Initial Claude implementation

tests/test_rbac.py

@@ -0,0 +1,53 @@
+async def _token(client, email, password="secret123"):
+    resp = await client.post(
+        "/api/auth/login", data={"username": email, "password": password}
+    )
+    assert resp.status_code == 200, resp.text
+    return resp.json()["access_token"]
+
+
+async def test_reader_can_list_but_not_create(client, seeded, make_user):
+    # User with only the "user" role (grants users:read).
+    await make_user("reader@example.com", role_ids=[seeded["roles"]["user"].id])
+    token = await _token(client, "reader@example.com")
+    headers = {"Authorization": f"Bearer {token}"}
+
+    assert (await client.get("/api/users", headers=headers)).status_code == 200
+
+    resp = await client.post(
+        "/api/users",
+        json={"email": "new@example.com", "password": "secret123"},
+        headers=headers,
+    )
+    assert resp.status_code == 403
+
+
+async def test_superuser_bypasses_permissions(client, seeded, make_user):
+    await make_user("root@example.com", is_superuser=True)
+    headers = {"Authorization": f"Bearer {await _token(client, 'root@example.com')}"}
+
+    resp = await client.post(
+        "/api/users",
+        json={"email": "created@example.com", "password": "secret123"},
+        headers=headers,
+    )
+    assert resp.status_code == 201, resp.text
+
+    # Superuser can also manage roles.
+    assert (await client.get("/api/roles", headers=headers)).status_code == 200
+
+
+async def test_no_role_user_is_forbidden(client, seeded, make_user):
+    await make_user("plain@example.com")  # no roles, not superuser
+    headers = {"Authorization": f"Bearer {await _token(client, 'plain@example.com')}"}
+    assert (await client.get("/api/users", headers=headers)).status_code == 403
+
+
+async def test_registered_user_gets_default_role(client, seeded):
+    await client.post(
+        "/api/auth/register",
+        json={"email": "fresh@example.com", "password": "secret123"},
+    )
+    headers = {"Authorization": f"Bearer {await _token(client, 'fresh@example.com')}"}
+    me = (await client.get("/api/users/me", headers=headers)).json()
+    assert [r["name"] for r in me["roles"]] == ["user"]