+
+ # TBD: create action should add permission signatures to manifest_text in the response,
+ # and we need to check those permission signatures here.
+ end
+
+ [:admin, :active].each do |user|
+ test "#{user} can get collection using portable data hash" do
+ authorize_with user
+
+ foo_collection = collections(:foo_file)
+
+ # Get foo_file using its portable data hash
+ get :show, {
+ id: foo_collection[:portable_data_hash]
+ }
+ assert_response :success
+ assert_not_nil assigns(:object)
+ resp = assigns(:object)
+ assert_equal foo_collection[:portable_data_hash], resp['portable_data_hash']
+ assert_signed_manifest resp['manifest_text']
+
+ # The manifest in the response will have had permission hints added.
+ # Remove any permission hints in the response before comparing it to the source.
+ stripped_manifest = resp['manifest_text'].gsub(/\+A[A-Za-z0-9@_-]+/, '')
+ assert_equal foo_collection[:manifest_text], stripped_manifest
+ end