1 files changed, 54 insertions, 0 deletions
diff --git a/tests/test_gn2_auth_flow.py b/tests/test_gn2_auth_flow.py
index f6beddb..6f4caeb 100644
--- a/tests/test_gn2_auth_flow.py
+++ b/tests/test_gn2_auth_flow.py
@@ -59,3 +59,57 @@ def test_unauthenticated_update_phenotype_redirects(gn2_url, http):
         f"Expected redirect for unauthenticated phenotype-update, "
         f"got {resp.status_code}: {resp.text[:200]}"
     )
+
+
+def test_unauthenticated_list_diffs_redirects(gn2_url, http):
+    """GET /datasets/diffs redirects to / without a session."""
+    resp = http.get(
+        f"{gn2_url}/datasets/diffs",
+        timeout=30,
+        allow_redirects=False,
+    )
+    assert resp.status_code in (301, 302), (
+        f"Expected redirect for unauthenticated diffs listing, "
+        f"got {resp.status_code}: {resp.text[:200]}"
+    )
+
+
+def test_unauthenticated_show_diff_redirects(gn2_url, http):
+    """GET /datasets/diffs/<name> redirects to / without a session."""
+    resp = http.get(
+        f"{gn2_url}/datasets/diffs/{_DIFF_NAME}",
+        timeout=30,
+        allow_redirects=False,
+    )
+    assert resp.status_code in (301, 302), (
+        f"Expected redirect for unauthenticated diff display, "
+        f"got {resp.status_code}: {resp.text[:200]}"
+    )
+
+
+def test_unauthenticated_approve_diff_redirects(gn2_url, http):
+    """POST /datasets/<resource_id>/diffs/<name>/approve redirects to / without a session."""
+    resp = http.post(
+        f"{gn2_url}/datasets/{_RESOURCE_ID}/diffs/{_DIFF_NAME}/approve",
+        data={},
+        timeout=30,
+        allow_redirects=False,
+    )
+    assert resp.status_code in (301, 302), (
+        f"Expected redirect for unauthenticated diff approval, "
+        f"got {resp.status_code}: {resp.text[:200]}"
+    )
+
+
+def test_unauthenticated_reject_diff_redirects(gn2_url, http):
+    """POST /datasets/<resource_id>/diffs/<name>/reject redirects to / without a session."""
+    resp = http.post(
+        f"{gn2_url}/datasets/{_RESOURCE_ID}/diffs/{_DIFF_NAME}/reject",
+        data={},
+        timeout=30,
+        allow_redirects=False,
+    )
+    assert resp.status_code in (301, 302), (
+        f"Expected redirect for unauthenticated diff rejection, "
+        f"got {resp.status_code}: {resp.text[:200]}"
+    )