silverstripe / silverstripe-restfulserver

        'RestfulServerTest_AuthorRating',

    );

    public function testApiAccess()

    {

        $comment1 = $this->objFromFixture('RestfulServerTest_Comment', 'comment1');

        $page1 = $this->objFromFixture('RestfulServerTest_Page', 'page1');

        // normal GET should succeed with $api_access enabled

        $url = "/api/v1/RestfulServerTest_Comment/" . $comment1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals($response->getStatusCode(), 200);

        $_SERVER['PHP_AUTH_USER'] = '[email protected]';

        $_SERVER['PHP_AUTH_PW'] = 'user';

        // even with logged in user a GET with $api_access disabled should fail

        $url = "/api/v1/RestfulServerTest_Page/" . $page1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals($response->getStatusCode(), 401);

        unset($_SERVER['PHP_AUTH_USER']);

        unset($_SERVER['PHP_AUTH_PW']);

    }

    public function testApiAccessBoolean()

        $this->assertContains('<Author', $response->getBody());

    }

    public function testAuthenticatedGET()

    {

        $thing1 = $this->objFromFixture('RestfulServerTest_SecretThing', 'thing1');

        $comment1 = $this->objFromFixture('RestfulServerTest_Comment', 'comment1');

        // @todo create additional mock object with authenticated VIEW permissions

        $url = "/api/v1/RestfulServerTest_SecretThing/" . $thing1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals($response->getStatusCode(), 401);

        $_SERVER['PHP_AUTH_USER'] = '[email protected]';

        $_SERVER['PHP_AUTH_PW'] = 'user';

        $url = "/api/v1/RestfulServerTest_Comment/" . $comment1->ID;

        $response = Director::test($url, null, null, 'GET');

        $this->assertEquals($response->getStatusCode(), 200);

        unset($_SERVER['PHP_AUTH_USER']);

        unset($_SERVER['PHP_AUTH_PW']);

    }

    public function testAuthenticatedPUT()