Reorder tests and reference the spec

Author: kjetilk

test/integration/authentication-oidc-test.js

@@ -144,7 +144,12 @@ describe('Authentication API (OIDC)', () => {
         expect(cookie).to.match(/Secure/)
       })
 
+      /* Reflecting https://github.com/solid/web-access-control-spec#referring-to-origins-ie-web-apps
+       where the cookie implies that the user is logged in
+       */
+
       describe('and performing a subsequent request', () => {
+        // If the user is not logged on, then fail 401 Unauthenticated
         describe('without that cookie', () => {
           let response
           before(done => {
@@ -160,28 +165,32 @@ describe('Authentication API (OIDC)', () => {
           })
         })
 
-        describe('with that cookie and a non-matching origin', () => {
+        // TODO User not authorized test here
+
+        // If the Origin header is not present, the succeed 200 OK
+        describe('with that cookie but without origin', () => {
           let response
           before(done => {
             alice.get('/')
               .set('Cookie', cookie)
-              .set('Origin', bobServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
               })
           })
 
-          it('should return a 401', () => {
-            expect(response).to.have.property('status', 401)
+          it('should return a 200', () => {
+            expect(response).to.have.property('status', 200)
           })
         })
 
-        describe('with that cookie but without origin', () => {
+        // Clear cut case
+        describe('with that cookie and a matching origin', () => {
           let response
           before(done => {
             alice.get('/')
               .set('Cookie', cookie)
+              .set('Origin', aliceServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
@@ -193,11 +202,11 @@ describe('Authentication API (OIDC)', () => {
           })
         })
 
-        describe('with that cookie and a matching origin', () => {
+        // If the Origin is allowed by the ACL, then succeed 200 OK
+        describe('without that cookie but with a matching origin', () => {
           let response
           before(done => {
             alice.get('/')
-              .set('Cookie', cookie)
               .set('Origin', aliceServerUri)
               .end((err, res) => {
                 response = res
@@ -210,34 +219,38 @@ describe('Authentication API (OIDC)', () => {
           })
         })
 
-        describe('without that cookie but with a matching origin', () => {
+        // Fail 403 Origin Unauthorized
+        describe('without that cookie and a matching origin', () => {
           let response
           before(done => {
             alice.get('/')
-              .set('Origin', aliceServerUri)
+              .set('Origin', bobServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
               })
           })
 
-          it('should return a 401', () => {
-            expect(response).to.have.property('status', 401)
+          it('should return a 403', () => {
+            expect(response).to.have.property('status', 403)
           })
         })
-        describe('without that cookie and a matching origin', () => {
+
+        // TODO Does this really make sense?
+        describe('with that cookie and a non-matching origin', () => {
           let response
           before(done => {
             alice.get('/')
+              .set('Cookie', cookie)
               .set('Origin', bobServerUri)
               .end((err, res) => {
                 response = res
                 done(err)
               })
           })
 
-          it('should return a 401', () => {
-            expect(response).to.have.property('status', 401)
+          it('should return a 403', () => {
+            expect(response).to.have.property('status', 403)
           })
         })
       })