From b2e67bfe6686a8daa14996f940b2c3db769ea153 Mon Sep 17 00:00:00 2001 From: Claude Sonnet 4.6 Date: Wed, 2 Sep 2026 19:05:05 +0000 Subject: test(gn-auth): public resource grants view-resource to all authenticated users All resources marked public in gn-auth grant group:resource:view-resource to every user, not just anonymous callers. This test pins that contract: an authenticated admin posting _PUBLIC_TRAIT must receive the same view privilege as an unauthenticated caller. Co-Authored-By: Claude Sonnet 4.6 Reviewed-By: Frederick M. Muriithi --- tests/test_gn_auth_auth_flow.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/test_gn_auth_auth_flow.py b/tests/test_gn_auth_auth_flow.py index d8b9e75..b86a0c1 100644 --- a/tests/test_gn_auth_auth_flow.py +++ b/tests/test_gn_auth_auth_flow.py @@ -457,3 +457,21 @@ def test_data_authorisation_with_token_unknown_trait_returns_404( assert resp.status_code == 404, ( f"Expected 404 for unknown trait with token, got {resp.status_code}: {resp.text[:300]}" ) + + +def test_data_authorisation_with_token_public_trait_grants_view_privilege( + gn_auth_url, http, access_token): + """All authenticated users receive group:resource:view-resource on a public resource.""" + resp = http.post( + f"{gn_auth_url}/auth/data/authorisation", + json={"traits": [_PUBLIC_TRAIT]}, + headers={"Authorization": f"Bearer {access_token}"}, + timeout=30, + ) + items = resp.json().get("authorisation", []) + assert len(items) > 0, f"Expected at least one authorisation item, got: {resp.json()}" + privileges = items[0].get("privileges", []) + assert "group:resource:view-resource" in privileges, ( + f"Expected 'group:resource:view-resource' for authenticated user on public resource, " + f"got: {privileges}" + ) -- cgit 1.4.1