extensions/tests/test_api.py

@@ -29,6 +29,20 @@ class VersionUploadAPITest(APITestCase):
         self.upload_url = reverse('extensions:upload-extension-version')
         self.file_path = TEST_FILES_DIR / "amaranth-1.0.8.zip"
 
+    def test_version_upload_unauthenticated(self):
+        with open(self.file_path, 'rb') as version_file:
+            response = self.client.post(
+                self.upload_url,
+                {
+                    'version_file': version_file,
+                    'extension_id': self.extension.extension_id,
+                    'release_notes': 'These are the release notes',
+                },
+                format='multipart',
+            )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
     def test_version_upload_extension_not_maintained_by_user(self):
         other_user = UserFactory()
         other_extension = create_approved_version(