Test for multi tenancy in a loopback starter project

test.1.sh

#!/bin/sh

#1.0 setup HOST_URL && make sure that HOST_URL is setup
export HOST_URL=http://localhost:3000 && echo "HOST_URL=$HOST_URL"

#2.0 orgAdminA signs-up
export ORG_ADMIN_A=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/signup" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"email\":\"[email protected]\", \"username\":\"[email protected]\", \"password\":\"orgAdminA\", \"orgName\":\"Org A\"}"` && \
  echo "ORG_ADMIN_A=$ORG_ADMIN_A" && \
export ORG_ADMIN_A_ORG_ID=`echo $ORG_ADMIN_A | \
    jq -r ".orgModelId"` && \
  echo "ORG_ADMIN_A_ORG_ID=$ORG_ADMIN_A_ORG_ID" && \
export ORG_ADMIN_A_ID=`echo $ORG_ADMIN_A | \
    jq -r ".id"` && \
  echo "ORG_ADMIN_A_ID=$ORG_ADMIN_A_ID"

#2.1 orgAdminA logs in
export ORG_ADMIN_A_TOKEN=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/login" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"username\":\"[email protected]\", \"password\":\"orgAdminA\"}" | \
  jq -r ".id"` && \
echo "ORG_ADMIN_A_TOKEN=$ORG_ADMIN_A_TOKEN"

#3.0 orgAdminB signs-up
export ORG_ADMIN_B=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/signup" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"email\":\"[email protected]\", \"username\":\"[email protected]\", \"password\":\"orgAdminB\", \"orgName\":\"Org B\"}"` && \
  echo "ORG_ADMIN_B=$ORG_ADMIN_B" && \
  export ORG_ADMIN_B_ORG_ID=`echo $ORG_ADMIN_B | jq -r ".orgModelId"` && \
    echo "ORG_ADMIN_B_ORG_ID=$ORG_ADMIN_B_ORG_ID" && \
  export ORG_ADMIN_B_ID=`echo $ORG_ADMIN_B | jq -r ".id"` && \
    echo "ORG_ADMIN_B_ID=$ORG_ADMIN_B_ID"

#3.1 orgAdminB logs in
export ORG_ADMIN_B_TOKEN=`curl -X POST \
  "$HOST_URL/api/1.0/UserModels/login" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d "{\"username\":\"[email protected]\", \"password\":\"orgAdminB\"}" | \
  jq -r ".id"`  && \
echo "ORG_ADMIN_B_TOKEN=$ORG_ADMIN_B_TOKEN"

#9.a orgAdminA can create users within its own organization
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "orgUserA1"}'

#9.b orgAdminA can NOT create users in other organizations
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "orgUserB1"}'

#9.c orgAdminA can list all users within its own organization
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#10.1 orgUserA1 logs in
export ORG_USER_A1_TOKEN=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/login" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"username\":\"[email protected]\", \"password\":\"orgUserA1\"}" | \
  jq -r ".id"` && \
echo "ORG_USER_A1_TOKEN=$ORG_USER_A1_TOKEN"

#10.2 orgUserA1 can NOT create other users, this request should fail
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_USER_A1_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "storeAdminA4"}'

#10.4 orgUserA1 can NOT list users within its own organization because its an `orgUser`
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_USER_A1_TOKEN" \
  --header "Content-Type: application/json"

#10.5 orgAdminA can list all users within its own organization because its an `orgAdmin`
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

test.2.sh

#!/bin/sh

#1.0 setup HOST_URL && make sure that HOST_URL is setup
export HOST_URL=http://localhost:3000 && echo "HOST_URL=$HOST_URL"

