"""Baseline integration tests for GET /hfa/eligible-tracks endpoint. These tests capture the current (pre-Permissions Platform) behavior of the endpoint across the integration test personas. The WIP rows are expected to flip once the endpoint is migrated to use PP authorization checks. """ import pytest import requests @pytest.mark.parametrize( 'header_fixture_name,expected_status_code', [ pytest.param( 'ows_product_user_headers', 200, id='OWS product user with valid JWT can list HFA eligible tracks', ), pytest.param( 'ows_product_content_user_headers', 200, id='OWS product content-profile user can list HFA eligible tracks', ), pytest.param( 'ows_product_pp_user_headers', 200, id=( 'PP user with content_ccm_digital_audio_can_bulk_create role ' 'can list HFA eligible tracks' ), ), pytest.param( 'ows_product_pp_no_access_user_headers', 200, id=( 'PP-XXXX WIP PP user without content_ccm_digital_audio_can_bulk_create ' 'role can currently list HFA eligible tracks' ), ), pytest.param( 'content_profile_headers', 200, id=( 'PP-XXXX WIP ContentProfile headers (no JWT) can currently list ' 'HFA eligible tracks' ), ), pytest.param( 'unauthorized_headers', 200, id=( 'PP-XXXX WIP Unauthorized headers (no JWT) can currently list ' 'HFA eligible tracks' ), ), ], ) def test_get_hfa_eligible_tracks_authorization_matrix( header_fixture_name: str, expected_status_code: int, qa_ows_product_url: str, request: pytest.FixtureRequest, ) -> None: """Baseline authorization matrix for GET /hfa/eligible-tracks.""" url = f'{qa_ows_product_url}/hfa/eligible-tracks' headers = request.getfixturevalue(header_fixture_name) result = requests.get(url, headers=headers) assert result.status_code == expected_status_code, result.text if result.status_code == 200: assert isinstance(result.json(), list) def test_get_hfa_eligible_tracks_no_headers(qa_ows_product_url: str) -> None: """Baseline: anonymous (no headers) request currently returns 200. Once PP authorization is applied this is expected to return 401/403. """ url = f'{qa_ows_product_url}/hfa/eligible-tracks' result = requests.get(url) assert result.status_code == 200, result.text assert isinstance(result.json(), list)