test(gn3/case-attr): assert 201 and queued status for valid-token edit

Two new integration tests on POST /case-attribute/<id>/edit that go past
the auth layer and verify actual business-logic behaviour:

* test_edit_with_valid_token_returns_201 — status code must be 201
* test_edit_with_valid_token_queues_diff — body must contain
  diff-status='queued'

The edit endpoint queues rather than immediately modifying the DB,
so these tests are safe to run against CD without side-effects.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 24 insertions, 0 deletions

diff --git a/tests/test_gn3_auth_flow.py b/tests/test_gn3_auth_flow.py
index 67ca4dd..85cfe5b 100644
--- a/tests/test_gn3_auth_flow.py
+++ b/tests/test_gn3_auth_flow.py
@@ -198,3 +198,27 @@ def test_edit_valid_token_is_not_rejected_by_auth(gn3_url, http, access_token):
     assert resp.json().get("error") != "TokenValidationError", (
         f"Valid token should not be rejected by @require_token, got: {resp.json()}"
     )
+
+
+def test_edit_with_valid_token_returns_201(gn3_url, http, access_token):
+    resp = http.post(
+        f"{gn3_url}/case-attribute/{_INBREDSET_ID}/edit",
+        json={"edit-data": []},
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 201, (
+        f"Expected 201 from edit endpoint with valid token, got {resp.status_code}: {resp.text}"
+    )
+
+
+def test_edit_with_valid_token_queues_diff(gn3_url, http, access_token):
+    resp = http.post(
+        f"{gn3_url}/case-attribute/{_INBREDSET_ID}/edit",
+        json={"edit-data": []},
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    assert resp.json().get("diff-status") == "queued", (
+        f"Expected diff-status='queued' from edit endpoint, got: {resp.json()}"
+    )