   end
 
   test "do not get document as anonymous user" do
-    conn = conn(:get, "/documents/doc-of-proj-b")
-    conn = Api.Router.call(conn, @opts)
-    resp_body = Core.Utils.atomize(Poison.decode!(conn.resp_body))
+    {conn, resp_body} = get_doc "doc-of-proj-b"
 
     assert conn.state == :sent
     assert conn.status == 401

    Poison.decode!(conn.resp_body)["token"]
  end

  defp show_rights token do
    conn = conn(:get, "/auth/show")
      |> put_req_header("authorization", token)
      |> Api.Router.call(@opts)

    Core.Utils.atomize(Poison.decode!(conn.resp_body)).rights.readable_projects
  end
end
  end

  test "show rights" do
    assert show_rights("user-1", "pass-1") == ["a", "b", "c", "d"]
    assert show_rights("user-2", "pass-2") == ["a", "b", "c"]
    assert show_rights("user-3", "pass-3") == ["a", "b"]
  end

  defp sign_in name, pass do
