tests(admin): HTTP integration tests for POST /auth/user/create

Two TDD tests that define the expected auth behaviour of the new
create-user endpoint before it is implemented:

- No Authorization header → 401
- Valid token for a non-admin user → 403

Both tests fail (404) until the endpoint exists.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

Add's aso a dummy endpoint.

1 files changed, 44 insertions, 1 deletions

diff --git a/tests/unit/auth/test_admin_users.py b/tests/unit/auth/test_admin_users.py
index 9074581..def9996 100644
--- a/tests/unit/auth/test_admin_users.py
+++ b/tests/unit/auth/test_admin_users.py
@@ -1,9 +1,11 @@
-"""Unit tests for admin user-management model functions."""
+"""Tests for admin user-management: model functions and HTTP endpoints."""
 import pytest
 
 from gn_auth.auth.db import sqlite3 as db
 from gn_auth.auth.authorisation.users.admin.models import create_verified_user
 
+from tests.unit.auth import conftest
+
 # ---------------------------------------------------------------------------
 # Helpers
 # ---------------------------------------------------------------------------
@@ -74,3 +76,44 @@ def test_create_verified_user_raises_on_duplicate_email(conn_after_auth_migratio
     create_verified_user(conn, "dupe@example.org", "First User", "s3cr3t")
     with pytest.raises(Exception):
         create_verified_user(conn, "dupe@example.org", "Second User", "s3cr3t")
+
+
+# ---------------------------------------------------------------------------
+# HTTP endpoint tests: POST /auth/user/create
+# ---------------------------------------------------------------------------
+
+_NEW_USER_BODY = {"email": "newbie@example.org", "name": "Newbie", "password": "s3cr3t"}
+
+
+@pytest.mark.unit_test
+def test_create_user_endpoint_no_token_returns_401(fxtr_app):
+    """
+    GIVEN: no Authorization header
+    WHEN: POST /auth/user/create
+    THEN: 401 is returned (OAuth2 layer rejects unauthenticated request)
+    """
+    with fxtr_app.test_client() as http:
+        res = http.post("/auth/user/create", json=_NEW_USER_BODY)
+    assert res.status_code == 401
+
+
+@pytest.mark.unit_test
+def test_create_user_endpoint_non_admin_returns_403(fxtr_app, mocker, fxtr_oauth2_clients):
+    """
+    GIVEN: a valid token belonging to a non-admin user
+    WHEN: POST /auth/user/create
+    THEN: 403 is returned
+    """
+    _conn, clients = fxtr_oauth2_clients
+    user = conftest.TEST_USERS[3]  # unaff@iliated.user — no privileges
+    mocker.patch(
+        "gn_auth.auth.authorisation.users.views.require_oauth.acquire",
+        conftest.get_tokeniser(
+            user,
+            tuple(c for c in clients if c.user == user)[0]))
+    with fxtr_app.test_client() as http:
+        res = http.post(
+            "/auth/user/create",
+            json=_NEW_USER_BODY,
+            headers={"Authorization": "Bearer some-mocked-token"})
+    assert res.status_code == 403