As we add more REST endpoints, the authorization e2e tests seem to become increasingly flaky.
Example (failures on two consecutive rechecks on https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/965682 PS2):
12:44:54 1) Auth
12:44:54 Authorization
12:44:54 Protected entity page
12:44:54 Permission denied - PATCH /entities/items/{item_id}/descriptions:
12:44:54
12:44:54 AssertionError:
12:44:54 7Response body: { en: 'random-test-description-LR5rdLQSeH' }8
12:44:54 Invalid status: expected 200 to equal 403
12:44:54 actual expected
12:44:54
12:44:54 200 403This is likely due to a race condition between the API call protecting the entity under test and the following request that's expected to result in the permission error.
Possible solution: Check the entity protection status prior to making the second request and wait a few milliseconds if it's not protected yet.