test(gn-auth): system/roles public-view content and authenticated 200

Add two contract tests for GET /auth/resource/system/roles:

- Without a token the response must be a list containing the
  'public-view' role (verifies the no-Authorization fallback branch).
- With a valid Bearer token the endpoint must return 200.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 26 insertions, 0 deletions

diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index a966d53..a3ddcf1 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -368,3 +368,29 @@ def test_system_roles_no_token_returns_200(gn_auth_url, http):
         f"Expected 200 from /auth/resource/system/roles without token, "
         f"got {resp.status_code}: {resp.text[:300]}"
     )
+
+
+def test_system_roles_no_token_contains_public_view_role(gn_auth_url, http):
+    """Without a token /auth/resource/system/roles returns the public-view role."""
+    resp = http.get(f"{gn_auth_url}/auth/resource/system/roles", timeout=30)
+    roles = resp.json()
+    assert isinstance(roles, list) and len(roles) > 0, (
+        f"Expected a non-empty list of roles, got: {roles}"
+    )
+    role_names = [r.get("role_name") for r in roles]
+    assert "public-view" in role_names, (
+        f"Expected 'public-view' in roles without token, got: {role_names}"
+    )
+
+
+def test_system_roles_with_token_returns_200(gn_auth_url, http, access_token):
+    """GET /auth/resource/system/roles with a valid token returns 200."""
+    resp = http.get(
+        f"{gn_auth_url}/auth/resource/system/roles",
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 200, (
+        f"Expected 200 from /auth/resource/system/roles with token, "
+        f"got {resp.status_code}: {resp.text[:300]}"
+    )