Merge pull request #2716 from Micheleboychuk/DS-4411-newlyCreatedUsersHaveNoSpecialRights

DS-4411 Create Integration Tests to prove newly created users have no special rights

dspace-server-webapp/src/test/java/org/dspace/app/rest/BitstreamControllerIT.java

@@ -351,6 +351,61 @@ public class BitstreamControllerIT extends AbstractControllerIntegrationTest {
 
     }
 
+    @Test
+    public void putOnBitstreamInOneBundleForbiddenTest() throws Exception {
+
+        context.turnOffAuthorisationSystem();
+
+        parentCommunity = CommunityBuilder.createCommunity(context)
+                                          .withName("Parent Community")
+                                          .build();
+        Community child1 = CommunityBuilder.createSubCommunity(context, parentCommunity)
+                                           .withName("Sub Community")
+                                           .build();
+        Collection col1 = CollectionBuilder.createCollection(context, child1).withName("Collection 1").build();
+
+        Item publicItem1 = ItemBuilder.createItem(context, col1)
+                                      .withTitle("Test")
+                                      .withIssueDate("2016-11-11")
+                                      .withAuthor("Smith, Donald")
+                                      .withSubject("ExtraEntry")
+                                      .build();
+
+        Item targetItem = ItemBuilder.createItem(context, col1)
+                                     .withTitle("Test")
+                                     .withIssueDate("2016-11-11")
+                                     .withAuthor("Smith, Donald")
+                                     .withSubject("ExtraEntry")
+                                     .build();
+
+
+        Bundle bundle1 = BundleBuilder.createBundle(context, publicItem1)
+                                      .withName("TEST FIRST BUNDLE")
+                                      .build();
+
+        Bundle targetBundle = BundleBuilder.createBundle(context, targetItem)
+                                           .withName("TARGET BUNDLE")
+                                           .build();
+
+        String bitstreamContent = "ThisIsSomeDummyText";
+        Bitstream bitstream = null;
+        try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
+            bitstream = BitstreamBuilder.createBitstream(context, bundle1, is)
+                                        .withName("Bitstream")
+                                        .withDescription("description")
+                                        .withMimeType("text/plain")
+                                        .build();
+        }
+
+        context.restoreAuthSystemState();
+        String token = getAuthToken(eperson.getEmail(), password);
+
+        getClient(token).perform(put("/api/core/bitstreams/" + bitstream.getID() + "/bundle")
+                        .contentType(parseMediaType(TEXT_URI_LIST_VALUE))
+                        .content("https://localhost:8080/spring-rest/api/core/bundles/" + targetBundle.getID()))
+                        .andExpect(status().isForbidden());
+    }
+
     @Test
     public void putOnBitstreamInMultipleBundles() throws Exception {
 

dspace-server-webapp/src/test/java/org/dspace/app/rest/BundleRestRepositoryIT.java

@@ -45,6 +45,7 @@ import org.dspace.app.rest.model.patch.MoveOperation;
 import org.dspace.app.rest.model.patch.Operation;
 import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
 import org.dspace.authorize.ResourcePolicy;
+import org.dspace.authorize.service.ResourcePolicyService;
 import org.dspace.content.Bitstream;
 import org.dspace.content.Bundle;
 import org.dspace.content.Collection;
@@ -54,10 +55,14 @@ import org.dspace.eperson.EPerson;
 import org.hamcrest.Matchers;
 import org.junit.Before;
 import org.junit.Test;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.test.web.servlet.MvcResult;
 
 public class BundleRestRepositoryIT extends AbstractControllerIntegrationTest {
 
+    @Autowired
+    ResourcePolicyService resourcePolicyService;
+
     private Collection collection;
     private Item item;
     private Bundle bundle1;
@@ -136,6 +141,30 @@ public class BundleRestRepositoryIT extends AbstractControllerIntegrationTest {
         ;
     }
 
