@ows_product_digital
@content_review
@graphql_product
@ows_product_digital_content
Feature: Product Digital Approve Authorization (INC-337)

  # Regression coverage for INC-337: a non-OA subaccount owner approved a Content-Review-rejected
  # release by calling PUT /product/audio/<id>/approve directly, which had no oa: role restriction.
  # These scenarios assert the POST-fix (AS-1) behaviour: the endpoint must return 403 and leave the
  # release in transfer_to_content. AS-1 is deployed to QA and both scenarios pass, so they are kept
  # active as a regression guard against the endpoint's authorisation being weakened again.
  @id_f88ed18bbe0f5187ad035443e340fe3a5667ba4517cb86f7b84745fc98d13a57
  Scenario: A non-OA owner cannot approve their own release via the product-digital approve endpoint
    Given an orchard employee label_7123_admin for workstation
    And I have a new project and digital product for the user with label data 7123_full and artist 161563
    And I have a blank track with all required fields for label 7123
    And I upload a track via api
    And I upload artwork via api
    When I validate and submit my product via api
    Then The product release status is transfer_to_content in the database
    When the workstation user label_7123_admin attempts to approve the product via the api
    Then the approve request is rejected with status 403
    And The product release status is transfer_to_content in the database

  @id_da7cec340b5b64793852bd9d139a788e6c8cfa077832a09a1364e086f81153ad
  Scenario: A non-owner cannot approve a release via the product-digital approve endpoint
    Given an orchard employee label_7123_admin for workstation
    And I have a new project and digital product for the user with label data 7123_full and artist 161563
    And I have a blank track with all required fields for label 7123
    And I upload a track via api
    And I upload artwork via api
    When I validate and submit my product via api
    Then The product release status is transfer_to_content in the database
    When the workstation user label_6971_admin attempts to approve the product via the api
    Then the approve request is rejected with status 403
    And The product release status is transfer_to_content in the database