#2.0 orgAdminA signs-up
export ORG_ADMIN_A=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/signup" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"email\":\"[email protected]\", \"username\":\"[email protected]\", \"password\":\"orgAdminA\", \"orgName\":\"Org A\"}"` && \
  echo "ORG_ADMIN_A=$ORG_ADMIN_A" && \
export ORG_ADMIN_A_ORG_ID=`echo $ORG_ADMIN_A | \
    jq -r ".orgModelId"` && \
  echo "ORG_ADMIN_A_ORG_ID=$ORG_ADMIN_A_ORG_ID" && \
export ORG_ADMIN_A_ID=`echo $ORG_ADMIN_A | \
    jq -r ".id"` && \
  echo "ORG_ADMIN_A_ID=$ORG_ADMIN_A_ID"

#2.1 orgAdminA logs in
export ORG_ADMIN_A_TOKEN=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/login" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"username\":\"[email protected]\", \"password\":\"orgAdminA\"}" | \
  jq -r ".id"` && \
echo "ORG_ADMIN_A_TOKEN=$ORG_ADMIN_A_TOKEN"

#2.2 orgAdminA creates stuff
export ORG_A_STUFF1_ID=`curl -X POST \
    "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?access_token=$ORG_ADMIN_A_TOKEN" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"name\": \"stuff1 for orgA\"}"  | \
  jq -r ".id"`  && \
echo "ORG_A_STUFF1_ID=$ORG_A_STUFF1_ID"

#2.3 orgAdminA can get stuff which is specific to orgA
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels/$ORG_A_STUFF1_ID?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#3.0 orgAdminB signs-up
export ORG_ADMIN_B=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/signup" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"email\":\"[email protected]\", \"username\":\"[email protected]\", \"password\":\"orgAdminB\", \"orgName\":\"Org B\"}"` && \
  echo "ORG_ADMIN_B=$ORG_ADMIN_B" && \
  export ORG_ADMIN_B_ORG_ID=`echo $ORG_ADMIN_B | jq -r ".orgModelId"` && \
    echo "ORG_ADMIN_B_ORG_ID=$ORG_ADMIN_B_ORG_ID" && \
  export ORG_ADMIN_B_ID=`echo $ORG_ADMIN_B | jq -r ".id"` && \
    echo "ORG_ADMIN_B_ID=$ORG_ADMIN_B_ID"

#3.1 orgAdminB logs in
export ORG_ADMIN_B_TOKEN=`curl -X POST \
  "$HOST_URL/api/1.0/UserModels/login" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d "{\"username\":\"[email protected]\", \"password\":\"orgAdminB\"}" | \
  jq -r ".id"`  && \
echo "ORG_ADMIN_B_TOKEN=$ORG_ADMIN_B_TOKEN"

#3.2 orgAdminB creates stuff
export ORG_B_STUFF1_ID=`curl -X POST \
    "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels?access_token=$ORG_ADMIN_B_TOKEN" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"name\": \"stuff1 for orgB\"}"  | \
  jq -r ".id"`  && \
echo "ORG_B_STUFF1_ID=$ORG_B_STUFF1_ID"

#3.3 orgAdminB can get stuff which is specific to orgB
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels/$ORG_B_STUFF1_ID?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Content-Type: application/json"

#4.1 orgAdminA can only LIST stuff which is specific to orgA
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#4.2 orgAdminB can only LIST stuff which is specific to orgB
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Accept: application/json"

#5.1 orgAdminA can NOT use FIND-BY-ID to get stuff from another org
#   SHOULD return 401 with AUTHORIZATION_REQUIRED
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels/$ORG_B_STUFF1_ID?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#5.2 orgAdminB can NOT use FIND-BY-ID to get stuff from another org
#   SHOULD return 401 with AUTHORIZATION_REQUIRED
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels/$ORG_A_STUFF1_ID?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Content-Type: application/json"

#6.1 orgAdminA can NOT access StuffModel directly
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/StuffModels?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Accept: application/json"

#6.2 orgAdminB can NOT access StuffModel directly
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/StuffModels?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Accept: application/json"

#7 orgAdminA can only FIND stuff which is specific to orgA
#  filter={"where":{"name":{"like":"stuff"}}}
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?filter=%7B%22where%22%3A%7B%22name%22%3A%7B%22like%22%3A%22stuff%22%7D%7D%7D&access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Accept: application/json"

