def METHOD_NAME(client, world):
    token = get_token(world, ["chat.read", "foo.bar"])
    r = client.get("/api/v1/worlds/sample/rooms/", HTTP_AUTHORIZATION="Bearer " + token)
    assert r.status_code == 403
    assert r.data["detail"] == "You do not have permission to perform this action."