test(gn-auth): public resource grants view-resource to all authenticated users HEAD main

All resources marked public in gn-auth grant group:resource:view-resource
to every user, not just anonymous callers.  This test pins that contract:
an authenticated admin posting _PUBLIC_TRAIT must receive the same
view privilege as an unauthenticated caller.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index d8b9e75..b86a0c1 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -457,3 +457,21 @@ def test_data_authorisation_with_token_unknown_trait_returns_404(
     assert resp.status_code == 404, (
         f"Expected 404 for unknown trait with token, got {resp.status_code}: {resp.text[:300]}"
     )
+
+
+def test_data_authorisation_with_token_public_trait_grants_view_privilege(
+        gn_auth_url, http, access_token):
+    """All authenticated users receive group:resource:view-resource on a public resource."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": [_PUBLIC_TRAIT]},
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    items = resp.json().get("authorisation", [])
+    assert len(items) > 0, f"Expected at least one authorisation item, got: {resp.json()}"
+    privileges = items[0].get("privileges", [])
+    assert "group:resource:view-resource" in privileges, (
+        f"Expected 'group:resource:view-resource' for authenticated user on public resource, "
+        f"got: {privileges}"
+    )