silverstripe / silverstripe-restfulserver

		'RestfulServerTest_AuthorRating',

	);

	public function testApiAccess() {

		$comment1 = $this->objFromFixture('RestfulServerTest_Comment', 'comment1');

		$page1 = $this->objFromFixture('RestfulServerTest_Page', 'page1');

		// normal GET should succeed with $api_access enabled

		$url = "/api/v1/RestfulServerTest_Comment/" . $comment1->ID;

		$response = Director::test($url, null, null, 'GET');

		$this->assertEquals($response->getStatusCode(), 200);

		$_SERVER['PHP_AUTH_USER'] = '[email protected]';

		$_SERVER['PHP_AUTH_PW'] = 'user';

		// even with logged in user a GET with $api_access disabled should fail

		$url = "/api/v1/RestfulServerTest_Page/" . $page1->ID;

		$response = Director::test($url, null, null, 'GET');

		$this->assertEquals($response->getStatusCode(), 401);

		unset($_SERVER['PHP_AUTH_USER']);

		unset($_SERVER['PHP_AUTH_PW']);

	}

	public function testApiAccessBoolean() {

		$comment1 = $this->objFromFixture('RestfulServerTest_Comment', 'comment1');

		$this->assertContains('<Author', $response->getBody());

	}

	public function testAuthenticatedGET() {

		$thing1 = $this->objFromFixture('RestfulServerTest_SecretThing', 'thing1');

		$comment1 = $this->objFromFixture('RestfulServerTest_Comment', 'comment1');

		// @todo create additional mock object with authenticated VIEW permissions

		$url = "/api/v1/RestfulServerTest_SecretThing/" . $thing1->ID;

		$response = Director::test($url, null, null, 'GET');

		$this->assertEquals($response->getStatusCode(), 401);

		$_SERVER['PHP_AUTH_USER'] = '[email protected]';

		$_SERVER['PHP_AUTH_PW'] = 'user';

		$url = "/api/v1/RestfulServerTest_Comment/" . $comment1->ID;

		$response = Director::test($url, null, null, 'GET');

		$this->assertEquals($response->getStatusCode(), 200);

		unset($_SERVER['PHP_AUTH_USER']);

		unset($_SERVER['PHP_AUTH_PW']);

	}

	public function testAuthenticatedPUT() {

		$comment1 = $this->objFromFixture('RestfulServerTest_Comment', 'comment1');