From bad5351f9d758d5b69531458e4e417739a03f044 Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Fri, 28 Aug 2026 15:10:11 +0000
Subject: test(gn3/case-attr): access-control level 1 & 2 for edit endpoints

Case-attribute names are public; tests cover only write endpoints.
Two parametrized tests over both the flat /case-attribute/ and the
new /api/v1/species/<s>/populations/<p>/case-attributes/ hierarchy:

- test_no_token_edit_returns_400: POST /edit with no token must return 400
- test_no_privilege_edit_returns_401: POST /edit with unprivileged token must return 401

Both tests are expected RED until the can_edit privilege check is added
to the flat and v1 edit endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
---
 pyproject.toml | 1 +
 1 file changed, 1 insertion(+)

(limited to 'pyproject.toml')

diff --git a/pyproject.toml b/pyproject.toml
index 773b57a..0a1d58d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,6 +16,7 @@ markers = [
     "gn_auth: Tests exercising the gn-auth service",
     "auth_flow: Tests requiring valid user credentials (set GN_TEST_EMAIL and GN_TEST_PASSWORD)",
     "transient: Tests known to fail intermittently due to timing or load; candidates for retry logic",
+    "case_attr_access: Tests for case-attribute endpoint access-control levels",
 ]
 
 [build-system]
-- 
cgit 1.4.1