test(gn-auth): authenticated data/authorisation structure and unknown-trait 404

Add two contract tests:

- data/authorisation with token: verify the response body contains an
  'authorisation' key with at least one item, confirming the response
  structure is the same as the no-token path.
- data/authorisation with token + unknown trait: verify NotFoundError
  (404) is raised regardless of whether a token is present — the
  resource lookup precedes the token check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 33 insertions, 0 deletions

diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index 6e6c3bc..d8b9e75 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -424,3 +424,36 @@ def test_data_authorisation_with_token_public_trait_returns_200(
         f"Expected 200 from /auth/data/authorisation with token for public trait, "
         f"got {resp.status_code}: {resp.text[:300]}"
     )
+
+
+def test_data_authorisation_with_token_public_trait_returns_authorisation_structure(
+        gn_auth_url, http, access_token):
+    """Authenticated data/authorisation response contains an 'authorisation' list."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": [_PUBLIC_TRAIT]},
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    data = resp.json()
+    assert "authorisation" in data, (
+        f"Response missing 'authorisation' key: {data}"
+    )
+    items = data["authorisation"]
+    assert isinstance(items, list) and len(items) > 0, (
+        f"Expected a non-empty 'authorisation' list, got: {items}"
+    )
+
+
+def test_data_authorisation_with_token_unknown_trait_returns_404(
+        gn_auth_url, http, access_token):
+    """POST /auth/data/authorisation with a token returns 404 for a non-existent trait."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": ["NoSuchDataset::no_such_trait"]},
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 404, (
+        f"Expected 404 for unknown trait with token, got {resp.status_code}: {resp.text[:300]}"
+    )