feat(users/admin): implement POST /auth/user/<uid>/roles/assign

Checks resource:user:assign-role via can_assign_role (gn_libs.privileges.resources)
on the caller's roles for the request's resource_id — caller must hold
resource-owner (or masquerade as one) on that resource.

Updates test setup to grant resource-owner on SYSTEM_RESOURCE instead of
system-administrator, matching the actual privilege model.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 9 insertions, 3 deletions

diff --git a/tests/unit/auth/test_admin_user_roles.py b/tests/unit/auth/test_admin_user_roles.py
index c751e20..6c153b5 100644
--- a/tests/unit/auth/test_admin_user_roles.py
+++ b/tests/unit/auth/test_admin_user_roles.py
@@ -2,7 +2,7 @@
 import pytest
 
 from gn_auth.auth.db import sqlite3 as db
-from gn_auth.auth.authorisation.users.admin.models import grant_sysadmin_role
+from gn_auth.auth.authorisation.roles.models import assign_user_role_by_name
 
 from tests.unit.auth import conftest
 from tests.unit.auth.fixtures.resource_fixtures import SYSTEM_RESOURCE
@@ -19,10 +19,16 @@ _TARGET_USER = conftest.TEST_USERS[3]
 
 
 def _setup_admin_mock(conn, clients, mocker):
-    """Grant sysadmin role and mock the token for sys@admin.user."""
+    """Grant resource-owner role on SYSTEM_RESOURCE and mock the token.
+
+    resource-owner carries resource:user:assign-role, which is what the
+    endpoint checks. In production the caller would masquerade as the
+    resource owner; here we grant the role directly for test setup.
+    """
     admin = conftest.TEST_USERS[4]
     with db.cursor(conn) as cursor:
-        grant_sysadmin_role(cursor, admin)
+        assign_user_role_by_name(
+            cursor, admin, SYSTEM_RESOURCE.resource_id, "resource-owner")
     mocker.patch(
         "gn_auth.auth.authorisation.users.views.require_oauth.acquire",
         conftest.get_tokeniser(