+    @Test
+    public void findOneForbiddenTest() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        String bitstreamContent = "Dummy content";
+        try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
+            bitstream1 = BitstreamBuilder.createBitstream(context, item, is)
+                                         .withName("Bitstream")
+                                         .withMimeType("text/plain")
+                                         .build();
+        }
+
+        bundle1 = BundleBuilder.createBundle(context, item)
+                               .withName("testname")
+                               .withBitstream(bitstream1)
+                               .build();
+
+        resourcePolicyService.removePolicies(context, bundle1, Constants.READ);
+        context.restoreAuthSystemState();
+
+        String tokenEperson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEperson).perform(get("/api/core/bundles/" + bundle1.getID()))
+                .andExpect(status().isForbidden());
+    }
 
     @Test
     public void getItemBundles() throws Exception {
@@ -385,6 +414,38 @@ public class BundleRestRepositoryIT extends AbstractControllerIntegrationTest {
                    )));
     }
 
+    @Test
+    public void getBitstreamsForBundleForbiddenTest() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        String bitstreamContent = "Dummy content";
+        try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
+            bitstream1 = BitstreamBuilder.createBitstream(context, item, is)
+                                         .withName("Bitstream")
+                                         .withDescription("Description")
+                                         .withMimeType("text/plain")
+                                         .build();
+            bitstream2 = BitstreamBuilder.createBitstream(context, item, is)
+                                         .withName("Bitstream2")
+                                         .withDescription("Description2")
+                                         .withMimeType("text/plain")
+                                         .build();
+        }
+
+        bundle1 = BundleBuilder.createBundle(context, item)
+                               .withName("testname")
+                               .withBitstream(bitstream1)
+                               .withBitstream(bitstream2)
+                               .build();
+
+        resourcePolicyService.removePolicies(context, bundle1, Constants.READ);
+        context.restoreAuthSystemState();
+
+        String tokenEperson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEperson).perform(get("/api/core/bundles/" + bundle1.getID() + "/bitstreams"))
+                   .andExpect(status().isForbidden());
+    }
+
     @Test
     public void patchMoveBitstreams() throws Exception {
         context.turnOffAuthorisationSystem();

dspace-server-webapp/src/test/java/org/dspace/app/rest/EPersonRestRepositoryIT.java

@@ -235,6 +235,28 @@ public class EPersonRestRepositoryIT extends AbstractControllerIntegrationTest {
 
     }
 
+    @Test
+    public void findOneForbiddenTest() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        EPerson ePerson1 = EPersonBuilder.createEPerson(context)
+                .withNameInMetadata("Mik", "Reck")
+                .withEmail("MikReck@email.com")
+                .withPassword("qwerty01")
+                .build();
+
+        EPerson ePerson2 = EPersonBuilder.createEPerson(context)
+                .withNameInMetadata("Bob", "Smith")
+                .withEmail("bobsmith@fake-email.com")
+                .build();
+
+        context.restoreAuthSystemState();
+
+        String tokenEperson1 = getAuthToken(ePerson1.getEmail(), "qwerty01");
+        getClient(tokenEperson1).perform(get("/api/eperson/epersons/" + ePerson2.getID()))
+                .andExpect(status().isForbidden());
+    }
+
     @Test
     public void readEpersonAuthorizationTest() throws Exception {
         context.turnOffAuthorisationSystem();
@@ -1494,6 +1516,31 @@ public class EPersonRestRepositoryIT extends AbstractControllerIntegrationTest {
         new MetadataPatchSuite().runWith(getClient(token), "/api/eperson/epersons/" + ePerson.getID(), expectedStatus);
     }
 
+    @Test
+    public void newlyCreatedAccountHasNoGroups() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        EPerson ePerson1 = EPersonBuilder.createEPerson(context)
+                .withNameInMetadata("Mik", "Reck")
+                .withEmail("MikReck@email.com")
+                .withPassword("qwerty01")
+                .build();
+
+        context.restoreAuthSystemState();
+
+        String tokenEperson1 = getAuthToken(ePerson1.getEmail(), "qwerty01");
+        // by contract the groups embedded in the eperson only contains direct explicit membership,
+        // so the anonymous group is not listed
+        getClient(tokenEperson1).perform(get("/api/eperson/epersons/" + ePerson1.getID())
+                .param("projection", "full"))
+                .andExpect(status().isOk())
+                .andExpect(content().contentType(contentType))
+                .andExpect(jsonPath("$", Matchers.allOf(
+                        hasJsonPath("$._embedded.groups._embedded.groups.length()", is(0)),
+                        hasJsonPath("$._embedded.groups.page.totalElements", is(0))
+                )));
+    }
+
     /**
      * Test that epersons/<:uuid>/groups endpoint returns the direct groups of the epersons
      * @throws Exception
@@ -1543,5 +1590,4 @@ public class EPersonRestRepositoryIT extends AbstractControllerIntegrationTest {
                             );
 
