Change: GET /work, POST /worker use access token to identify worker

1 files changed, 3 insertions, 2 deletions

diff --git a/yarns/300-workers.yarn b/yarns/300-workers.yarn
index 4e975ea..89444f9 100644
--- a/yarns/300-workers.yarn
+++ b/yarns/300-workers.yarn
@@ -55,10 +55,11 @@ controller API. It doesn't actually talk to the worker itself.
     GIVEN an RSA key pair for token signing
     AND an access token for user with scopes
     ... uapi_workers_get
-    ... uapi_workers_post
     ... uapi_workers_id_get
     ... uapi_workers_id_put
     ... uapi_workers_id_delete
+    AND an access token for obelix with scopes
+    ... uapi_workers_post
     AND controller config uses statedir at the state directory
     AND controller config uses https://blobs.example.com as artifact store
     AND controller config uses https://auth.example.com as authentication
@@ -68,7 +69,7 @@ controller API. It doesn't actually talk to the worker itself.
     THEN result has status code 200
     AND body matches { "workers": [] }
 
-    WHEN user makes request POST /workers with a valid token and body
+    WHEN obelix makes request POST /workers with a valid token and body
     ... {
     ...     "worker": "obelix",
     ...     "protocol": "ssh",