read permissions on every GET

tests/test_plugins/test_knowledgebase_visibility.py

@@ -15,6 +15,17 @@ from shopdb.core.models import Application
 from plugins.knowledgebase.models import KnowledgeBase
 
 
+@pytest.fixture(autouse=True)
+def _signed_in(client, auth_headers):
+    """Reading needs a permission now, and these tests are about what the
+    payload says rather than about who may see it. Signing the client in once
+    beats threading headers through every helper in the module."""
+    client.environ_base['HTTP_AUTHORIZATION'] = auth_headers['Authorization']
+    yield
+    client.environ_base.pop('HTTP_AUTHORIZATION', None)
+
+
+
 @pytest.fixture
 def library(db):
     """One application of each interesting shape, with an article each."""
@@ -84,7 +95,7 @@ def test_searching_a_title_does_not_resurrect_a_retired_article(client, library)
     assert 'Live runbook' in found
 
 
-def test_the_counts_agree_with_the_list(client, library):
+def test_the_counts_agree_with_the_list(client, library, auth_headers):
     """A total that includes articles nobody can see is a total nobody can
     reconcile against the page."""
     visible = titles(client)
@@ -97,10 +108,11 @@ def test_the_counts_agree_with_the_list(client, library):
     assert clicks == 6
 
 
-def test_the_topic_list_offers_every_active_application(client, library):
+def test_the_topic_list_offers_every_active_application(client, library, auth_headers):
     """What the article form's topic dropdown fetches. Installable or not,
     hidden or not - only retired is excluded."""
-    offered = sorted(row['appname'] for row in client.get(
-        '/api/applications?perpage=100&showhidden=true').get_json()['data'])
+    response = client.get('/api/applications?perpage=100&showhidden=true',
+                          headers=auth_headers)
+    offered = sorted(row['appname'] for row in response.get_json()['data'])
     assert offered == ['Hidden App', 'Live App', 'Manual App']
     assert 'Retired App' not in offered