     }
-
 }

dspace-server-webapp/src/test/java/org/dspace/app/rest/GroupRestRepositoryIT.java

@@ -36,9 +36,11 @@ import org.dspace.app.rest.model.MetadataRest;
 import org.dspace.app.rest.model.MetadataValueRest;
 import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
 import org.dspace.app.rest.test.MetadataPatchSuite;
+import org.dspace.authorize.service.ResourcePolicyService;
 import org.dspace.content.Community;
 import org.dspace.content.factory.ContentServiceFactory;
 import org.dspace.content.service.CommunityService;
+import org.dspace.core.Constants;
 import org.dspace.eperson.EPerson;
 import org.dspace.eperson.Group;
 import org.dspace.eperson.factory.EPersonServiceFactory;
@@ -46,6 +48,7 @@ import org.dspace.eperson.service.EPersonService;
 import org.dspace.eperson.service.GroupService;
 import org.hamcrest.Matchers;
 import org.junit.Test;
+import org.springframework.beans.factory.annotation.Autowired;
 
 /**
  * @author Jonas Van Goolen - (jonas@atmire.com)
@@ -53,6 +56,9 @@ import org.junit.Test;
 
 public class GroupRestRepositoryIT extends AbstractControllerIntegrationTest {
 
+    @Autowired
+    ResourcePolicyService resourcePolicyService;
+
     @Test
     public void createTest()
         throws Exception {
@@ -186,6 +192,13 @@ public class GroupRestRepositoryIT extends AbstractControllerIntegrationTest {
         ;
     }
 
+    @Test
+    public void findAllForbiddenTest() throws Exception {
+        String tokenEperson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEperson).perform(get("/api/eperson/groups"))
+                   .andExpect(status().isForbidden());
+    }
+
     @Test
     public void findAllPaginationTest() throws Exception {
 
@@ -295,6 +308,22 @@ public class GroupRestRepositoryIT extends AbstractControllerIntegrationTest {
                                         Matchers.containsString("/api/eperson/groups/" + group2.getID())));
     }
 
+    @Test
+    public void findOneForbiddenTest() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        Group privateGroup = GroupBuilder.createGroup(context)
+                .withName("Private Group")
+                .build();
+
+        resourcePolicyService.removePolicies(context, privateGroup, Constants.READ);
+        context.restoreAuthSystemState();
+
+        String tokenEperson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEperson).perform(get("/api/eperson/groups/" + privateGroup.getID()))
+                .andExpect(status().isForbidden());
+    }
+
     @Test
     public void findOneTestWrongUUID() throws Exception {
         context.turnOffAuthorisationSystem();

dspace-server-webapp/src/test/java/org/dspace/app/rest/ItemOwningCollectionUpdateRestControllerIT.java

@@ -283,4 +283,34 @@ public class ItemOwningCollectionUpdateRestControllerIT extends AbstractControll
 
 
     }
+
+    @Test
+    public void moveItemForbiddenTest() throws Exception {
+        context.turnOffAuthorisationSystem();
+
+        parentCommunity = CommunityBuilder.createCommunity(context)
+                                   .withName("Parent Community")
+                                   .build();
+        Collection col1 = CollectionBuilder.createCollection(context, parentCommunity)
+                                    .withName("Collection 1")
+                                    .build();
+        Collection col2 = CollectionBuilder.createCollection(context, parentCommunity)
+                                    .withName("Collection 2")
+                                    .build();
+
+        Item publicItem1 = ItemBuilder.createItem(context, col1)
+                                    .withTitle("Public item 1")
+                                    .withIssueDate("2019-10-21")
+                                    .withAuthor("Smith, Donald")
+                                    .build();
+
+        context.restoreAuthSystemState();
+
+        String tokenEPerson = getAuthToken(eperson.getEmail(), password);
+
+        getClient(tokenEPerson).perform(put("/api/core/items/" + publicItem1.getID() + "/owningCollection/")
+                               .contentType(parseMediaType(TEXT_URI_LIST_VALUE))
+                               .content("https://localhost:8080/spring-rest/api/core/collections/" + col2.getID()))
+                               .andExpect(status().isForbidden());
+    }
 }

