feat(server): add _ensure_admin helper and require_admin FastAPI dep

server/tests/test_auth_helpers.py

@@ -0,0 +1,56 @@
+"""Unit tests for _ensure_admin and require_admin in server/auth.py."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+
+
+def _fake_request(auth_type: str = "none"):
+    return SimpleNamespace(state=SimpleNamespace(auth_type=auth_type))
+
+
+def test_ensure_admin_passes_for_admin_user(admin_user):
+    from auth import _ensure_admin
+
+    _ensure_admin(_fake_request("bearer"), admin_user)  # must not raise
+
+
+def test_ensure_admin_passes_for_admin_api_key_auth_type():
+    from auth import _ensure_admin
+
+    _ensure_admin(_fake_request("admin_api_key"), None)  # must not raise
+
+
+def test_ensure_admin_passes_for_auth_disabled():
+    from auth import _ensure_admin
+
+    _ensure_admin(_fake_request("disabled"), None)  # must not raise
+
+
+def test_ensure_admin_rejects_non_admin_user(member_user):
+    from auth import _ensure_admin
+
+    with pytest.raises(HTTPException) as exc:
+        _ensure_admin(_fake_request("bearer"), member_user)
+    assert exc.value.status_code == 403
+    assert "Admin role required" in exc.value.detail
+
+
+def test_ensure_admin_rejects_no_user_with_no_legacy_path():
+    from auth import _ensure_admin
+
+    with pytest.raises(HTTPException) as exc:
+        _ensure_admin(_fake_request("none"), None)
+    assert exc.value.status_code == 403
+
+
+def test_ensure_admin_rejects_bearer_with_no_user():
+    """Defense-in-depth: a 'bearer' auth_type without a User should not pass."""
+    from auth import _ensure_admin
+
+    with pytest.raises(HTTPException) as exc:
+        _ensure_admin(_fake_request("bearer"), None)
+    assert exc.value.status_code == 403