test(campaign): enforce aggregate report permissions

tests/test_aggregate_report_routes.py

@@ -116,6 +116,19 @@ def test_aggregate_route_uses_only_the_safe_projection() -> None:
     )
 
 
+@pytest.mark.parametrize("path", ["/campaigns/aggregate-reports", "/campaigns/aggregate-reports/{campaign_id}"])
+def test_aggregate_routes_require_report_read_permission(path: str) -> None:
+    route = next(item for item in router.router.routes if item.path == path)
+    dependency = next(item for item in route.dependant.dependencies if item.name == "principal")
+
+    with pytest.raises(HTTPException) as denied:
+        dependency.call(_Principal())
+    assert denied.value.status_code == 403
+
+    principal = _Principal("campaigns:report:read")
+    assert dependency.call(principal) is principal
+
+
 def test_aggregate_projection_is_tenant_isolated_and_needs_no_optional_module() -> None:
     engine = create_engine("sqlite+pysqlite:///:memory:")
     create_scope_tables(engine)