silverstripe / silverstripe-restfulserver

        Security::setCurrentUser(null);

    }

    public function testApiAccess()

    {

        $comment1 = $this->objFromFixture(RestfulServerTestComment::class, 'comment1');

        $page1 = $this->objFromFixture(RestfulServerTestPage::class, 'page1');

        // normal GET should succeed with $api_access enabled

        $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestComment::class);

        $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $comment1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals(200, $response->getStatusCode());

        $_SERVER['PHP_AUTH_USER'] = '[email protected]';

        $_SERVER['PHP_AUTH_PW'] = 'user';

        // even with logged in user a GET with $api_access disabled should fail

        $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestPage::class);

        $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $page1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals(401, $response->getStatusCode());

        unset($_SERVER['PHP_AUTH_USER']);

        unset($_SERVER['PHP_AUTH_PW']);

    }

    public function testApiAccessBoolean()

    {

        $this->assertContains('<Author', $response->getBody());

    }

    public function testAuthenticatedGET()

    {

        $thing1 = $this->objFromFixture(RestfulServerTestSecretThing::class, 'thing1');

        $comment1 = $this->objFromFixture(RestfulServerTestComment::class, 'comment1');

        // @todo create additional mock object with authenticated VIEW permissions

        $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestSecretThing::class);

        $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $thing1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals(401, $response->getStatusCode());

        $_SERVER['PHP_AUTH_USER'] = '[email protected]';

        $_SERVER['PHP_AUTH_PW'] = 'user';

        $urlSafeClassname = $this->urlSafeClassname(RestfulServerTestComment::class);

        $url = "{$this->baseURI}/api/v1/$urlSafeClassname/" . $comment1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals(200, $response->getStatusCode());

        unset($_SERVER['PHP_AUTH_USER']);

        unset($_SERVER['PHP_AUTH_PW']);

    }

    public function testAuthenticatedPUT()

    {