Test that `POST /api/admin/imports/preflight` accepts the import capability and denies unrelated authenticated users.

• Assert 401 separately from 403.
• Drive access through capabilities, not broad role assumptions.
• Use harmless preflight input and isolated services.
• Keep all matrix rows visible in one test source.

I turn the policy into data rows so adding or removing one access path is obvious in review. Each request goes through the real authorization middleware. The success cases assert endpoint behavior too, preventing a false pass caused by an unrelated 404 or 500.

[Theory]
[InlineData(null, null, HttpStatusCode.Unauthorized)]
[InlineData("user", "suggestions.create", HttpStatusCode.Forbidden)]
[InlineData("editor", "content.read", HttpStatusCode.Forbidden)]
[InlineData("editor", "imports.preflight", HttpStatusCode.OK)]
[InlineData("admin", "imports.preflight", HttpStatusCode.OK)]
public async Task Import_preflight_enforces_capability(
    string? userId,
    string? capabilities,
    HttpStatusCode expected)
{
    await using var factory = new ApiTestFactory();
    var client = factory.CreateClient();

    if (userId is not null)
    {
        client.DefaultRequestHeaders.Add("X-Test-User", userId);
        client.DefaultRequestHeaders.Add("X-Test-Capabilities", capabilities);
    }

    using var response = await client.PostAsJsonAsync(
        "/api/admin/imports/preflight",
        TestImports.MinimalValidPack());

    Assert.Equal(expected, response.StatusCode);
}

The matrix is small and deterministic. It validates policy wiring, claim transformation, and endpoint authorization without importing content because the route is preflight-only and test services are isolated.

• A user has several comma-separated capabilities.
• The capability differs only by casing.
• The endpoint route changes.
• A fallback policy is configured incorrectly.

• Add a negative row for every neighboring capability.
• Assert successful rows return the expected preflight contract.
• Verify anonymous and authenticated-denied responses remain distinct.

• Testing roles while production checks capabilities.
• Writing only allowed cases.
• Treating 404 or 500 as acceptable denial.
• Calling a mutating import endpoint in an authorization test.