1 files changed, 28 insertions, 0 deletions
diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py
index c7b2a5c..a966d53 100644
--- a/tests/test_gn_auth_auth_flow.py
+++ b/tests/test_gn_auth_auth_flow.py
@@ -340,3 +340,31 @@ def test_data_authorisation_no_token_public_trait_grants_view_privilege(gn_auth_
         f"Expected 'group:resource:view-resource' in privileges for public trait, "
         f"got: {privileges}"
     )
+
+
+def test_data_authorisation_no_token_unknown_trait_returns_404(gn_auth_url, http):
+    """POST /auth/data/authorisation with a non-existent trait returns 404."""
+    resp = http.post(
+        f"{gn_auth_url}/auth/data/authorisation",
+        json={"traits": ["NoSuchDataset::no_such_trait"]},
+        timeout=30,
+    )
+    assert resp.status_code == 404, (
+        f"Expected 404 for unknown trait, got {resp.status_code}: {resp.text[:300]}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# GET /auth/resource/system/roles — public-view fallback and authenticated
+#
+# Without an Authorization header the endpoint returns the public-view role.
+# With a valid Bearer token it returns the user's system roles.
+# ---------------------------------------------------------------------------
+
+def test_system_roles_no_token_returns_200(gn_auth_url, http):
+    """GET /auth/resource/system/roles without a token returns 200."""
+    resp = http.get(f"{gn_auth_url}/auth/resource/system/roles", timeout=30)
+    assert resp.status_code == 200, (
+        f"Expected 200 from /auth/resource/system/roles without token, "
+        f"got {resp.status_code}: {resp.text[:300]}"
+    )