1 files changed, 61 insertions, 0 deletions
diff --git a/tests/test_gn2_auth_flow.py b/tests/test_gn2_auth_flow.py
new file mode 100644
index 0000000..f6beddb
--- /dev/null
+++ b/tests/test_gn2_auth_flow.py
@@ -0,0 +1,61 @@
+"""
+Auth-flow integration tests for genenetwork2 protected endpoints.
+
+Part 1 — Unauthenticated redirect checks:
+    GN2's @login_required decorator redirects unauthenticated requests to the
+    home page ("/").  These tests verify that all protected endpoints in the
+    metadata-edit blueprint enforce that guard.  No credentials are required.
+
+Part 2 — gn-auth contract tests (auth_flow, credentials required):
+    GN2 calls back to gn-auth's POST /auth/data/authorisation and
+    GET /auth/resource/system/roles per-request.  These tests verify the
+    contracts that gn2 depends on.
+
+Blueprint prefix: /datasets/ (registered in wqflask/__init__.py)
+
+Run all:
+    pytest -m "gn2 and auth_flow"
+
+Run unauthenticated only (no credentials needed):
+    pytest -m "gn2 and auth_flow" -k "unauthenticated"
+"""
+import pytest
+
+pytestmark = [pytest.mark.gn2, pytest.mark.auth_flow]
+
+# Known-good values reused from the smoke test suite.
+_DATASET_ID = "HC_M2_0606_P"
+_TRAIT_NAME = "1435395_s_at"
+_RESOURCE_ID = "00000000-0000-0000-0000-000000000000"  # arbitrary; rejected before DB lookup
+_DIFF_NAME = "some-diff-name"
+
+
+# ---------------------------------------------------------------------------
+# Part 1: unauthenticated redirect — @login_required enforcement
+# ---------------------------------------------------------------------------
+
+def test_unauthenticated_display_phenotype_redirects(gn2_url, http):
+    """GET /datasets/<dataset_id>/traits/<name> redirects to / without a session."""
+    resp = http.get(
+        f"{gn2_url}/datasets/{_DATASET_ID}/traits/{_TRAIT_NAME}",
+        timeout=30,
+        allow_redirects=False,
+    )
+    assert resp.status_code in (301, 302), (
+        f"Expected redirect for unauthenticated phenotype-display, "
+        f"got {resp.status_code}: {resp.text[:200]}"
+    )
+
+
+def test_unauthenticated_update_phenotype_redirects(gn2_url, http):
+    """POST /datasets/<dataset_id>/traits/<name> redirects to / without a session."""
+    resp = http.post(
+        f"{gn2_url}/datasets/{_DATASET_ID}/traits/{_TRAIT_NAME}",
+        data={},
+        timeout=30,
+        allow_redirects=False,
+    )
+    assert resp.status_code in (301, 302), (
+        f"Expected redirect for unauthenticated phenotype-update, "
+        f"got {resp.status_code}: {resp.text[:200]}"
+    )