test(gn_auth): add data/authorisation contract tests — no-token public fallback

GN2 calls POST /auth/data/authorisation per-request to check a user's
privileges on a trait's resource.  Without a Bearer token the endpoint
does not 401; instead it returns public-access privileges for publicly
visible resources.

Two tests verify this contract:

  test_data_authorisation_no_token_public_trait_returns_200
    Confirms the endpoint returns 200 for a known public trait without
    a token.

  test_data_authorisation_no_token_public_trait_grants_view_privilege
    Confirms the response includes 'group:resource:view-resource' —
    the privilege GN2 checks to determine read access.

Co-Authored-By: Frederick Muriuki Muriithi <fmuriit1@uthsc.edu>

1 files changed, 41 insertions, 0 deletions

diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index c031584..c7b2a5c 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -299,3 +299,44 @@ class TestMasqueradePrivilege:
         assert data["masquerade_as"]["user"]["user_id"] == basic_user_id, (
             "Masquerade response user_id does not match target user"
         )
+
+
+# ---------------------------------------------------------------------------
+# POST /auth/data/authorisation — public-resource fallback (no token)
+#
+# GN2 calls this endpoint per-request to determine the user's privileges on
+# a given trait's resource.  Without a Bearer token the endpoint falls back
+# to returning public-access privileges for publicly visible resources rather
+# than returning 401.  These tests verify that contract.
+# ---------------------------------------------------------------------------
+
+_PUBLIC_TRAIT = "HC_M2_0606_P::1435395_s_at"
+
+
+def test_data_authorisation_no_token_public_trait_returns_200(gn_auth_url, http):
+    """POST /auth/data/authorisation without a token returns 200 for a public trait."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": [_PUBLIC_TRAIT]},
+        timeout=30,
+    )
+    assert resp.status_code == 200, (
+        f"Expected 200 from /auth/data/authorisation for public trait without token, "
+        f"got {resp.status_code}: {resp.text[:300]}"
+    )
+
+
+def test_data_authorisation_no_token_public_trait_grants_view_privilege(gn_auth_url, http):
+    """Without a token, a public trait's resource grants group:resource:view-resource."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": [_PUBLIC_TRAIT]},
+        timeout=30,
+    )
+    items = resp.json().get("authorisation", [])
+    assert len(items) > 0, f"Expected at least one authorisation item, got: {resp.json()}"
+    privileges = items[0].get("privileges", [])
+    assert "group:resource:view-resource" in privileges, (
+        f"Expected 'group:resource:view-resource' in privileges for public trait, "
+        f"got: {privileges}"
+    )