feat: route SBOM writes to Nexus behind flag

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

tests/test_sbom_nexus_compat.py

@@ -156,6 +156,58 @@ async def test_nexus_read_mode_does_not_move_ingest_write_authority(client, monk
     assert response.json()["ingested"] == 1
 
 
+async def test_nexus_write_mode_moves_authority_and_updates_projection(client, monkeypatch):
+    repo = await _create_repo(client)
+    snapshot_id = str(uuid.uuid4())
+    observed = {}
+
+    async def fake_post(path: str, *, body):
+        observed["path"] = path
+        observed["body"] = body
+        return {
+            "repo_slug": "testrepo",
+            "snapshot_id": snapshot_id,
+            "ingested": 1,
+            "snapshot_at": "2026-08-22T13:00:00Z",
+            "status": "ingested",
+        }
+
+    monkeypatch.setattr(settings, "sbom_nexus_read_mode", "legacy")
+    monkeypatch.setattr(settings, "sbom_nexus_write_mode", "nexus")
+    monkeypatch.setattr("api.routers.sbom.post_json", fake_post)
+    response = await client.post(
+        "/sbom/ingest/",
+        json={
+            "repo_slug": "testrepo",
+            "entries": [
+                {
+                    "package_name": "fastapi",
+                    "package_version": "0.115.0",
+                    "ecosystem": "python",
+                    "license_spdx": "MIT",
+                }
+            ],
+        },
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "repo_slug": "testrepo",
+        "snapshot_id": snapshot_id,
+        "ingested": 1,
+        "snapshot_at": "2026-08-22T13:00:00Z",
+    }
+    assert observed["path"] == "/sbom/ingest/"
+    assert observed["body"]["entries"][0]["ecosystem"] == "python"
+
+    legacy_snapshots = await client.get("/sbom/snapshots/?repo_slug=testrepo")
+    projected_repo = await client.get("/repos/testrepo")
+    assert legacy_snapshots.json() == []
+    assert projected_repo.json()["id"] == repo["id"]
+    assert projected_repo.json()["last_sbom_at"] == "2026-08-22T13:00:00Z"
+    assert projected_repo.json()["sbom_source"] == "sbom-nexus"
+
+
 async def test_nexus_failure_is_visible_and_does_not_fall_back(client, monkeypatch):
     await _create_repo(client)