test(gn3/case-attr): level 5 — data-curator approve/reject

Add fixtures and tests for approve/reject access control using a
systemwide-data-curator token.

conftest.py:
- data_curator_oauth2_credentials: reads role "systemwide-data-curator"
  from GN_TEST_USERS_FILE; skips if absent.
- data_curator_token: requests scope "profile group resource role user".

tests/test_gn3_case_attr_access.py:
- test_data_curator_can_approve_returns_200_or_201: parametrized over
  flat (/case-attribute/…) and v1 endpoints; asserts 200 or 201 (either
  proves the auth check passed).
- test_data_curator_can_reject_returns_200_or_201: same for reject
  paths.

Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 54 insertions, 0 deletions

diff --git a/tests/test_gn3_case_attr_access.py b/tests/test_gn3_case_attr_access.py
index 92d97e2..0e7706a 100644
--- a/tests/test_gn3_case_attr_access.py
+++ b/tests/test_gn3_case_attr_access.py
@@ -248,3 +248,57 @@ def test_resource_owner_can_edit_returns_201(
         f"If 401: likely the __population_privileges__ bug (resource_privs always empty). "
         f"Body: {resp.text[:300]}"
     )
+
+
+# ---------------------------------------------------------------------------
+# Level 5: approve/reject with systemwide-data-curator privilege
+# ---------------------------------------------------------------------------
+
+@pytest.mark.case_attr_access
+@pytest.mark.auth_flow
+@pytest.mark.parametrize("path", [
+    f"/case-attribute/{_INBREDSET_ID}/approve/{_CHANGE_ID}",
+    f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/diffs/{_CHANGE_ID}/approve",
+])
+def test_data_curator_can_approve_returns_200_or_201(
+        gn3_url, http, data_curator_token, path):
+    """A systemwide-data-curator must be allowed to approve diffs (200/201).
+
+    The endpoint returns 201 when the change is successfully applied and 200
+    when there is no matching pending diff.  Either response proves the auth
+    check passed.
+    """
+    resp = http.post(
+        f"{gn3_url}{path}",
+        headers={"Authorization": f"Bearer {data_curator_token}"},
+        timeout=30,
+    )
+    assert resp.status_code in (200, 201), (
+        f"Expected 200 or 201 for systemwide-data-curator POST {path!r}, "
+        f"got {resp.status_code}. Body: {resp.text[:300]}"
+    )
+
+
+@pytest.mark.case_attr_access
+@pytest.mark.auth_flow
+@pytest.mark.parametrize("path", [
+    f"/case-attribute/{_INBREDSET_ID}/reject/{_CHANGE_ID}",
+    f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/diffs/{_CHANGE_ID}/reject",
+])
+def test_data_curator_can_reject_returns_200_or_201(
+        gn3_url, http, data_curator_token, path):
+    """A systemwide-data-curator must be allowed to reject diffs (200/201).
+
+    The endpoint returns 201 when the change is successfully rejected and 200
+    when there is no matching pending diff.  Either response proves the auth
+    check passed.
+    """
+    resp = http.post(
+        f"{gn3_url}{path}",
+        headers={"Authorization": f"Bearer {data_curator_token}"},
+        timeout=30,
+    )
+    assert resp.status_code in (200, 201), (
+        f"Expected 200 or 201 for systemwide-data-curator POST {path!r}, "
+        f"got {resp.status_code}. Body: {resp.text[:300]}"
+    )