'An unauthorized user should not be able to access an app\'s resources.
If an unauthorized user is trying to scale an app he or she does not have access to, it
should return a 403.'

def test_scale_with_unauthorized_user_returns_403(self):

    url = u'/v1/apps'
    response = self.client.post(url, HTTP_AUTHORIZATION=u'token    {}'.format(self.token))
    self.assertEqual(response.status_code, 201)
    app_id = response.data[u'id']
    url = u'/v1/apps/{app_id}/builds'.format(**locals())
    body = {u'image': u'autotest/example', u'sha': (u'a' * 40), u'procfile': json.dumps({u'web': u'node    server.js', u'worker': u'node    worker.js'})}
    response = self.client.post(url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(self.token))
    unauthorized_user = User.objects.get(username=u'autotest2')
    unauthorized_token = Token.objects.get(user=unauthorized_user).key
    url = u'/v1/apps/{app_id}/scale'.format(**locals())
    body = {u'web': 4}
    response = self.client.post(url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(unauthorized_token))
    self.assertEqual(response.status_code, 403)
