✅ [#4650] Add tests for optional ownership check

* Added tests for configuration validation
* Added tests for runtime behaviour

Author: sergei-maertens

src/openforms/prefill/contrib/objects_api/tests/test_initial_data_ownership_validation.py

@@ -159,3 +159,19 @@ def test_verify_initial_data_ownership_missing_auth_attribute_path_causes_failin
                 logs.filter_event("object_ownership_check_success").exists()
             )
             self.assertFalse(logs.filter_event("prefill_retrieve_success").exists())
+
+    def test_allow_prefill_when_ownership_check_is_skipped(self):
+        self.variable.prefill_options["skip_ownership_check"] = True
+        self.variable.save()
+        submission = SubmissionFactory.create(
+            form=self.form,
+            # invalid BSN
+            auth_info__value="000XXX000",
+            auth_info__attribute=AuthAttribute.bsn,
+            initial_data_reference=self.object_ref,
+        )
+
+        try:
+            prefill_variables(submission=submission)
+        except PermissionDenied as exc:
+            raise self.failureException("Ownership check should be skipped") from exc

src/openforms/prefill/contrib/objects_api/tests/test_options_validation.py

@@ -0,0 +1,47 @@
+import uuid
+
+from rest_framework.test import APITestCase
+
+from openforms.contrib.objects_api.tests.factories import ObjectsAPIGroupConfigFactory
+
+from ..api.serializers import ObjectsAPIOptionsSerializer
+
+
+class OptionValidationTests(APITestCase):
+    """
+    Test the serializer used for options validation.
+    """
+
+    def test_auth_attribute_not_required(self):
+        api_group = ObjectsAPIGroupConfigFactory.create()
+        data = {
+            "objects_api_group": api_group.pk,
+            "objecttype_uuid": uuid.uuid4(),
+            "objecttype_version": 3,
+            "skip_ownership_check": True,
+            "auth_attribute_path": [],
+            "variables_mapping": [],
+        }
+        serializer = ObjectsAPIOptionsSerializer(data=data)
+
+        is_valid = serializer.is_valid()
+
+        self.assertTrue(is_valid)
+
+    def test_auth_attribute_required(self):
+        api_group = ObjectsAPIGroupConfigFactory.create()
+        data = {
+            "objects_api_group": api_group.pk,
+            "objecttype_uuid": uuid.uuid4(),
+            "objecttype_version": 3,
+            "skip_ownership_check": False,
+            "auth_attribute_path": [],
+            "variables_mapping": [],
+        }
+        serializer = ObjectsAPIOptionsSerializer(data=data)
+
+        is_valid = serializer.is_valid()
+
+        self.assertFalse(is_valid)
+        error = serializer.errors["auth_attribute_path"][0]
+        self.assertEqual(error.code, "empty")