feat(manager): allow manager to create auto-approved campaigns and tests from templates

A manager organizes and validates work, so their own campaigns skip the
draft -> submit -> pending_approval queue and go straight to active with
the start_date they provide (they're the same role that would otherwise
approve it). Manager can also now create tests from the catalog, same as
red_lead/blue_lead.

backend/tests/test_campaign_approval_router.py

@@ -346,5 +346,74 @@ def test_create_campaign_payload_has_no_start_date_field(api, db, red_lead_heade
         json={"name": "No date campaign", "start_date": "2026-01-01"},
     )
     assert resp.status_code == 201
-    # start_date silently ignored — only the manager can ever set it, via /approve
+    # start_date silently ignored for a lead — only a manager's own
+    # creation (or a later /approve) can ever set it.
     assert resp.json()["start_date"] is None
+
+
+def test_manager_can_create_campaign_auto_approved(api, db, manager_headers):
+    """A manager is the same role that would otherwise approve a campaign,
+    so their own campaign skips the draft -> submit -> pending_approval
+    queue and goes straight to active with the start_date they provide."""
+    resp = api(
+        "post",
+        "/api/v1/campaigns",
+        manager_headers,
+        json={"name": "Manager-created campaign", "start_date": "2020-01-01T00:00:00"},
+    )
+    assert resp.status_code == 201, resp.text
+    body = resp.json()
+    assert body["status"] == "active"
+    assert body["start_date"] is not None
+
+
+def test_manager_campaign_creation_requires_start_date(api, db, manager_headers):
+    resp = api(
+        "post",
+        "/api/v1/campaigns",
+        manager_headers,
+        json={"name": "Manager-created campaign, no date"},
+    )
+    assert resp.status_code == 400
+
+
+def test_manager_creation_creates_jira_tickets_when_start_date_is_due(api, db, manager_headers):
+    with patch(
+        "app.services.jira_service.get_campaign_jira_key", return_value=None
+    ) as mock_get_key, patch(
+        "app.services.jira_service.auto_create_campaign_issue", return_value="PT-300"
+    ) as mock_create_campaign:
+        resp = api(
+            "post",
+            "/api/v1/campaigns",
+            manager_headers,
+            json={"name": "Manager-created, due now", "start_date": "2020-01-01T00:00:00"},
+        )
+    assert resp.status_code == 201, resp.text
+    mock_get_key.assert_called_once()
+    mock_create_campaign.assert_called_once()
+
+
+def test_manager_creation_skips_jira_tickets_when_start_date_is_future(api, db, manager_headers):
+    with patch(
+        "app.services.jira_service.get_campaign_jira_key", return_value=None
+    ) as mock_get_key:
+        resp = api(
+            "post",
+            "/api/v1/campaigns",
+            manager_headers,
+            json={"name": "Manager-created, future", "start_date": "2099-01-01T00:00:00"},
+        )
+    assert resp.status_code == 201, resp.text
+    mock_get_key.assert_not_called()
+
+
+def test_lead_created_campaign_is_still_draft_not_auto_approved(api, db, red_lead_headers):
+    resp = api(
+        "post",
+        "/api/v1/campaigns",
+        red_lead_headers,
+        json={"name": "Lead-created campaign"},
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["status"] == "draft"

backend/tests/test_manager_creation_permissions.py

@@ -0,0 +1,56 @@
+"""Manager role — creating tests from templates.
+
+A manager organizes and validates work rather than executing it, but they
+should still be able to seed a test from the catalog directly (same as a
+red_lead/blue_lead), not just approve/reject what leads submit.
+"""
+
+
+def test_manager_can_create_test_from_template(api, auth_headers, red_lead_headers, manager_headers):
+    technique = api(
+        "post", "/api/v1/techniques", auth_headers,
+        json={"mitre_id": "T1059.400", "name": "Command Line Manager Test"},
+    )
+    assert technique.status_code == 201, technique.text
+    technique_id = technique.json()["id"]
+
+    template = api(
+        "post", "/api/v1/test-templates", red_lead_headers,
+        json={
+            "mitre_technique_id": "T1059.400",
+            "name": "Manager-usable template",
+            "attack_procedure": "Run a discovery command.",
+        },
+    )
+    assert template.status_code == 201, template.text
+    template_id = template.json()["id"]
+
+    resp = api(
+        "post", "/api/v1/tests/from-template", manager_headers,
+        json={"template_id": template_id, "technique_id": technique_id},
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["name"] == "Manager-usable template"
+
+
+def test_admin_still_cannot_create_test_from_template(api, red_lead_headers, auth_headers):
+    """require_any_role_strict keeps site-admin separate from workflow
+    actions — adding manager to the allow-list must not accidentally
+    reintroduce an admin bypass here."""
+    technique = api(
+        "post", "/api/v1/techniques", auth_headers,
+        json={"mitre_id": "T1059.401", "name": "Command Line Admin Test"},
+    )
+    technique_id = technique.json()["id"]
+
+    template = api(
+        "post", "/api/v1/test-templates", red_lead_headers,
+        json={"mitre_technique_id": "T1059.401", "name": "Admin-blocked template"},
+    )
+    template_id = template.json()["id"]
+
+    resp = api(
+        "post", "/api/v1/tests/from-template", auth_headers,
+        json={"template_id": template_id, "technique_id": technique_id},
+    )
+    assert resp.status_code == 403