How would you test a new API feature involving user authentication and authorization?

@Test
public void testAdminCanAccessAllResources() {
    given()
        .header("Authorization", "Bearer " + adminToken)
        .when()
        .get("/api/admin/users")
        .then()
        .statusCode(200);
}

@Test
public void testUserCannotAccessAdminEndpoints() {
    given()
        .header("Authorization", "Bearer " + userToken)
        .when()
        .get("/api/admin/users")
        .then()
        .statusCode(403)
        .body("error", containsString("Forbidden"));
}

@Test
public void testGuestCanOnlyAccessPublicEndpoints() {
    // No auth header
    given()
        .when()
        .get("/api/public/products")
        .then()
        .statusCode(200);

    given()
        .when()
        .get("/api/private/orders")
        .then()
        .statusCode(401);
}

@Test
public void testJWTTokenContainsRequiredClaims() {
    Response loginResponse = given()
        .body("{ \"username\": \"admin\", \"password\": \"admin123\" }")
        .contentType(ContentType.JSON)
        .when()
        .post("/api/auth/login");

    String token = loginResponse.jsonPath().getString("token");

    // Decode JWT and verify claims
    // (Use java-jwt or nimbus-jose-jwt library)
    assertNotNull(token);

    // Token should expire in 1 hour
    String expiry = loginResponse.jsonPath().getString("expires_in");
    assertEquals(expiry, "3600");
}

@Test
public void testExpiredTokenRejected() {
    String expiredToken = "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2MDAwMDAwMDB9.invalid";

    given()
        .header("Authorization", "Bearer " + expiredToken)
        .when()
        .get("/api/users")
        .then()
        .statusCode(401)
        .body("error", equalTo("Token expired"));
}

@Test
public void testSQLInjectionInLoginEndpoint() {
    String maliciousBody = "{ \"username\": \"admin'' OR ''1''=''1\", \"password\": \"x\" }";

    given()
        .contentType(ContentType.JSON)
        .body(maliciousBody)
        .when()
        .post("/api/auth/login")
        .then()
        .statusCode(anyOf(equalTo(400), equalTo(401)))
        // Should NOT return 200
        .statusCode(not(equalTo(200)));
}

@Test
public void testBruteForceProtection() {
    // After 5 failed attempts, should be locked out
    for (int i = 0; i < 5; i++) {
        given()
            .body("{ \"username\": \"user@test.com\", \"password\": \"wrong\" }")
            .contentType(ContentType.JSON)
            .when()
            .post("/api/auth/login");
    }

    // 6th attempt should be rate-limited
    given()
        .body("{ \"username\": \"user@test.com\", \"password\": \"wrong\" }")
        .contentType(ContentType.JSON)
        .when()
        .post("/api/auth/login")
        .then()
        .statusCode(429); // Too Many Requests
}

@Test
public void testLogoutInvalidatesToken() {
    String token = getAuthToken();

    // Logout
    given()
        .header("Authorization", "Bearer " + token)
        .when()
        .post("/api/auth/logout")
        .then()
        .statusCode(200);

    // Try using the token after logout
    given()
        .header("Authorization", "Bearer " + token)
        .when()
        .get("/api/users")
        .then()
        .statusCode(401); // Token should now be invalid
}