Page Comparison

Step

Action

Expected system response

Comment

1

Use devadmin account to check if user without right FACILITIES_MANAGE cannot

GET, PUT, POST & DELETE for: /api/facilities, /api/facilities/{id}, /api/facilityTypes, /api/facilityTypes/{id}, /api/facilityOperators, /api/facilityOperators/{id}

Response Code 403
{
  "messageKey": "referenceData.error.unauthorized",
  "message": "You do not have the following right to perform this action: FACILITIES_MANAGE"
}

For all these endpoints:

post /api/facilities

get /api/facilities/search

delete /api/facilities/{id}

get /api/facilities/{id}

put /api/facilities/{id}

get /api/facilities/{id}/approvedProducts

get /api/facilities/{id}/auditLog

get /api/facilityOperators

post /api/facilityOperators

delete /api/facilityOperators/{id}

get /api/facilityOperators/{id}

put /api/facilityOperators/{id}

post /api/facilityTypeApprovedProducts

delete /api/facilityTypeApprovedProducts/{id}

get /api/facilityTypeApprovedProducts/{id}

put /api/facilityTypeApprovedProducts/{id}

get /api/facilityTypes

post /api/facilityTypes

delete /api/facilityTypes/{id}get

/api/facilityTypes/{id}

put /api/facilityTypes/{id}

2

Use administrator account to check if user with right  FACILITIES_MANAGE canGET, PUT, POST & DELETE for: /api/facilities, /api/facilities/{id}, /api/facilityTypes, /api/facilityTypes/{id}, /api/facilityOperators, /api/facilityOperators/{id}

Response Code

200/201/204 for these endpoints: 

post /api/facilities

get /api/facilities/search

delete /api/facilities/{id}

get /api/facilities/{id}

put /api/facilities/{id}

get /api/facilities/{id}/approvedProducts

get /api/facilities/{id}/auditLog

get /api/facilityOperators

post /api/facilityOperators

delete /api/facilityOperators/{id}

get /api/facilityOperators/{id}

put /api/facilityOperators/{id}

post /api/facilityTypeApprovedProducts

delete /api/facilityTypeApprovedProducts/{id}

get /api/facilityTypeApprovedProducts/{id}

put /api/facilityTypeApprovedProducts/{id}

get /api/facilityTypes

post /api/facilityTypes

delete /api/facilityTypes/{id}get

/api/facilityTypes/{id}

put /api/facilityTypes/{id}

3

4

5

6

7

8