---
estimated_steps: 37
estimated_files: 2
skills_used: []
---

# T03: Add integration tests for all consent endpoints

Write comprehensive integration tests covering all consent endpoints, auth/authz edge cases, and audit trail correctness.

## Steps

1. Read `backend/tests/conftest.py` for existing fixture patterns (`client`, `auth_headers`, `registered_user`, `db_engine`).
2. Add new fixtures to `backend/tests/conftest.py`:
   - `creator_with_videos`: creates a Creator + 2 SourceVideo records in the test DB, returns dict with `creator_id`, `video_ids`
   - `creator_user_auth`: registers a user linked to that creator (set `creator_id` on User after registration), returns auth headers
   - `admin_auth`: registers an admin-role user, returns auth headers
3. Create `backend/tests/test_consent.py` with these test cases:
   - **Auth tests**: unauthenticated GET/PUT → 401. User without creator_id → 403 on all consent endpoints.
   - **Ownership tests**: Creator A can't read/update Creator B's video consent. Returns 403.
   - **Happy path — PUT**: First PUT creates VideoConsent + audit entries. Response has correct flags.
   - **Happy path — GET list**: Returns creator's videos with consent status. Pagination works.
   - **Happy path — GET single**: Returns consent for specific video.
   - **Audit trail**: PUT changing 2 fields creates 2 audit entries with correct version numbers. GET history returns them ordered.
   - **Idempotency**: PUT with same values as current state creates no new audit entries.
   - **Partial update**: PUT with only `kb_inclusion=True` changes only that field, leaves others unchanged.
   - **Admin access**: Admin can read any creator's consent via GET endpoints. Admin summary returns correct counts.
   - **Nonexistent video**: GET/PUT for random UUID → 404.
4. Run the full test suite to confirm no regressions.

## Must-Haves

- [ ] Tests for 401 (no auth), 403 (no creator_id), 403 (wrong creator), 404 (no video)
- [ ] Tests for PUT creating audit entries with incrementing versions
- [ ] Test for idempotent PUT (no audit entries when values unchanged)
- [ ] Test for admin bypass on read endpoints
- [ ] Test for GET list pagination
- [ ] All existing tests still pass

## Verification

- `cd backend && python -m pytest tests/test_consent.py -v` — all consent tests pass
- `cd backend && python -m pytest tests/ -v --timeout=60` — full suite passes, no regressions

## Inputs

- `backend/tests/conftest.py` — existing test fixtures
- `backend/routers/consent.py` — consent router from T02
- `backend/schemas.py` — consent schemas from T02
- `backend/models.py` — consent models from T01

## Expected Output

- `backend/tests/conftest.py` — updated with creator_with_videos, creator_user_auth, admin_auth fixtures
- `backend/tests/test_consent.py` — new test file with comprehensive consent endpoint tests

## Inputs

- `backend/tests/conftest.py`
- `backend/routers/consent.py`
- `backend/schemas.py`
- `backend/models.py`

## Expected Output

- `backend/tests/test_consent.py`
- `backend/tests/conftest.py`

## Verification

cd backend && python -m pytest tests/test_consent.py -v && python -m pytest tests/ -v --timeout=60
