test(case-attr): pre-provision resource-owner token per session

Replace the per-invocation provisioned_token("resource-owner", ...) call
in test_resource_owner_can_edit_returns_201 with a new session-scoped
resource_owner_token fixture.  One user is created and torn down per test
session instead of per parametrized test invocation.

Also fix the provisioned_token teardown URL: /auth/user/delete was moved
to /auth/system/administration/users/delete.

Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 70 insertions, 4 deletions

diff --git a/tests/test_gn3_case_attr_access.py b/tests/test_gn3_case_attr_access.py
index 0e7706a..638f1ab 100644
--- a/tests/test_gn3_case_attr_access.py
+++ b/tests/test_gn3_case_attr_access.py
@@ -208,13 +208,80 @@ def provisioned_token(gn_auth_url, http, _admin_full_scope_token, oauth2_credent
             timeout=30,
         )
         http.post(
-            f"{gn_auth_url}/auth/user/delete",
+            f"{gn_auth_url}/auth/system/administration/users/delete",
             json={"user_ids": [user_id]},
             headers=admin_hdrs,
             timeout=30,
         )
 
 
+@pytest.fixture(scope="session")
+def resource_owner_token(
+        gn_auth_url, http, _admin_full_scope_token, oauth2_credentials,
+        bxd_resource_id):
+    """Bearer token for a resource-owner on the BXD population, provisioned once per session."""
+    *_, client_id, client_secret = oauth2_credentials
+    admin_hdrs = {"Authorization": f"Bearer {_admin_full_scope_token}"}
+
+    unique = str(uuid.uuid4())[:8]
+    email = f"test-resource-owner-{unique}@regression.genenetwork.org"
+    password = "GnTest1234!"
+
+    create_resp = http.post(
+        f"{gn_auth_url}/auth/system/administration/users/create",
+        json={"email": email, "name": "Test resource-owner", "password": password},
+        headers=admin_hdrs,
+        timeout=30,
+    )
+    assert create_resp.status_code == 201, (
+        f"Failed to create resource-owner test user: "
+        f"{create_resp.status_code} {create_resp.text}"
+    )
+    user_id = create_resp.json()["user_id"]
+
+    assign_resp = http.post(
+        f"{gn_auth_url}/auth/system/administration/resources/{bxd_resource_id}/assign-owner",
+        json={"user_id": user_id},
+        headers=admin_hdrs,
+        timeout=30,
+    )
+    assert assign_resp.status_code == 200, (
+        f"Failed to assign resource-owner to user {user_id} on {bxd_resource_id}: "
+        f"{assign_resp.status_code} {assign_resp.text}"
+    )
+
+    token_resp = http.post(
+        f"{gn_auth_url}/auth/token",
+        json={
+            "grant_type": "password",
+            "username": email,
+            "password": password,
+            "scope": "profile group resource role user",
+            "client_id": client_id,
+            "client_secret": client_secret,
+        },
+        timeout=30,
+    )
+    assert token_resp.status_code == 200, (
+        f"Failed to get token for resource-owner test user: "
+        f"{token_resp.status_code} {token_resp.text}"
+    )
+    yield token_resp.json()["access_token"]
+
+    http.post(
+        f"{gn_auth_url}/auth/system/administration/resources/{bxd_resource_id}/revoke-owner",
+        json={"user_id": user_id},
+        headers=admin_hdrs,
+        timeout=30,
+    )
+    http.post(
+        f"{gn_auth_url}/auth/system/administration/users/delete",
+        json={"user_ids": [user_id]},
+        headers=admin_hdrs,
+        timeout=30,
+    )
+
+
 # ---------------------------------------------------------------------------
 # Level 4: edit with resource-owner privilege
 # (documents the __population_privileges__ bug)
@@ -227,7 +294,7 @@ def provisioned_token(gn_auth_url, http, _admin_full_scope_token, oauth2_credent
     f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/edit",
 ])
 def test_resource_owner_can_edit_returns_201(
-        gn3_url, http, provisioned_token, bxd_resource_id, path):
+        gn3_url, http, resource_owner_token, path):
     """A resource-owner on the BXD population must be allowed to queue edits (201).
 
     BUG: Currently returns 401 because __population_privileges__ calls
@@ -235,11 +302,10 @@ def test_resource_owner_can_edit_returns_201(
     always empty and the resource_spec branch of can_edit is never reachable.
     This test is RED until that bug is fixed.
     """
-    token = provisioned_token("resource-owner", bxd_resource_id)
     resp = http.post(
         f"{gn3_url}{path}",
         json={"edit-data": []},
-        headers={"Authorization": f"Bearer {token}"},
+        headers={"Authorization": f"Bearer {resource_owner_token}"},
         timeout=30,
     )
     assert resp.status_code == 201, (