dspace-server-webapp/src/test/java/org/dspace/app/rest/ItemRestRepositoryIT.java

@@ -123,6 +123,13 @@ public class ItemRestRepositoryIT extends AbstractControllerIntegrationTest {
         ;
     }
 
+    @Test
+    public void findAllForbiddenTest() throws Exception {
+        String tokenEperson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEperson).perform(get("/api/core/items"))
+                .andExpect(status().isForbidden());
+    }
+
     @Test
     public void findAllWithPaginationTest() throws Exception {
         context.turnOffAuthorisationSystem();

dspace-server-webapp/src/test/java/org/dspace/app/rest/ItemTemplateRestControllerIT.java

@@ -32,14 +32,20 @@ import org.dspace.app.rest.model.patch.AddOperation;
 import org.dspace.app.rest.model.patch.Operation;
 import org.dspace.app.rest.model.patch.ReplaceOperation;
 import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
+import org.dspace.authorize.service.ResourcePolicyService;
 import org.dspace.content.Collection;
+import org.dspace.core.Constants;
 import org.hamcrest.Matchers;
 import org.junit.Before;
 import org.junit.Test;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.test.web.servlet.MvcResult;
 
 public class ItemTemplateRestControllerIT extends AbstractControllerIntegrationTest {
 
+    @Autowired
+    ResourcePolicyService  resourcePolicyService;
+
     private ObjectMapper mapper;
     private String adminAuthToken;
     private Collection childCollection;
@@ -160,6 +166,17 @@ public class ItemTemplateRestControllerIT extends AbstractControllerIntegrationT
                                  )));
     }
 
+    @Test
+    public void getTemplateItemFromCollectionForbiddenTest() throws Exception {
+        setupTestTemplate();
+        String itemUuidString = installTestTemplate();
+
+        resourcePolicyService.removePolicies(context, childCollection, Constants.READ);
+        String tokenEperson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEperson).perform(get(getCollectionTemplateItemUrlTemplate(childCollection.getID().toString())))
+                .andExpect(status().isForbidden());
+    }
+
     @Test
     public void getTemplateItemFromItemId() throws Exception {
         setupTestTemplate();

dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionDefinitionsControllerIT.java

@@ -8,6 +8,7 @@
 package org.dspace.app.rest;
 
 import static com.jayway.jsonpath.matchers.JsonPathMatchers.hasJsonPath;
+import static org.dspace.app.rest.test.AbstractControllerIntegrationTest.REST_SERVER_URL;
 import static org.hamcrest.Matchers.allOf;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
 import static org.hamcrest.Matchers.hasSize;
@@ -62,6 +63,22 @@ public class SubmissionDefinitionsControllerIT extends AbstractControllerIntegra
         ;
     }
 
+    @Test
+    public void findAllWithNewlyCreatedAccountTest() throws Exception {
+        String token = getAuthToken(eperson.getEmail(), password);
+        getClient(token).perform(get("/api/config/submissiondefinitions"))
+                .andExpect(status().isOk())
+                .andExpect(content().contentType(contentType))
+                .andExpect(jsonPath("$.page.size", is(20)))
+                .andExpect(jsonPath("$.page.totalElements", greaterThanOrEqualTo(1)))
+                .andExpect(jsonPath("$.page.totalPages", greaterThanOrEqualTo(1)))
+                .andExpect(jsonPath("$.page.number", is(0)))
+                .andExpect(jsonPath("$._links.search.href", is(REST_SERVER_URL
+                                  + "config/submissiondefinitions/search")))
+                //The array of browse index should have a size greater or equals to 1
+                .andExpect(jsonPath("$._embedded.submissiondefinitions", hasSize(greaterThanOrEqualTo(1))));
+    }
+
     @Test
     public void findDefault() throws Exception {
         getClient().perform(get("/api/config/submissiondefinitions/traditional"))
@@ -84,6 +101,19 @@ public class SubmissionDefinitionsControllerIT extends AbstractControllerIntegra
         ;
     }
 
