Revert "Reorder tests and reference the spec"

This reverts commit 0d760ea.

Author: kjetilk

test/integration/authentication-oidc-test.js

@@ -144,12 +144,7 @@ describe('Authentication API (OIDC)', () => {
         expect(cookie).to.match(/Secure/)
       })
 
-      /* Reflecting https://github.com/solid/web-access-control-spec#referring-to-origins-ie-web-apps
-       where the cookie implies that the user is logged in
-       */
-
       describe('and performing a subsequent request', () => {
-        // If the user is not logged on, then fail 401 Unauthenticated
         describe('without that cookie', () => {
           let response
           before(done => {
@@ -165,32 +160,28 @@ describe('Authentication API (OIDC)', () => {
           })
         })
 
-        // TODO User not authorized test here
-
-        // If the Origin header is not present, the succeed 200 OK
-        describe('with that cookie but without origin', () => {
+        describe('with that cookie and a non-matching origin', () => {
           let response
           before(done => {
             alice.get('/')
               .set('Cookie', cookie)
+              .set('Origin', bobServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
               })
           })
 
-          it('should return a 200', () => {
-            expect(response).to.have.property('status', 200)
+          it('should return a 401', () => {
+            expect(response).to.have.property('status', 401)
           })
         })
 
-        // Clear cut case
-        describe('with that cookie and a matching origin', () => {
+        describe('with that cookie but without origin', () => {
           let response
           before(done => {
             alice.get('/')
               .set('Cookie', cookie)
-              .set('Origin', aliceServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
@@ -202,11 +193,11 @@ describe('Authentication API (OIDC)', () => {
           })
         })
 
-        // If the Origin is allowed by the ACL, then succeed 200 OK
-        describe('without that cookie but with a matching origin', () => {
+        describe('with that cookie and a matching origin', () => {
           let response
           before(done => {
             alice.get('/')
+              .set('Cookie', cookie)
               .set('Origin', aliceServerUri)
               .end((err, res) => {
                 response = res
@@ -219,38 +210,34 @@ describe('Authentication API (OIDC)', () => {
           })
         })
 
-        // Fail 403 Origin Unauthorized
-        describe('without that cookie and a matching origin', () => {
+        describe('without that cookie but with a matching origin', () => {
           let response
           before(done => {
             alice.get('/')
-              .set('Origin', bobServerUri)
+              .set('Origin', aliceServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
               })
           })
 
-          it('should return a 403', () => {
-            expect(response).to.have.property('status', 403)
+          it('should return a 401', () => {
+            expect(response).to.have.property('status', 401)
           })
         })
-
-        // TODO Does this really make sense?
-        describe('with that cookie and a non-matching origin', () => {
+        describe('without that cookie and a matching origin', () => {
           let response
           before(done => {
             alice.get('/')
-              .set('Cookie', cookie)
               .set('Origin', bobServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
               })
           })
 
-          it('should return a 403', () => {
-            expect(response).to.have.property('status', 403)
+          it('should return a 401', () => {
+            expect(response).to.have.property('status', 401)
           })
         })
       })