diff options
| -rw-r--r-- | tests/test_gn_auth_auth_flow.py | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py index c7b2a5c..a966d53 100644 --- a/tests/test_gn_auth_auth_flow.py +++ b/tests/test_gn_auth_auth_flow.py @@ -340,3 +340,31 @@ def test_data_authorisation_no_token_public_trait_grants_view_privilege(gn_auth_ f"Expected 'group:resource:view-resource' in privileges for public trait, " f"got: {privileges}" ) + + +def test_data_authorisation_no_token_unknown_trait_returns_404(gn_auth_url, http): + """POST /auth/data/authorisation with a non-existent trait returns 404.""" + resp = http.post( + f"{gn_auth_url}/auth/data/authorisation", + json={"traits": ["NoSuchDataset::no_such_trait"]}, + timeout=30, + ) + assert resp.status_code == 404, ( + f"Expected 404 for unknown trait, got {resp.status_code}: {resp.text[:300]}" + ) + + +# --------------------------------------------------------------------------- +# GET /auth/resource/system/roles — public-view fallback and authenticated +# +# Without an Authorization header the endpoint returns the public-view role. +# With a valid Bearer token it returns the user's system roles. +# --------------------------------------------------------------------------- + +def test_system_roles_no_token_returns_200(gn_auth_url, http): + """GET /auth/resource/system/roles without a token returns 200.""" + resp = http.get(f"{gn_auth_url}/auth/resource/system/roles", timeout=30) + assert resp.status_code == 200, ( + f"Expected 200 from /auth/resource/system/roles without token, " + f"got {resp.status_code}: {resp.text[:300]}" + ) |