tests(admin): success-path tests for POST /auth/user/create

Two TDD tests for the admin create-user endpoint success case:

- Valid admin token + valid body → 201
- Response body contains the new user's email and name

Both fail (501) until the endpoint body is implemented.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 71 insertions, 1 deletions

diff --git a/tests/unit/auth/test_admin_users.py b/tests/unit/auth/test_admin_users.py
index def9996..f31e6af 100644
--- a/tests/unit/auth/test_admin_users.py
+++ b/tests/unit/auth/test_admin_users.py
@@ -2,7 +2,9 @@
 import pytest
 
 from gn_auth.auth.db import sqlite3 as db
-from gn_auth.auth.authorisation.users.admin.models import create_verified_user
+from gn_auth.auth.authorisation.users.admin.models import (
+    create_verified_user,
+    grant_sysadmin_role)
 
 from tests.unit.auth import conftest
 
@@ -117,3 +119,71 @@ def test_create_user_endpoint_non_admin_returns_403(fxtr_app, mocker, fxtr_oauth
             json=_NEW_USER_BODY,
             headers={"Authorization": "Bearer some-mocked-token"})
     assert res.status_code == 403
+
+
+def _setup_admin_mock(conn, clients, mocker):
+    """Grant sysadmin role and mock the token for sys@admin.user."""
+    admin = conftest.TEST_USERS[4]
+    with db.cursor(conn) as cursor:
+        grant_sysadmin_role(cursor, admin)
+    mocker.patch(
+        "gn_auth.auth.authorisation.users.views.require_oauth.acquire",
+        conftest.get_tokeniser(
+            admin,
+            tuple(c for c in clients if c.user == admin)[0]))
+    return admin
+
+
+@pytest.mark.unit_test
+def test_create_user_endpoint_admin_returns_201(fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid system-admin token and a valid request body
+    WHEN: POST /auth/user/create
+    THEN: 201 is returned
+    """
+    conn, clients = fxtr_oauth2_clients
+    _setup_admin_mock(conn, clients, mocker)
+    with fxtr_app.test_client() as http:
+        res = http.post(
+            "/auth/user/create",
+            json={**_NEW_USER_BODY, "password": "s3cr3tP4ssw0rd"},
+            headers={"Authorization": "Bearer some-mocked-token"})
+    assert res.status_code == 201
+
+
+@pytest.mark.unit_test
+def test_create_user_endpoint_admin_returns_new_user(fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid system-admin token and a valid request body
+    WHEN: POST /auth/user/create
+    THEN: the response body contains the new user's email and name
+    """
+    conn, clients = fxtr_oauth2_clients
+    _setup_admin_mock(conn, clients, mocker)
+    with fxtr_app.test_client() as http:
+        res = http.post(
+            "/auth/user/create",
+            json={**_NEW_USER_BODY, "password": "s3cr3tP4ssw0rd"},
+            headers={"Authorization": "Bearer some-mocked-token"})
+    data = res.get_json()
+    assert data.get("email") == _NEW_USER_BODY["email"]
+    assert data.get("name") == _NEW_USER_BODY["name"]
+    assert res.status_code == 201
+
+
+@pytest.mark.unit_test
+def test_create_user_endpoint_short_password_returns_400(
+        fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid system-admin token and a request body with a short password
+    WHEN: POST /auth/user/create
+    THEN: 400 is returned (password must be at least 8 characters)
+    """
+    conn, clients = fxtr_oauth2_clients
+    _setup_admin_mock(conn, clients, mocker)
+    with fxtr_app.test_client() as http:
+        res = http.post(
+            "/auth/user/create",
+            json={**_NEW_USER_BODY, "password": "short"},
+            headers={"Authorization": "Bearer some-mocked-token"})
+    assert res.status_code == 400