Okay now that we've set up the permissions on our feed API let's go
ahead and test it in the browser okay so load up the terminal or the git
bash window and make sure that the Django development server is running and
is refreshed with the latest changes then let's open up the Google Chrome browser
and you can see that I am currently unauthenticated because I haven't
checked the authorization box in the mod header Chrome extension so let's leave
it unauthenticated and let's just click on the URL again and hit enter to reload
the page you can see that this time because we added the is authenticated or
read-only permission the only thing that we're allowed to do is read the objects
in the API currently there are no objects so it just returns an empty list so
let's try adding authentication back to the mod header Chrome extension and then
refresh the page again you can see that now we're authenticated we have the
ability to create new status objects let's add a new object called new object
and hit post to create the new status object now we're going to test what
happens if we try and modify this object from a different user this is to test
the update own status permission
so I'm going to head over to API forward slash login to
generate a new login token for a different user now I'm currently using
the mark@londonappdev.com user so I'm going to authenticate with brooke@londonappdev.com
password 1 2 3 and you can see that we have a new token here so I'm
just going to copy the contents of this token and then I'm going to add a new
row to the mod headers extension by clicking add request header and we're
going to type authorization as the name and the value is going to be token and
I'm going to paste the token that I added or that we just generated then I'm
going to uncheck the first authorization token
because we only want to use one at a time and I'm going to use the second
then I'm going to head back to the feed API
you can see here that now I am
authenticated as brooke@londonappdev.com so what happens if I head over
to the ID object with the ID of five so I'm going to add five to the URL hit
enter you can see that I'm unable to modify this object because it isn't
assigned to me the user profile doesn't match the ID that I'm currently
authenticated as so let's go and create a new item here so new item hit post and
then go back to the route of the URL and you can see that the user profile 3 is
the user that I'm logged in as so if we were to add forward slash 6 and modify
this object you can see that I can change the text changed text so for
objects that I create I'm able to modify but objects that I didn't create I'm
unable to modify or delete
ok so it appears that our permissions are working
as expected