test(gn-auth): unknown-trait 404 and system/roles no-token 200

Add two contract tests for gn-auth's authorisation endpoints:

- POST /auth/data/authorisation with a non-existent trait must return 404
  (gn-auth raises NotFoundError which maps to error_code=404).
- GET /auth/resource/system/roles without an Authorization header must
  return 200 with the public-view role rather than 401.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 28 insertions, 0 deletions

diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index c7b2a5c..a966d53 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -340,3 +340,31 @@ def test_data_authorisation_no_token_public_trait_grants_view_privilege(gn_auth_
         f"Expected 'group:resource:view-resource' in privileges for public trait, "
         f"got: {privileges}"
     )
+
+
+def test_data_authorisation_no_token_unknown_trait_returns_404(gn_auth_url, http):
+    """POST /auth/data/authorisation with a non-existent trait returns 404."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": ["NoSuchDataset::no_such_trait"]},
+        timeout=30,
+    )
+    assert resp.status_code == 404, (
+        f"Expected 404 for unknown trait, got {resp.status_code}: {resp.text[:300]}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# GET /auth/resource/system/roles — public-view fallback and authenticated
+#
+# Without an Authorization header the endpoint returns the public-view role.
+# With a valid Bearer token it returns the user's system roles.
+# ---------------------------------------------------------------------------
+
+def test_system_roles_no_token_returns_200(gn_auth_url, http):
+    """GET /auth/resource/system/roles without a token returns 200."""
+    resp = http.get(f"{gn_auth_url}/auth/resource/system/roles", timeout=30)
+    assert resp.status_code == 200, (
+        f"Expected 200 from /auth/resource/system/roles without token, "
+        f"got {resp.status_code}: {resp.text[:300]}"
+    )