Change: allow only owner to see, update, delete a resource

1 files changed, 13 insertions, 0 deletions

diff --git a/yarns/100-happy.yarn b/yarns/100-happy.yarn
index 5a5ba32..88b29a5 100644
--- a/yarns/100-happy.yarn
+++ b/yarns/100-happy.yarn
@@ -36,6 +36,19 @@ Retrieve the resource.
     THEN response has header "Muck-Revision: ${REV1}"
     THEN response has header "Muck-Owner: tomjon"
 
+Make sure another user can't retreive, update, or delete the resource.
+
+    WHEN user verence makes request GET /res with header "Muck-Id: ${ID}"
+    THEN status code is 404
+
+    WHEN user verence makes request PUT /res with header "Muck-Id: ${ID}" and
+    ... header "Muck-Revision: ${REV1}" and
+    ... body { "foo": "foobar" }
+    THEN status code is 404
+
+    WHEN user verence makes request DELETE /res with header "Muck-Id: ${ID}"
+    THEN status code is 404
+
 Update the resource.
 
     WHEN user tomjon makes request PUT /res with header "Muck-Id: ${ID}" and