'An unauthorized user should not be able to access an app\'s resources.
Since an unauthorized user can\'t access the application, these
tests should return a 403, but currently return a 404. FIXME!'

def test_unauthorized_user_cannot_see_app(self):

    app_id = u'autotest'
    base_url = u'/v1/apps'
    body = {u'id': app_id}
    response = self.client.post(base_url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(self.token))
    unauthorized_user = User.objects.get(username=u'autotest2')
    unauthorized_token = Token.objects.get(user=unauthorized_user).key
    url = u'{}/{}/run'.format(base_url, app_id)
    body = {u'command': u'foo'}
    response = self.client.post(url, json.dumps(body), content_type=u'application/json', HTTP_AUTHORIZATION=u'token    {}'.format(unauthorized_token))
    self.assertEqual(response.status_code, 403)
    url = u'{}/{}/logs'.format(base_url, app_id)
    response = self.client.get(url, HTTP_AUTHORIZATION=u'token    {}'.format(unauthorized_token))
    self.assertEqual(response.status_code, 403)
    url = u'{}/{}'.format(base_url, app_id)
    response = self.client.get(url, HTTP_AUTHORIZATION=u'token    {}'.format(unauthorized_token))
    self.assertEqual(response.status_code, 403)
    response = self.client.delete(url, HTTP_AUTHORIZATION=u'token    {}'.format(unauthorized_token))
    self.assertEqual(response.status_code, 403)
