Merge pull request #1820 from NHSDigital/feature/ERSSUP-80635

[ERSSUP-80635]-[]-[Check for body in 403 response]-[DMW]

Author: nhsd-david-wass

tests/asserts.py

@@ -225,3 +225,28 @@ def assert_error_response(
 
     for renamed_header in RenamedHeader:
         assert renamed_header.renamed not in client_response_headers
+
+
+def assert_error_response_with_body(
+    response: Response, expected_correlation_id: int, expected_status_code: int
+):
+    # Verify the status
+    assert response.status_code == expected_status_code, (
+        "Expected a "
+        + expected_status_code
+        + " when accessing the api but got "
+        + (str)(response.status_code)
+    )
+
+    assert len(response.content) > 0
+
+    # Verify the response headers
+    client_response_headers = response.headers
+
+    assert (
+        client_response_headers[RenamedHeader.CORRELATION_ID.original]
+        == expected_correlation_id
+    )
+
+    for renamed_header in RenamedHeader:
+        assert renamed_header.renamed not in client_response_headers

tests/integration/test_app_restricted.py

@@ -2,7 +2,11 @@
 import requests
 from requests import Response
 from tests.data import RenamedHeader
-from tests.asserts import assert_ok_response, assert_error_response
+from tests.asserts import (
+    assert_ok_response,
+    assert_error_response,
+    assert_error_response_with_body,
+)
 
 _HEADER_AUTHORIZATION = "Authorization"
 _HEADER_ECHO = "echo"  # enable echo target
@@ -42,7 +46,7 @@ async def test_authorised_application_not_supported_for_user_restricted(
             f"{service_url}{_SPECIALTY_REF_DATA_URL}", headers=client_request_headers
         )
 
-        assert_error_response(response, _EXPECTED_CORRELATION_ID, 403)
+        assert_error_response_with_body(response, _EXPECTED_CORRELATION_ID, 403)
 
     def test_authorised_application_supported_for_app_restricted(
         self, app_restricted_access_code, service_url