test(gn3/case-attr): level 2 access-control for approve and reject endpoints

Two parametrized tests covering both the flat /case-attribute/ blueprint
and the v1 hierarchy for approve and reject diff operations:

- test_no_privilege_approve_returns_401: basic token must get 401
- test_no_privilege_reject_returns_401: basic token must get 401

Expected RED on the flat endpoints (using old required_access helper with
wrong privilege check); v1 endpoints already use can_apply_or_reject_edit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 39 insertions, 0 deletions

diff --git a/tests/test_gn3_case_attr_access.py b/tests/test_gn3_case_attr_access.py
index e2399c8..dcce6ea 100644
--- a/tests/test_gn3_case_attr_access.py
+++ b/tests/test_gn3_case_attr_access.py
@@ -10,6 +10,7 @@ pytestmark = pytest.mark.gn3
 
 _SPECIES_ID = 1     # Mouse
 _INBREDSET_ID = 1   # BXD
+_CHANGE_ID = 1
 
 
 @pytest.mark.case_attr_access
@@ -48,3 +49,41 @@ def test_no_privilege_edit_returns_401(gn3_url, http, basic_access_token, path):
         f"Expected 401 for unprivileged POST {path!r}, "
         f"got {resp.status_code}. Body: {resp.text[:200]}"
     )
+
+
+@pytest.mark.case_attr_access
+@pytest.mark.auth_flow
+@pytest.mark.parametrize("path", [
+    f"/case-attribute/{_INBREDSET_ID}/approve/{_CHANGE_ID}",
+    f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/diffs/{_CHANGE_ID}/approve",
+])
+def test_no_privilege_approve_returns_401(gn3_url, http, basic_access_token, path):
+    """A token with no approve privileges must be refused with 401."""
+    resp = http.post(
+        f"{gn3_url}{path}",
+        headers={"Authorization": f"Bearer {basic_access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 401, (
+        f"Expected 401 for unprivileged POST {path!r}, "
+        f"got {resp.status_code}. Body: {resp.text[:200]}"
+    )
+
+
+@pytest.mark.case_attr_access
+@pytest.mark.auth_flow
+@pytest.mark.parametrize("path", [
+    f"/case-attribute/{_INBREDSET_ID}/reject/{_CHANGE_ID}",
+    f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/diffs/{_CHANGE_ID}/reject",
+])
+def test_no_privilege_reject_returns_401(gn3_url, http, basic_access_token, path):
+    """A token with no reject privileges must be refused with 401."""
+    resp = http.post(
+        f"{gn3_url}{path}",
+        headers={"Authorization": f"Bearer {basic_access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 401, (
+        f"Expected 401 for unprivileged POST {path!r}, "
+        f"got {resp.status_code}. Body: {resp.text[:200]}"
+    )