What: Add security tests that verify unauthorized access is prevented for all admin functions.
Why: Unauthorized access is a critical vulnerability. Tests must verify authorization is enforced.
Scope: Create test that: attempts admin functions without auth, attempts role-granting without auth, attempts pause without auth, verifies all revert.
Acceptance criteria:
- Unauthorized access is prevented
- Auth checks are enforced
- Error messages are clear
- No state changes
Technical context: tests/integration/ — existing integration tests.
What: Add security tests that verify unauthorized access is prevented for all admin functions.
Why: Unauthorized access is a critical vulnerability. Tests must verify authorization is enforced.
Scope: Create test that: attempts admin functions without auth, attempts role-granting without auth, attempts pause without auth, verifies all revert.
Acceptance criteria:
Technical context:
tests/integration/— existing integration tests.