From a90390053ccfbf66eaf6189074a99927d2dce8f0 Mon Sep 17 00:00:00 2001 From: Claude Sonnet 4.6 Date: Wed, 26 Aug 2026 16:26:35 +0000 Subject: tests(admin): HTTP integration tests for POST /auth/user/create Two TDD tests that define the expected auth behaviour of the new create-user endpoint before it is implemented: - No Authorization header → 401 - Valid token for a non-admin user → 403 Both tests fail (404) until the endpoint exists. Co-Authored-By: Claude Sonnet 4.6 Reviewed-By: Frederick M. Muriithi Add's aso a dummy endpoint. --- tests/unit/auth/test_admin_users.py | 45 ++++++++++++++++++++++++++++++++++++- 1 file changed, 44 insertions(+), 1 deletion(-) (limited to 'tests/unit/auth/test_admin_users.py') diff --git a/tests/unit/auth/test_admin_users.py b/tests/unit/auth/test_admin_users.py index 9074581..def9996 100644 --- a/tests/unit/auth/test_admin_users.py +++ b/tests/unit/auth/test_admin_users.py @@ -1,9 +1,11 @@ -"""Unit tests for admin user-management model functions.""" +"""Tests for admin user-management: model functions and HTTP endpoints.""" import pytest from gn_auth.auth.db import sqlite3 as db from gn_auth.auth.authorisation.users.admin.models import create_verified_user +from tests.unit.auth import conftest + # --------------------------------------------------------------------------- # Helpers # --------------------------------------------------------------------------- @@ -74,3 +76,44 @@ def test_create_verified_user_raises_on_duplicate_email(conn_after_auth_migratio create_verified_user(conn, "dupe@example.org", "First User", "s3cr3t") with pytest.raises(Exception): create_verified_user(conn, "dupe@example.org", "Second User", "s3cr3t") + + +# --------------------------------------------------------------------------- +# HTTP endpoint tests: POST /auth/user/create +# --------------------------------------------------------------------------- + +_NEW_USER_BODY = {"email": "newbie@example.org", "name": "Newbie", "password": "s3cr3t"} + + +@pytest.mark.unit_test +def test_create_user_endpoint_no_token_returns_401(fxtr_app): + """ + GIVEN: no Authorization header + WHEN: POST /auth/user/create + THEN: 401 is returned (OAuth2 layer rejects unauthenticated request) + """ + with fxtr_app.test_client() as http: + res = http.post("/auth/user/create", json=_NEW_USER_BODY) + assert res.status_code == 401 + + +@pytest.mark.unit_test +def test_create_user_endpoint_non_admin_returns_403(fxtr_app, mocker, fxtr_oauth2_clients): + """ + GIVEN: a valid token belonging to a non-admin user + WHEN: POST /auth/user/create + THEN: 403 is returned + """ + _conn, clients = fxtr_oauth2_clients + user = conftest.TEST_USERS[3] # unaff@iliated.user — no privileges + mocker.patch( + "gn_auth.auth.authorisation.users.views.require_oauth.acquire", + conftest.get_tokeniser( + user, + tuple(c for c in clients if c.user == user)[0])) + with fxtr_app.test_client() as http: + res = http.post( + "/auth/user/create", + json=_NEW_USER_BODY, + headers={"Authorization": "Bearer some-mocked-token"}) + assert res.status_code == 403 -- cgit 1.4.1