test(gn-auth): system/roles role shape and authenticated data authorisation

Add two contract tests:

- system/roles with token: verify response is a non-empty list of role
  objects each containing a 'role_name' field.
- data/authorisation with token for public trait: verify authenticated
  path returns 200 (the token path through require_oauth.acquire).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 30 insertions, 0 deletions

diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index a3ddcf1..6e6c3bc 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -394,3 +394,33 @@ def test_system_roles_with_token_returns_200(gn_auth_url, http, access_token):
         f"Expected 200 from /auth/resource/system/roles with token, "
         f"got {resp.status_code}: {resp.text[:300]}"
     )
+
+
+def test_system_roles_with_token_returns_list_of_roles(gn_auth_url, http, access_token):
+    """With a token /auth/resource/system/roles returns a list of role objects."""
+    resp = http.get(
+        f"{gn_auth_url}/auth/resource/system/roles",
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    roles = resp.json()
+    assert isinstance(roles, list) and len(roles) > 0, (
+        f"Expected a non-empty list of roles for authenticated user, got: {roles}"
+    )
+    for role in roles:
+        assert "role_name" in role, f"Role object missing 'role_name': {role}"
+
+
+def test_data_authorisation_with_token_public_trait_returns_200(
+        gn_auth_url, http, access_token):
+    """POST /auth/data/authorisation with a valid token returns 200 for a public trait."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": [_PUBLIC_TRAIT]},
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 200, (
+        f"Expected 200 from /auth/data/authorisation with token for public trait, "
+        f"got {resp.status_code}: {resp.text[:300]}"
+    )