tests(admin): success-path tests for POST /auth/user/<uid>/roles/assign

Adds 200-status and DB-persistence checks. Both use try/finally to call
_revoke_assigned_role so the DB is left in the state the fixtures expect,
preventing surprises in teardown or future tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 67 insertions, 0 deletions

diff --git a/tests/unit/auth/test_admin_user_roles.py b/tests/unit/auth/test_admin_user_roles.py
index 2c1464a..c751e20 100644
--- a/tests/unit/auth/test_admin_user_roles.py
+++ b/tests/unit/auth/test_admin_user_roles.py
@@ -65,3 +65,70 @@ def test_assign_role_non_admin_returns_403(fxtr_app, mocker, fxtr_oauth2_clients
             json=_ASSIGN_BODY,
             headers={"Authorization": "Bearer some-mocked-token"})
     assert res.status_code == 403
+
+
+def _revoke_assigned_role(conn):
+    """Remove the role row written by the success tests.
+
+    Keeps the DB in the state the fixtures expect — no user_roles entry for
+    _TARGET_USER — so teardown and any subsequent queries are not surprised.
+    """
+    with db.cursor(conn) as cursor:
+        cursor.execute(
+            "DELETE FROM user_roles "
+            "WHERE user_id=? "
+            "AND role_id=(SELECT role_id FROM roles WHERE role_name=?) "
+            "AND resource_id=?",
+            (str(_TARGET_USER.user_id),
+             _ASSIGN_BODY["role_name"],
+             _ASSIGN_BODY["resource_id"]))
+
+
+@pytest.mark.unit_test
+def test_assign_role_admin_returns_200(fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid system-admin token and a valid role/resource body
+    WHEN: POST /auth/user/<uid>/roles/assign
+    THEN: 200 is returned
+    """
+    conn, clients = fxtr_oauth2_clients
+    _setup_admin_mock(conn, clients, mocker)
+    try:
+        with fxtr_app.test_client() as http:
+            res = http.post(
+                f"/auth/user/{_TARGET_USER.user_id}/roles/assign",
+                json=_ASSIGN_BODY,
+                headers={"Authorization": "Bearer some-mocked-token"})
+        assert res.status_code == 200
+    finally:
+        _revoke_assigned_role(conn)
+
+
+@pytest.mark.unit_test
+def test_assign_role_persists_to_db(fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid system-admin token and a valid role/resource body
+    WHEN: POST /auth/user/<uid>/roles/assign
+    THEN: the user_roles row is present in the DB for that user/role/resource
+    """
+    conn, clients = fxtr_oauth2_clients
+    _setup_admin_mock(conn, clients, mocker)
+    try:
+        with fxtr_app.test_client() as http:
+            http.post(
+                f"/auth/user/{_TARGET_USER.user_id}/roles/assign",
+                json=_ASSIGN_BODY,
+                headers={"Authorization": "Bearer some-mocked-token"})
+        with db.cursor(conn) as cursor:
+            cursor.execute(
+                "SELECT COUNT(*) AS cnt FROM user_roles "
+                "INNER JOIN roles ON user_roles.role_id=roles.role_id "
+                "WHERE user_roles.user_id=? "
+                "AND roles.role_name=? "
+                "AND user_roles.resource_id=?",
+                (str(_TARGET_USER.user_id),
+                 _ASSIGN_BODY["role_name"],
+                 _ASSIGN_BODY["resource_id"]))
+            assert cursor.fetchone()["cnt"] == 1
+    finally:
+        _revoke_assigned_role(conn)