Open mihaidma opened 6 years ago
I think at the moment all access is denied but you're right in that we should be testing this with authorization id with no policy vs ones with read policy (and perhaps another with an explicit deny policy) and check every endpoint for valid and invalid access around several policies. Only then can we be sure it works correctly and we should prob test at team and org level too.
each test could check valid and invalid with the valid returning 200 and invalid showing a 403