tests(admin): auth-guard tests for POST /auth/user/<uid>/roles/assign

401 (no token) and 403 (non-admin token) — both expect 404 until the
stub endpoint is added.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 67 insertions, 0 deletions

diff --git a/tests/unit/auth/test_admin_user_roles.py b/tests/unit/auth/test_admin_user_roles.py
new file mode 100644
index 0000000..2c1464a
--- /dev/null
+++ b/tests/unit/auth/test_admin_user_roles.py
@@ -0,0 +1,67 @@
+"""Tests for admin role-assignment HTTP endpoints."""
+import pytest
+
+from gn_auth.auth.db import sqlite3 as db
+from gn_auth.auth.authorisation.users.admin.models import grant_sysadmin_role
+
+from tests.unit.auth import conftest
+from tests.unit.auth.fixtures.resource_fixtures import SYSTEM_RESOURCE
+
+# Body used in all role-assign tests — assigning system-administrator on the
+# system resource is a real, migrations-seeded combination.
+_ASSIGN_BODY = {
+    "role_name": "system-administrator",
+    "resource_id": str(SYSTEM_RESOURCE.resource_id)
+}
+
+# Target user for assignment: unaff@iliated.user (no roles initially)
+_TARGET_USER = conftest.TEST_USERS[3]
+
+
+def _setup_admin_mock(conn, clients, mocker):
+    """Grant sysadmin role and mock the token for sys@admin.user."""
+    admin = conftest.TEST_USERS[4]
+    with db.cursor(conn) as cursor:
+        grant_sysadmin_role(cursor, admin)
+    mocker.patch(
+        "gn_auth.auth.authorisation.users.views.require_oauth.acquire",
+        conftest.get_tokeniser(
+            admin,
+            tuple(c for c in clients if c.user == admin)[0]))
+    return admin
+
+
+@pytest.mark.unit_test
+def test_assign_role_no_token_returns_401(fxtr_app):
+    """
+    GIVEN: no Authorization header
+    WHEN: POST /auth/user/<uid>/roles/assign
+    THEN: 401 is returned
+    """
+    with fxtr_app.test_client() as http:
+        res = http.post(
+            f"/auth/user/{_TARGET_USER.user_id}/roles/assign",
+            json=_ASSIGN_BODY)
+    assert res.status_code == 401
+
+
+@pytest.mark.unit_test
+def test_assign_role_non_admin_returns_403(fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid token belonging to a non-admin user
+    WHEN: POST /auth/user/<uid>/roles/assign
+    THEN: 403 is returned
+    """
+    _conn, clients = fxtr_oauth2_clients
+    user = conftest.TEST_USERS[3]  # unaff@iliated.user — no privileges
+    mocker.patch(
+        "gn_auth.auth.authorisation.users.views.require_oauth.acquire",
+        conftest.get_tokeniser(
+            user,
+            tuple(c for c in clients if c.user == user)[0]))
+    with fxtr_app.test_client() as http:
+        res = http.post(
+            f"/auth/user/{_TARGET_USER.user_id}/roles/assign",
+            json=_ASSIGN_BODY,
+            headers={"Authorization": "Bearer some-mocked-token"})
+    assert res.status_code == 403