Don't forgot to add a test where you fetch the publications for *another* user and assert that the tickets don't show up (as you should not be able to see them)