info:
  name: Register - Admin Role Unauthenticated (403)
  type: http
  seq: 2

http:
  method: POST
  url: '{{base_url}}/api/auth/register'
  auth: inherit
  body:
    type: json
    data: |-
      {
        "email": "smoke-admin-attempts@tests.bookhoard.internal",
        "username": "smokeadminattempts",
        "password": "Sm0ke@Pass123!",
        "role": "admin"
      }
settings:
  encodeUrl: true
  timeout: 0
  followRedirects: true
  maxRedirects: 5

runtime:
  scripts:
    - type: tests
      code: |-
        test("status is 403", function() {
          expect(res.status).to.eql(403);
        });

docs:
  content: |-
    # Register - Admin Role Unauthenticated (403)

    With admins already present, an unauthenticated register attempt
    carrying role=admin must be rejected with 403 and create nothing.
    Repeats safely.
  type: text/markdown