access.feature

Story: Users without fiscal admin role accessing Invoices
  In order to ensure users that shouldn't have access to fiscal components don't
  As a user who isn't a fiscal admin
  I should not be able to access Invoices

  Scenario: Users without the fiscal admin role cannot access certain resources
    Given I've log in as a user without the 'fiscal admin' role
    When I try to GET /invoices
    Then I am notified that I do not have access to that

    More Examples:
    | role         | request_method | path                 |
    | fiscal admin | GET            | /grants              |
    | fiscal admin | POST           | /grants/             |
    | fiscal admin | GET            | /grants/1            |
    | fiscal admin | PUT            | /grants/1            |
    | fiscal admin | DELETE         | /grants/1            |
    | fiscal admin | PUT            | /grants/1/deactivate |
    | fiscal admin | PUT            | /grants/1/activate   |
    | fiscal admin | GET            | /appropriations      |
    | fiscal admin | POST           | /appropriations/     |
    | fiscal admin | GET            | /appropriations/1    |
    | fiscal admin | PUT            | /appropriations/1    |