1 files changed, 51 insertions, 0 deletions
diff --git a/conftest.py b/conftest.py
index 250f72d..26931fc 100644
--- a/conftest.py
+++ b/conftest.py
@@ -204,3 +204,54 @@ def basic_access_token(gn_auth_url, basic_oauth2_credentials, http):
     data = resp.json()
     assert "access_token" in data
     return data["access_token"]
+
+
+@pytest.fixture(scope="session")
+def data_curator_oauth2_credentials():
+    """Return (email, password, client_id, client_secret) for the systemwide-data-curator user.
+
+    Requires GN_TEST_USERS_FILE + GN_TEST_CLIENT_FILE (set by the CI
+    auth-flow job).  Skips if not available or if the role is absent.
+    """
+    users_file = os.environ.get("GN_TEST_USERS_FILE")
+    client_file = os.environ.get("GN_TEST_CLIENT_FILE")
+    if not (users_file and client_file):
+        pytest.skip(
+            "Set GN_TEST_USERS_FILE and GN_TEST_CLIENT_FILE to run "
+            "auth-flow tests that require the systemwide-data-curator user."
+        )
+    users_data = _read_json_file(users_file)
+    client_data = _read_json_file(client_file)
+    curator = _user_by_role(users_data, "systemwide-data-curator")
+    if curator is None:
+        pytest.fail(
+            f"No user with role='systemwide-data-curator' found in {users_file}"
+        )
+    return (
+        curator["email"],
+        curator["password"],
+        client_data["client"]["client_id"],
+        client_data["client"]["client_secret"],
+    )
+
+
+@pytest.fixture(scope="session")
+def data_curator_token(gn_auth_url, data_curator_oauth2_credentials, http):
+    """Bearer token for the systemwide-data-curator test user."""
+    email, password, client_id, client_secret = data_curator_oauth2_credentials
+    resp = http.post(
+        f"{gn_auth_url}/auth/token",
+        json={
+            "grant_type": "password",
+            "username": email,
+            "password": password,
+            "scope": "profile group resource role user",
+            "client_id": client_id,
+            "client_secret": client_secret,
+        },
+        timeout=30,
+    )
+    assert resp.status_code == 200, f"Data-curator token request failed: {resp.text}"
+    data = resp.json()
+    assert "access_token" in data
+    return data["access_token"]