diff options
| -rw-r--r-- | tests/test_gn3_case_attr_access.py | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/tests/test_gn3_case_attr_access.py b/tests/test_gn3_case_attr_access.py index e2399c8..dcce6ea 100644 --- a/tests/test_gn3_case_attr_access.py +++ b/tests/test_gn3_case_attr_access.py @@ -10,6 +10,7 @@ pytestmark = pytest.mark.gn3 _SPECIES_ID = 1 # Mouse _INBREDSET_ID = 1 # BXD +_CHANGE_ID = 1 @pytest.mark.case_attr_access @@ -48,3 +49,41 @@ def test_no_privilege_edit_returns_401(gn3_url, http, basic_access_token, path): f"Expected 401 for unprivileged POST {path!r}, " f"got {resp.status_code}. Body: {resp.text[:200]}" ) + + +@pytest.mark.case_attr_access +@pytest.mark.auth_flow +@pytest.mark.parametrize("path", [ + f"/case-attribute/{_INBREDSET_ID}/approve/{_CHANGE_ID}", + f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/diffs/{_CHANGE_ID}/approve", +]) +def test_no_privilege_approve_returns_401(gn3_url, http, basic_access_token, path): + """A token with no approve privileges must be refused with 401.""" + resp = http.post( + f"{gn3_url}{path}", + headers={"Authorization": f"Bearer {basic_access_token}"}, + timeout=30, + ) + assert resp.status_code == 401, ( + f"Expected 401 for unprivileged POST {path!r}, " + f"got {resp.status_code}. Body: {resp.text[:200]}" + ) + + +@pytest.mark.case_attr_access +@pytest.mark.auth_flow +@pytest.mark.parametrize("path", [ + f"/case-attribute/{_INBREDSET_ID}/reject/{_CHANGE_ID}", + f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/diffs/{_CHANGE_ID}/reject", +]) +def test_no_privilege_reject_returns_401(gn3_url, http, basic_access_token, path): + """A token with no reject privileges must be refused with 401.""" + resp = http.post( + f"{gn3_url}{path}", + headers={"Authorization": f"Bearer {basic_access_token}"}, + timeout=30, + ) + assert resp.status_code == 401, ( + f"Expected 401 for unprivileged POST {path!r}, " + f"got {resp.status_code}. Body: {resp.text[:200]}" + ) |