1 files changed, 50 insertions, 0 deletions
diff --git a/tests/test_gn3_case_attr_access.py b/tests/test_gn3_case_attr_access.py
new file mode 100644
index 0000000..e2399c8
--- /dev/null
+++ b/tests/test_gn3_case_attr_access.py
@@ -0,0 +1,50 @@
+"""Access-control tests for case-attribute endpoints (old flat + v1 hierarchy).
+
+Case-attribute names are publicly accessible (no token required).
+All write endpoints require a valid token, and a token with appropriate
+edit privileges.
+"""
+import pytest
+
+pytestmark = pytest.mark.gn3
+
+_SPECIES_ID = 1     # Mouse
+_INBREDSET_ID = 1   # BXD
+
+
+@pytest.mark.case_attr_access
+@pytest.mark.parametrize("path", [
+    f"/case-attribute/{_INBREDSET_ID}/edit",
+    f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/edit",
+])
+def test_no_token_edit_returns_400(gn3_url, http, path):
+    """POST to any edit endpoint with no token must be rejected with 400."""
+    resp = http.post(
+        f"{gn3_url}{path}",
+        json={"edit-data": []},
+        timeout=30,
+    )
+    assert resp.status_code == 400, (
+        f"Expected 400 for unauthenticated POST {path!r}, "
+        f"got {resp.status_code}. Body: {resp.text[:200]}"
+    )
+
+
+@pytest.mark.case_attr_access
+@pytest.mark.auth_flow
+@pytest.mark.parametrize("path", [
+    f"/case-attribute/{_INBREDSET_ID}/edit",
+    f"/v1/species/{_SPECIES_ID}/populations/{_INBREDSET_ID}/case-attributes/edit",
+])
+def test_no_privilege_edit_returns_401(gn3_url, http, basic_access_token, path):
+    """A token with no case-attribute edit privileges must be refused with 401."""
+    resp = http.post(
+        f"{gn3_url}{path}",
+        json={"edit-data": []},
+        headers={"Authorization": f"Bearer {basic_access_token}"},
+        timeout=30,
+    )
+    assert resp.status_code == 401, (
+        f"Expected 401 for unprivileged POST {path!r}, "
+        f"got {resp.status_code}. Body: {resp.text[:200]}"
+    )