test: isole le garde SSRF dans les tests fetch_url - plus de dependance au DNS reel BUG-092

tests/test_webrender.py

@@ -20,7 +20,7 @@ class TestRegistration:
 
 
 class TestRenderUnavailable:
-    def test_missing_playwright_clear_error(self, monkeypatch):
+    def test_missing_playwright_clear_error(self, monkeypatch, no_dns):
         monkeypatch.setattr(webrender, "_playwright_available", lambda: False)
         with pytest.raises(ToolError) as ei:
             web.fetch_url(_ctx(), web.FetchUrlInput(
@@ -35,8 +35,21 @@ class TestRenderUnavailable:
         assert ei.value.code in ("ssrf_blocked", "dns_error")
 
 
+@pytest.fixture
+def no_dns(monkeypatch):
+    """Neutralise la résolution DNS réelle du garde SSRF.
+
+    ``fetch_url`` appelle ``_assert_public_http_url`` (getaddrinfo) *avant* le
+    rendu : sur un runner au DNS instable le test échouait en ``dns_error``
+    au lieu d'atteindre le worker Playwright mocké. ``webrender`` importe la
+    fonction dans son propre namespace : les deux références sont mockées.
+    """
+    monkeypatch.setattr(web, "_assert_public_http_url", lambda url: url)
+    monkeypatch.setattr(webrender, "_assert_public_http_url", lambda url: url)
+
+
 class TestRenderSuccess:
-    def test_fetch_url_delegates_to_worker(self, monkeypatch):
+    def test_fetch_url_delegates_to_worker(self, monkeypatch, no_dns):
         captured = {}
 
         def fake_render(url):
@@ -51,7 +64,7 @@ class TestRenderSuccess:
         assert out["rendered"] is True
         assert "dynamic content" in out["text"]
 
-    def test_worker_failure_maps_to_tool_error(self, monkeypatch):
+    def test_worker_failure_maps_to_tool_error(self, monkeypatch, no_dns):
         monkeypatch.setattr(webrender, "_playwright_available", lambda: True)
 
         def boom(url):