Start
First story: happy-path passing
First story: first sad-path passing (anonymous access to a protected resource is blocked)
First story: second sad-path passing (null arguments rejected)
Second story: first happy-path passing (allow access to a protected resource for an authenticated user)
REFACTOR: Moved mock authentication expectation to the setUp since it didn't aid readability of the test
Third story: happy-path (allow access to a resource with named users) and first sad-path passing (denay access to same)
REFACTOR: Added tests to drive out the behaviour of Resources and Resource
REFACTOR: Tidied up the nested conditional logic in AuthorizationService#isAllowed and pulled out some meaningful method names to make it more readable
Third-story: happy path for resources with more than one allowed user
Fourth story: First happy-path passing (access for a user who is a member of a group)
REFACTOR: Pulled out the instance variables defining the users, groups etc. into factory methods, exposing the lack of an appropriate equals/hashCode on User
Fourth story: First happy-path extended and added a sad-path (authenticated user, not a member of the correct group)
Fifth story: test written but pending, refactoring of the authorization response is needed to carry extra information (should have started with a micro-type!)
REFACTOR: Wrap the return value of AuthorizationService#isAllowed in a new type AuthorizationResponse
Sixth story: Happy-path passing (failure responses should show the groups with access)