CMIS authoring operations

tests/cmis/test_cmis_browser_binding_api.py

@@ -162,3 +162,41 @@ def test_cmis_query_reports_unsupported_subset_diagnostics(cmis_client) -> None:
         "SELECT * FROM cmis:document",
         "SELECT * FROM kontextual:document",
     ]
+
+
+def test_cmis_governed_authoring_routes_allow_selected_mutations(cmis_client) -> None:
+    created = cmis_client.post(
+        "/cmis/governed-authoring/browser/document",
+        json={
+            "asset_id": "asset-api-authored",
+            "name": "API Authored",
+            "content": "# API Authored",
+            "media_type": "text/markdown",
+        },
+    )
+    updated = cmis_client.post(
+        "/cmis/governed-authoring/browser/object/cmis:asset:asset-api-authored/properties",
+        json={"properties": {"kontextual:metadata:status": "draft"}},
+    )
+    streamed = cmis_client.post(
+        "/cmis/governed-authoring/browser/object/cmis:asset:asset-api-authored/content",
+        json={"content": "# Updated", "media_type": "text/markdown"},
+    )
+    deleted = cmis_client.post(
+        "/cmis/governed-authoring/browser/object/cmis:asset:asset-api-authored/delete",
+        json={},
+    )
+
+    assert created.status_code == 200
+    assert updated.json()["properties"]["kontextual:metadata:status"] == "draft"
+    assert streamed.json()["content_stream"]["mime_type"] == "text/markdown"
+    assert deleted.json()["lifecycle"] == "delete_requested"
+
+
+def test_cmis_readonly_route_rejects_mutation(cmis_client) -> None:
+    response = cmis_client.post(
+        "/cmis/readonly-browser/browser/document",
+        json={"asset_id": "asset-api-readonly-denied", "name": "Denied"},
+    )
+
+    assert response.status_code == 403