'An collaborator should not be able to modify the app\'s permissions.'

def test_collaborator_cannot_share(self):

    app_id = u'autotest-1-app'
    owner_token = self.token
    collab = self.user2
    collab_token = self.token2
    url = u'/v1/apps/{}/perms'.format(app_id)
    body = {u'username': collab.username}
    response = self.client.post(url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(owner_token))
    self.assertEqual(response.status_code, 201)
    body = {u'username': self.user3.username}
    response = self.client.post(url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(collab_token))
    self.assertEqual(response.status_code, 403)
    response = self.client.get(url, content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(collab_token))
    self.assertEqual(response.status_code, 200)
    response = self.client.post(url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(owner_token))
    self.assertEqual(response.status_code, 201)
    response = self.client.get(url, content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(collab_token))
    self.assertEqual(response.status_code, 200)
    url += u'/{}'.format(self.user3.username)
    response = self.client.delete(url, HTTP_AUTHORIZATION=u'token    {}'.format(collab_token))
    self.assertEqual(response.status_code, 403)
    url = u'/v1/apps/{}/perms/{}'.format(app_id, collab.username)
    response = self.client.delete(url, HTTP_AUTHORIZATION=u'token    {}'.format(collab_token))
    self.assertEqual(response.status_code, 204)
