alphagov/panopticon — pull request #219 by JordanHatch (2014-10-10 10:32:28+00:00)
Title: Override GDS::SSO.test_user with extra permissions

In development, the "mock bearer token" strategy used for API requests returns a user which has only the `signin` permission by default. For requests to change tags to work, this user needs the `manage_tags` permission too.

The easiest way to add this permission is to override the `GDS::SSO.test_user` variable with a new user that has all the necessary permissions. The test user takes precedence over the dummy user [1] so this user will always be selected.

A nice side effect of doing this is that it will no longer be required to have a user in the database when running this app in development, as the `GDS::SSO.test_user` field is checked first.

This file is overwritten on deploy, and the mock GDS::SSO strategies are not requested in production environments, so this will not have an effect on the production behaviour of the app.

[1] https://github.com/alphagov/gds-sso/blob/v9.3.0/lib/gds-sso/bearer_token.rb#L49