+    @Test
+    public void findOneWithNewlyCreatedAccountTest() throws Exception {
+        String tokenEPerson = getAuthToken(eperson.getEmail(), password);
+        getClient(tokenEPerson).perform(get("/api/config/submissiondefinitions/traditional"))
+                .andExpect(status().isOk())
+                .andExpect(content().contentType(contentType))
+                .andExpect(jsonPath("$", allOf(
+                        hasJsonPath("$.isDefault", is(true)),
+                        hasJsonPath("$.name", is("traditional")),
+                        hasJsonPath("$.id", is("traditional")),
+                        hasJsonPath("$.type", is("submissiondefinition")))));
+    }
+
     @Test
     public void findByCollection() throws Exception {
 
@@ -117,6 +147,29 @@ public class SubmissionDefinitionsControllerIT extends AbstractControllerIntegra
                        .matchSubmissionDefinition(true, "traditional", "traditional")));
     }
 
+    @Test
+    public void findByCollectionWithNewlyCreatedAccountTest() throws Exception {
+
+        context.turnOffAuthorisationSystem();
+
+        parentCommunity = CommunityBuilder.createCommunity(context)
+                .withName("Community")
+                .build();
+
+        Collection col1 = CollectionBuilder.createCollection(context, parentCommunity)
+                .withName("Collection 1")
+                .build();
+
+        String token = getAuthToken(eperson.getEmail(), password);
+        getClient(token).perform(get("/api/config/submissiondefinitions/search/findByCollection")
+                .param("uuid", col1.getID().toString()))
+                .andExpect(status().isOk())
+                .andDo(MockMvcResultHandlers.print())
+                .andExpect(content().contentType(contentType))
+                .andExpect(jsonPath("$", SubmissionDefinitionsMatcher
+                       .matchSubmissionDefinition(true, "traditional", "traditional")));
+    }
+
     @Test
     public void findCollections() throws Exception {
 

dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionFormsControllerIT.java

@@ -55,6 +55,21 @@ public class SubmissionFormsControllerIT extends AbstractControllerIntegrationTe
         ;
     }
 
+    @Test
+    public void findAllWithNewlyCreatedAccountTest() throws Exception {
+        String token = getAuthToken(eperson.getEmail(), password);
+        getClient(token).perform(get("/api/config/submissionforms"))
+                .andExpect(status().isOk())
+                .andExpect(content().contentType(contentType))
+                .andExpect(jsonPath("$.page.size", is(20)))
+                .andExpect(jsonPath("$.page.totalElements", equalTo(4)))
+                .andExpect(jsonPath("$.page.totalPages", equalTo(1)))
+                .andExpect(jsonPath("$.page.number", is(0)))
+                .andExpect(jsonPath("$._links.self.href", Matchers.startsWith(REST_SERVER_URL
+                           + "config/submissionforms")))
+                .andExpect(jsonPath("$._embedded.submissionforms", hasSize(equalTo(4))));
+    }
+
     @Test
     public void findTraditionalPageOne() throws Exception {
         //When we call the root endpoint as anonymous user
@@ -96,6 +111,34 @@ public class SubmissionFormsControllerIT extends AbstractControllerIntegrationTe
         ;
     }
 
