This actually adds authentication to e2e tests for all editing endpoints (POST, PUT, DELETE), not only to the AddItemStatementTest.

I compiled an overview the response codes for all our current endpoints as I have observed them in our current dev environment.

Notes from Backlog Refinement:

In T312551#8108743, @gerritbot wrote:

Change 817803 had a related patch set uploaded (by Silvan Heintze; author: Silvan Heintze):

*Task Breakdown notes*

The last subtask that was solved in this sprint was T311287: 🟩️ Refuse to handle POST requests to /entities/items/{item_id}/statements when an item has been merged into another one which can be tested on https://wikidata.beta.wmflabs.org/wiki/Q12 (merged into Q593112).

Turns out that the canEdit() check we are performing in the PermissionChecker may not only fail for protected pages, but also for other reasons, such as (partial) user blocks. Since we already had agreed, that the error response should be the same as the MediaWiki framework response, when the route handler's needsWriteAccess check fails, we are now returning a generic "permission denied" error from the use case. However, that never makes it to the surface, because the route handler detects it and turns it into the framework's standard 403 Forbidden response.

Notes from Backlog Refinement:

Pls note that the Location header value holds the URL to the newly created statement in url-encoded format, which means the statement guid Q42$... becomes Q42%24..., which isn't very pretty. @WMDE-leszek Should this be changed or do you agree that tools and gadgets won't actually care much about Location header URL's prettiness?

remaining bits and pieces have been addressed in T309851

@WMDE-leszek, Product Verification, please

The newly added request headers and 304 responses are shown in the now published OpenAPI document and all conditional requests should be working as expected.

I moved this back to ToDo for now, since I noticed something in the task description, which we had actually missed: T309633: 🟦️ Adjust examples in the OpenAPI specification to include all required statement fields