Test validated DNS address fallback behavior

tests/test_downloader.py

@@ -8,7 +8,7 @@ import respx
 from httpx import Response
 
 from app.core.exceptions import InputError
-from app.services.downloader import Downloader
+from app.services.downloader import Downloader, _PinnedNetworkBackend
 from app.services.validator import MediaValidator
 
 
@@ -90,3 +90,38 @@ def test_response_filename_falls_back_to_url_path() -> None:
 
     response = Response(200)
     assert Downloader._response_filename(response, "https://example.test/media%20clip.mp4") == "media clip.mp4"
+
+
+async def test_pinned_backend_retries_validated_addresses(settings) -> None:
+    first_socket = object()
+    calls = []
+
+    class Fallback:
+        async def connect_tcp(self, **kwargs):
+            calls.append(kwargs)
+            if len(calls) == 1:
+                raise OSError("first validated address unavailable")
+            return first_socket
+
+    downloader = Downloader(settings, MediaValidator(settings))
+    downloader._pinned[("media.example.test", 443)] = ("203.0.113.10", "93.184.216.34")
+    backend = _PinnedNetworkBackend(downloader, Fallback())
+
+    result = await backend.connect_tcp("media.example.test", 443, timeout=3.0)
+
+    assert result is first_socket
+    assert [call["host"] for call in calls] == ["203.0.113.10", "93.184.216.34"]
+    assert all(call["port"] == 443 for call in calls)
+
+
+async def test_pinned_backend_fails_closed_without_validated_addresses(settings) -> None:
+    class Fallback:
+        async def connect_tcp(self, **kwargs):
+            raise AssertionError("must not connect when validated address list is empty")
+
+    downloader = Downloader(settings, MediaValidator(settings))
+    downloader._pinned[("media.example.test", 443)] = ()
+    backend = _PinnedNetworkBackend(downloader, Fallback())
+
+    with pytest.raises(OSError, match="No validated network destination"):
+        await backend.connect_tcp("media.example.test", 443)