+    @Test
+    public void findTraditionalPageOneWithNewlyCreatedAccountTest() throws Exception {
+        String token = getAuthToken(eperson.getEmail(), password);
+        getClient(token).perform(get("/api/config/submissionforms/traditionalpageone"))
+                   .andExpect(status().isOk())
+                   .andExpect(content().contentType(contentType))
+                   .andExpect(jsonPath("$.id", is("traditionalpageone")))
+                   .andExpect(jsonPath("$.name", is("traditionalpageone")))
+                   .andExpect(jsonPath("$.type", is("submissionform")))
+                   .andExpect(jsonPath("$._links.self.href", Matchers
+                       .startsWith(REST_SERVER_URL + "config/submissionforms/traditionalpageone")))
+                   .andExpect(jsonPath("$.rows[0].fields", contains(
+                        SubmissionFormFieldMatcher.matchFormFieldDefinition("name", "Author",
+                          null, true,"Add an author", "dc.contributor.author"))))
+                   .andExpect(jsonPath("$.rows[1].fields", contains(
+                        SubmissionFormFieldMatcher.matchFormFieldDefinition("onebox", "Title",
+                                "You must enter a main title for this item.", false,
+                                "Enter the main title of the item.", "dc.title"))))
+                   .andExpect(jsonPath("$.rows[3].fields",contains(
+                                SubmissionFormFieldMatcher.matchFormFieldDefinition("date", "Date of Issue",
+                                        "You must enter at least the year.", false,
+                                        "Please give the date", "col-sm-4",
+                                        "dc.date.issued"),
+                                SubmissionFormFieldMatcher.matchFormFieldDefinition("onebox", "Publisher",
+                                        null, false,"Enter the name of",
+                                        "col-sm-8","dc.publisher"))));
+    }
+
     @Test
     public void findOpenRelationshipConfig() throws Exception {
         String token = getAuthToken(admin.getEmail(), password);

dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionSectionsControllerIT.java

@@ -33,7 +33,7 @@ public class SubmissionSectionsControllerIT extends AbstractControllerIntegratio
                    .andExpect(status().isUnauthorized());
 
 
-        String token = getAuthToken(admin.getEmail(), password);
+        String token = getAuthToken(eperson.getEmail(), password);
 
         //When we call the root endpoint
         getClient(token).perform(get("/api/config/submissionsections"))

dspace-server-webapp/src/test/java/org/dspace/app/rest/SubmissionUploadsControllerIT.java

@@ -54,4 +54,19 @@ public class SubmissionUploadsControllerIT extends AbstractControllerIntegration
                    .andExpect(jsonPath("$._embedded.submissionuploads", hasSize(greaterThanOrEqualTo(1))))
         ;
     }
+
+    @Test
+    public void findAllWithNewlyCreatedAccountTest() throws Exception {
+        String token = getAuthToken(eperson.getEmail(), password);
+        getClient(token).perform(get("/api/config/submissionuploads"))
+                   .andExpect(status().isOk())
+                   .andExpect(content().contentType(contentType))
+                   .andExpect(jsonPath("$.page.size", is(20)))
+                   .andExpect(jsonPath("$.page.totalElements", greaterThanOrEqualTo(1)))
+                   .andExpect(jsonPath("$.page.totalPages", greaterThanOrEqualTo(1)))
+                   .andExpect(jsonPath("$.page.number", is(0)))
+                   .andExpect(jsonPath("$._links.self.href",
+                                       Matchers.startsWith(REST_SERVER_URL + "config/submissionuploads")))
+                   .andExpect(jsonPath("$._embedded.submissionuploads", hasSize(greaterThanOrEqualTo(1))));
+    }
 }

dspace-server-webapp/src/test/java/org/dspace/app/rest/ViewEventRestRepositoryIT.java

@@ -453,7 +453,7 @@ public class ViewEventRestRepositoryIT extends AbstractControllerIntegrationTest
 
 
     @Test
-    public void postTestAuthenticatedUserSucces() throws Exception {
+    public void postTestAuthenticatedUserSuccess() throws Exception {
 
         context.turnOffAuthorisationSystem();
 
@@ -485,7 +485,7 @@ public class ViewEventRestRepositoryIT extends AbstractControllerIntegrationTest
 
         ObjectMapper mapper = new ObjectMapper();
 
-        String token = getAuthToken(admin.getEmail(), password);
+        String token = getAuthToken(eperson.getEmail(), password);
 
         getClient(token).perform(post("/api/statistics/viewevents")
                                 .content(mapper.writeValueAsBytes(viewEventRest))