_old(path, "test", monkeypatch)
+    row = conn.execute("SELECT * FROM accounts WHERE id=6").fetchone()
+    assert row["rar_prod_enabled"] == 1
+    assert row["rar_test_enabled"] == 0
+    assert row["rar_env_default"] == "prod"
+    conn.close()
+
+
+def test_submissions_rar_env(tmp_path, monkeypatch):
+    """Un rand PRE-migrare ajunge cu env-ul global (NU 'test') + cheie recalculata env-aware."""
+    path = str(tmp_path / "old.db")
+    old = _old_db(path)
+    payload = {
+        "vin": "WVWZZZ1JZXW000001", "nr_inmatriculare": "B123ABC",
+        "data_prestatie": "2026-01-10", "odometru_final": "123456",
+        "prestatii": [{"cod_prestatie": "OE-1"}],
+    }
+    old.execute(
+        "INSERT INTO submissions (idempotency_key, account_id, status, payload_json) "
+        "VALUES ('LEGACY_KEY', 7, 'sent', ?)",
+        (json.dumps(payload),),
+    )
+    old.close()
+
+    conn = _migrate_old(path, "prod", monkeypatch)
+    row = conn.execute("SELECT rar_env, idempotency_key FROM submissions").fetchone()
+    assert row["rar_env"] == "prod"  # ancora globala, NU DEFAULT 'test'
+
+    from app.idempotency import build_key, canonicalize_row
+    canon = canonicalize_row(payload)
+    canon["prestatii"] = payload["prestatii"]
+    assert row["idempotency_key"] == build_key(7, canon, "prod")
+    # si difera de varianta env-aware pe test (reconciliere pe endpoint corect)
+    assert row["idempotency_key"] != build_key(7, canon, "test")
+    conn.close()
+
+
+def test_migrare_idempotenta(fresh_conn):
+    """A doua rulare _migrate pe DB deja migrat nu strica nimic."""
+    from app.db import _migrate
+    _migrate(fresh_conn)  # nu arunca, nu dubleaza coloane
+    acc = {r["name"] for r in fresh_conn.execute("PRAGMA table_info(accounts)").fetchall()}
+    assert "rar_env_default" in acc