Change: allow super users to impersonate other users

1 files changed, 43 insertions, 0 deletions

diff --git a/yarns/200-super.yarn b/yarns/200-super.yarn
new file mode 100644
index 0000000..d07e451
--- /dev/null
+++ b/yarns/200-super.yarn
@@ -0,0 +1,43 @@
+# A happy path scenario
+
+This scenario does some basic resource management via the Muck API.
+
+    SCENARIO super user
+
+Start Muck. This also sets up access to it for the user by getting an
+access token, which will be used for all requests.
+
+    GIVEN a running Muck
+
+    GIVEN a user tomjon with superuser access
+
+Create a simple resource. Assign it to another user. Remember its id.
+
+    WHEN user tomjon makes request POST /res 
+    ... with header "Muck-User: verence" and body { "foo": "bar" }
+    THEN status code is 201
+    THEN remember resource id as ID
+    THEN remember resource revision as REV1
+    THEN response has header "Muck-Owner: verence"
+
+Retrieve the resource.
+
+    WHEN user tomjon makes request GET /res with header "Muck-Id: ${ID}"
+    THEN status code is 200
+    THEN response body is { "foo": "bar" }
+    THEN response has header "Muck-Id: ${ID}"
+    THEN response has header "Muck-Revision: ${REV1}"
+    THEN response has header "Muck-Owner: verence"
+
+Make sure Verence CAN retrieve, update, or delete the resource.
+
+    WHEN user verence makes request GET /res with header "Muck-Id: ${ID}"
+    THEN status code is 200
+    THEN response body is { "foo": "bar" }
+    THEN response has header "Muck-Id: ${ID}"
+    THEN response has header "Muck-Revision: ${REV1}"
+    THEN response has header "Muck-Owner: verence"
+
+All done.
+
+    FINALLY Muck is stopped