🐛 Fix RPC test helper dropping injected request metadata

The push-audit-events initiator test injects a request with
:app.http/auth-key-id via :app.http/request metadata. prepare-rpc-params
always replaced that metadata with a fresh DummyRequest, so the key id
was lost and the initiator fell back to "app".

Honor a caller-supplied request map, merging body params into its
:params, and keep the dummy request only for non-map IRequest stubs
(reify requests used by the audit tests, which cannot be assoc'd).

Add focused regression tests for the three cases and document the
helper contract in the backend testing memory.

AI-assisted-by: deepseek-v4.1-flash

.serena/memories/backend/testing.md

@@ -8,4 +8,5 @@ JVM `clojure.test` (kaocha runner) under `backend/test/backend_tests/`.
 - Coverage: if code is added or modified in `src/`, corresponding tests in `test/backend_tests/` must be added or updated.
 - Isolated run: `clojure -M:dev:test --focus backend-tests.my-ns-test` for a specific test namespace, or `clojure -M:dev:test --focus backend-tests.my-ns-test/my-test-var` for a specific test var.
 - Regression run: `clojure -M:dev:test` to ensure no regressions in related functional areas.
-- If you need to filter output, tee to a temp file first: `clojure -M:dev:test 2>&1 | tee /tmp/penpot-test-output.txt`.
+- If you need to filter output, tee to a temp file first: `clojure -M:dev:test 2>&1 | tee /tmp/penpot-test-output.txt`.
+- RPC test helpers `command!`/`management-command!` split the data map: qualified keys become server params, unqualified keys become request body params. To inject request-level context (headers, `:app.http/auth-key-id`, ip), pass a map under `:app.http/request` metadata; non-map `IRequest` stubs fall back to a dummy request.

backend/test/backend_tests/helpers.clj

@@ -443,14 +443,23 @@
 
 (defn- prepare-rpc-params
   [data]
-  (let [params  (reduce-kv (fn [params k v]
-                             (if (qualified-keyword? k)
-                               (assoc params k v)
-                               params))
-                           {}
-                           (dissoc data ::type))
-        request (-> (make-dummy-request)
-                    (assoc :params (d/without-qualified data)))]
+  (let [params   (reduce-kv (fn [params k v]
+                              (if (qualified-keyword? k)
+                                (assoc params k v)
+                                params))
+                            {}
+                            (dissoc data ::type))
+        ;; Honor a caller-supplied request map from the data metadata so
+        ;; tests can inject headers, remote address and auth context (e.g.
+        ;; :app.http/auth-key-id). Non-map requests (reify IRequest stubs)
+        ;; fall back to the dummy request, which carries the body params
+        ;; the validation wrapper reads.
+        supplied (-> data meta :app.http/request)
+        request  (if (map? supplied)
+                   (assoc supplied :params (merge (:params supplied)
+                                                  (d/without-qualified data)))
+                   (assoc (make-dummy-request)
+                          :params (d/without-qualified data)))]
 
     (-> params
         (assoc :app.rpc/request-at (ct/now))

backend/test/backend_tests/helpers_test.clj

@@ -90,3 +90,35 @@
 
 (t/deftest make-dummy-request-missing-cookie-returns-nil-value
   (t/is (= {:value nil} (yreq/get-cookie (th/make-dummy-request) "missing"))))
+
+;; --- RPC PARAMS: REQUEST METADATA
+
+(t/deftest prepare-rpc-params-preserves-supplied-request
+  (let [supplied {:headers {"x-frontend-version" "1.2.3"}
+                  :app.http/auth-key-id :admin-console}
+        params   (#'th/prepare-rpc-params
+                  (with-meta {::th/type :dummy
+                              :events [{:name "event"}]}
+                    {:app.http/request supplied}))
+        request  (:app.http/request (meta params))]
+    (t/is (= "1.2.3" (yreq/get-header request "x-frontend-version")))
+    (t/is (= :admin-console (:app.http/auth-key-id request)))
+    (t/is (= {:events [{:name "event"}]} (:params request)))))
+
+(t/deftest prepare-rpc-params-builds-dummy-request-without-metadata
+  (let [params  (#'th/prepare-rpc-params {::th/type :dummy
+                                          :events [{:name "event"}]})
+        request (:app.http/request (meta params))]
+    (t/is (instance? backend_tests.helpers.DummyRequest request))
+    (t/is (= {:events [{:name "event"}]} (:params request)))))
+
+(t/deftest prepare-rpc-params-falls-back-to-dummy-for-non-map-request
+  (let [supplied (reify yreq/IRequest
+                   (get-header [_ _] nil))
+        params   (#'th/prepare-rpc-params
+                  (with-meta {::th/type :dummy
+                              :events [{:name "event"}]}
+                    {:app.http/request supplied}))
+        request  (:app.http/request (meta params))]
+    (t/is (instance? backend_tests.helpers.DummyRequest request))
+    (t/is (= {:events [{:name "event"}]} (:params request)))))