#9.a orgAdminA can create users within its own organization
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "orgUserA1"}'

#9.b orgAdminA can NOT create users in other organizations
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "orgUserB1"}'

#9.c orgAdminA can list all users within its own organization
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#10.1 orgUserA1 logs in
export ORG_USER_A1_TOKEN=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/login" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"username\":\"[email protected]\", \"password\":\"orgUserA1\"}" | \
  jq -r ".id"` && \
echo "ORG_USER_A1_TOKEN=$ORG_USER_A1_TOKEN"

#10.2 orgUserA1 can NOT create other users, this request should fail
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_USER_A1_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "storeAdminA4"}'

#10.3 orgUserA1 can LIST stuff which is specific to orgA
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?access_token=$ORG_USER_A1_TOKEN" \
  --header "Accept: application/json"

#10.4 orgUserA1 can NOT list users within its own organization because its an `orgUser`
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_USER_A1_TOKEN" \
  --header "Content-Type: application/json"

#10.5 orgAdminA can list all users within its own organization because its an `orgAdmin`
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

test.sh

#!/bin/sh

echo "###"
echo Its best to invoke this script as: '. ./test.sh' rather than './test.sh'
echo "###"

#1.0 setup HOST_URL && make sure that HOST_URL is setup
export HOST_URL=http://localhost:3000 && echo "HOST_URL=$HOST_URL"

#2.0 orgAdminA signs-up
export ORG_ADMIN_A=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/signup" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"email\":\"[email protected]\", \"username\":\"[email protected]\", \"password\":\"orgAdminA\", \"orgName\":\"Org A\"}"` && \
  echo "ORG_ADMIN_A=$ORG_ADMIN_A" && \
export ORG_ADMIN_A_ORG_ID=`echo $ORG_ADMIN_A | \
    jq -r ".orgModelId"` && \
  echo "ORG_ADMIN_A_ORG_ID=$ORG_ADMIN_A_ORG_ID" && \
export ORG_ADMIN_A_ID=`echo $ORG_ADMIN_A | \
    jq -r ".id"` && \
  echo "ORG_ADMIN_A_ID=$ORG_ADMIN_A_ID"

#2.1 orgAdminA logs in
export ORG_ADMIN_A_TOKEN=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/login" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"username\":\"[email protected]\", \"password\":\"orgAdminA\"}" | \
  jq -r ".id"` && \
echo "ORG_ADMIN_A_TOKEN=$ORG_ADMIN_A_TOKEN"

#2.2 orgAdminA creates stuff
export ORG_A_STUFF1_ID=`curl -X POST \
    "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?access_token=$ORG_ADMIN_A_TOKEN" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"name\": \"stuff1 for orgA\"}"  | \
  jq -r ".id"`  && \
echo "ORG_A_STUFF1_ID=$ORG_A_STUFF1_ID"

#2.3 orgAdminA can get stuff which is specific to orgA
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels/$ORG_A_STUFF1_ID?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#3.0 orgAdminB signs-up
export ORG_ADMIN_B=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/signup" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"email\":\"[email protected]\", \"username\":\"[email protected]\", \"password\":\"orgAdminB\", \"orgName\":\"Org B\"}"` && \
  echo "ORG_ADMIN_B=$ORG_ADMIN_B" && \
  export ORG_ADMIN_B_ORG_ID=`echo $ORG_ADMIN_B | jq -r ".orgModelId"` && \
    echo "ORG_ADMIN_B_ORG_ID=$ORG_ADMIN_B_ORG_ID" && \
  export ORG_ADMIN_B_ID=`echo $ORG_ADMIN_B | jq -r ".id"` && \
    echo "ORG_ADMIN_B_ID=$ORG_ADMIN_B_ID"

