✅ [#4199] Add/fix tests for starting anonymous submission

src/openforms/authentication/tests/test_signals.py

@@ -86,6 +86,29 @@ def test_attribute_set_for_demo_plugin_with_staff_user(self):
         instance.refresh_from_db()
         self.assertEqual(instance.auth_info.value, "123")
 
+    def test_ignore_set_attribute_if_anonymous(self):
+        register = Registry()
+        register("plugin1")(RequiresAdminPlugin)
+        instance = SubmissionFactory.create()
+        request = factory.get("/foo")
+        request.user = StaffUserFactory.create()
+        request.session = {
+            FORM_AUTH_SESSION_KEY: {
+                "plugin": "plugin1",
+                "attribute": RequiresAdminPlugin.provides_auth,
+                "value": "123",
+            }
+        }
+
+        with mock_register(register):
+            set_auth_attribute_on_session(
+                sender=None, instance=instance, request=request, anonymous=True
+            )
+
+        instance.refresh_from_db()
+        with self.assertRaises(Submission.auth_info.RelatedObjectDoesNotExist):
+            instance.auth_info
+
     @tag("gh-4199")
     def test_two_submissions_within_same_session(self):
         """

src/openforms/submissions/tests/test_authentication_requirements.py

@@ -11,6 +11,8 @@
 If authentication is optional, then this behaviour does not apply.
 """
 
+from unittest.mock import patch
+
 from django.test import override_settings, tag
 
 from rest_framework import status
@@ -51,16 +53,21 @@ def setUpTestData(cls) -> None:
             "api:form-detail", kwargs={"uuid_or_slug": cls.form.uuid}
         )
 
-    def test_start_submission_is_allowed(self):
+    @patch("openforms.submissions.api.viewsets.submission_start.send", autospec=True)
+    def test_start_submission_is_allowed(self, mock_signal):
         body = {
             "form": f"http://testserver.com{self.form_url}",
             "formUrl": "http://testserver.com/my-form",
+            "anonymous": True,
         }
 
         response = self.client.post(self.endpoint, body, HTTP_HOST="testserver.com")
 
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
 
+        mock_signal.assert_called_once()
+        self.assertEqual(mock_signal.call_args_list[0].kwargs["anonymous"], True)
+
     def test_submitting_step_data_is_allowed_anon_user(self):
         submission = SubmissionFactory.create(form=self.form)
         assert not submission.is_authenticated, "Submission must be anonymous"