@@ -152,6 +152,7 @@ Feature: Authorization checking
152
152
And the JSON node "data.securedDummy.relatedDummy" should exist
153
153
And the JSON node "data.securedDummy.relatedDummy" should not be null
154
154
155
+ @v3
155
156
@createSchema
156
157
Scenario : A user can't access a secured collection relation
157
158
Given there are 1 SecuredDummy objects owned by dunglas with related dummies
@@ -175,6 +176,7 @@ Feature: Authorization checking
175
176
And the header "Content-Type" should be equal to "application/json"
176
177
And the JSON node "data.securedDummy.relatedDummies" should be null
177
178
179
+ @v3
178
180
Scenario : A user can't access a secured relation
179
181
When I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg=="
180
182
And I send the following GraphQL request:
@@ -232,6 +234,7 @@ Feature: Authorization checking
232
234
And the JSON node "errors[0].message" should be equal to "Access Denied."
233
235
And the JSON node "data.relatedSecuredDummies" should be null
234
236
237
+ @v3
235
238
Scenario : A user can access a secured collection relation
236
239
When I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg=="
237
240
And I send the following GraphQL request:
@@ -253,6 +256,7 @@ Feature: Authorization checking
253
256
And the header "Content-Type" should be equal to "application/json"
254
257
And the JSON node "data.securedDummy.relatedSecuredDummies" should have 1 element
255
258
259
+ @v3
256
260
Scenario : A user can access a secured relation
257
261
When I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg=="
258
262
And I send the following GraphQL request:
@@ -271,6 +275,7 @@ Feature: Authorization checking
271
275
And the JSON node "data.securedDummy.relatedSecuredDummy" should exist
272
276
And the JSON node "data.securedDummy.relatedSecuredDummy" should not be null
273
277
278
+ @v3
274
279
Scenario : A user can access a non-secured collection relation
275
280
When I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg=="
276
281
And I send the following GraphQL request:
@@ -292,6 +297,7 @@ Feature: Authorization checking
292
297
And the header "Content-Type" should be equal to "application/json"
293
298
And the JSON node "data.securedDummy.publicRelatedSecuredDummies" should have 1 element
294
299
300
+ @v3
295
301
Scenario : A user can access a non-secured relation
296
302
When I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg=="
297
303
When I send the following GraphQL request:
@@ -382,6 +388,7 @@ Feature: Authorization checking
382
388
And the response should be in JSON
383
389
And the JSON node "data.securedDummies.edges[2].node.ownerOnlyProperty" should be equal to "it works"
384
390
391
+ @v3
385
392
Scenario : An admin can't create a secured resource with an owner-only property if they won't be the owner
386
393
When I add "Authorization" header equal to "Basic YWRtaW46a2l0dGVu"
387
394
And I send the following GraphQL request:
@@ -465,6 +472,7 @@ Feature: Authorization checking
465
472
And the JSON node "data.securedDummy.adminOnlyProperty" should exist
466
473
And the JSON node "data.securedDummy.adminOnlyProperty" should not be null
467
474
475
+ @v3
468
476
Scenario : A user can't see a secured admin-only property on an object they own
469
477
When I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg=="
470
478
And I send the following GraphQL request:
@@ -527,6 +535,7 @@ Feature: Authorization checking
527
535
And the response should be in JSON
528
536
And the JSON node "data.securedDummy.ownerOnlyProperty" should be equal to the string "updated"
529
537
538
+ @v3
530
539
Scenario : An admin can't see a secured owner-only property on an object they don't own
531
540
When I add "Authorization" header equal to "Basic YWRtaW46a2l0dGVu"
532
541
And I send the following GraphQL request:
0 commit comments