#3.1 orgAdminB logs in
export ORG_ADMIN_B_TOKEN=`curl -X POST \
  "$HOST_URL/api/1.0/UserModels/login" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d "{\"username\":\"[email protected]\", \"password\":\"orgAdminB\"}" | \
  jq -r ".id"`  && \
echo "ORG_ADMIN_B_TOKEN=$ORG_ADMIN_B_TOKEN"

#3.2 orgAdminB creates stuff
export ORG_B_STUFF1_ID=`curl -X POST \
    "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels?access_token=$ORG_ADMIN_B_TOKEN" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"name\": \"stuff1 for orgB\"}"  | \
  jq -r ".id"`  && \
echo "ORG_B_STUFF1_ID=$ORG_B_STUFF1_ID"

#3.3 orgAdminB can get stuff which is specific to orgB
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels/$ORG_B_STUFF1_ID?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Content-Type: application/json"

#4.1 orgAdminA can only LIST stuff which is specific to orgA
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#4.2 orgAdminB can only LIST stuff which is specific to orgB
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Accept: application/json"

#5.1 orgAdminA can NOT use FIND-BY-ID to get stuff from another org
#   SHOULD return 401 with AUTHORIZATION_REQUIRED
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/stuffModels/$ORG_B_STUFF1_ID?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#5.2 orgAdminB can NOT use FIND-BY-ID to get stuff from another org
#   SHOULD return 401 with AUTHORIZATION_REQUIRED
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels/$ORG_A_STUFF1_ID?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Content-Type: application/json"

#6.1 orgAdminA can NOT access StuffModel directly
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/StuffModels?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Accept: application/json"

#6.2 orgAdminB can NOT access StuffModel directly
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/StuffModels?access_token=$ORG_ADMIN_B_TOKEN" \
  --header "Accept: application/json"

#7 orgAdminA can only FIND stuff which is specific to orgA
#  filter={"where":{"name":{"like":"stuff"}}}
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?filter=%7B%22where%22%3A%7B%22name%22%3A%7B%22like%22%3A%22stuff%22%7D%7D%7D&access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Accept: application/json"

#8.1 A user can get its own user-profile data
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/UserModels/$ORG_ADMIN_A_ID/profile?access_token=$ORG_ADMIN_A_TOKEN"

#8.2 A user can NOT get someone else's user-profile data
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/UserModels/$ORG_ADMIN_A_ID/profile?access_token=$ORG_ADMIN_B_TOKEN"

#9.a orgAdminA can create users within its own organization
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "orgUserA1"}'

#9.b orgAdminA can NOT create users in other organizations
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_B_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "orgUserB1"}'

#9.c orgAdminA can list all users within its own organization
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"

#10.1 orgUserA1 logs in
export ORG_USER_A1_TOKEN=`curl -X POST \
    "$HOST_URL/api/1.0/UserModels/login" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    -d "{\"username\":\"[email protected]\", \"password\":\"orgUserA1\"}" | \
  jq -r ".id"` && \
echo "ORG_USER_A1_TOKEN=$ORG_USER_A1_TOKEN"

#10.2 orgUserA1 can NOT create other users, this request should fail
curl -w "\n" \
  -X POST \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_USER_A1_TOKEN" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  -d '{"username": "[email protected]", "email": "[email protected]", "password": "storeAdminA4"}'

#10.3 orgUserA1 can LIST stuff which is specific to orgA
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/stuffModels?access_token=$ORG_USER_A1_TOKEN" \
  --header "Accept: application/json"

#10.4 orgUserA1 can NOT list users within its own organization because its an `orgUser`
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_USER_A1_TOKEN" \
  --header "Content-Type: application/json"

#10.5 orgAdminA can list all users within its own organization because its an `orgAdmin`
curl -w "\n" \
  -X GET \
  "$HOST_URL/api/1.0/OrgModels/$ORG_ADMIN_A_ORG_ID/users?access_token=$ORG_ADMIN_A_TOKEN" \
  --header "Content-Type: application/json"