---
# System prepended metadata

title: CYF - API - Authentication behaviour  - adminOnly
tags: [' tickets', cyf]

---

---
tags: cyf, tickets
---

# CYF - API - Authentication behaviour  - adminOnly

### CYF - API - Authentication behaviour #13 - H12

### Is your feature request related to a problem? Please describe.

We need to double check that security is behaving as expected.

More details [in the Slack Channel](https://codeyourfuture.slack.com/archives/C01J84Q88GZ/p1623430869447200).

### Acceptance criteria

- [ ] **Given** a request to `DELETE /application-process	/applicant/:userId?` is made:

    - [ ] ***When*** the user is unauthenticated (has no JWT) 
    ***then*** they receive a 401 Unauthenticated response

    - [ ] ***When*** the user is authenticated (has a valid JWT) but not a VERIFIED Admin
    ***then*** they receive a 401 Unauthenticated response

    - [ ] ***When*** the user is authenticated and a VERIFIED Admin
    ***then*** they receive a _200 OK_ response 

- [ ] CYF Apps continue to operate as expected, all automated and [manual tests](https://github.com/CodeYourFuture/tech-team/wiki/Manual-Test-Procedures) pass.


### Implementation Notes

Spreadsheet reference https://docs.google.com/spreadsheets/d/1wDocO2RPhaRSePOV_kR5yuEneybU-VymVNO1K1lN-_g/edit#gid=0&range=H11

Examples of different solutions to "adminOnly" and superAdminOnly" access requirements can be found in the "Authentication behaviour" tickets here:
https://github.com/CodeYourFuture/cyf-api/pulls?q=is%3Apr|

1. Decide the second half of a name for this `bugfix/***` branch
1. Create your new branch!
1. Regularly commit your code and push it to the remote branch.  Do the same at the end of a day.  Then others can see it and offer suggesions if you ask, and if your computer breaks you don't lose any work!
1. Write your tests.  These may fail initially, but should be set up so that when you have finished work on this ticket, they pass.
1. Start changing the code so that the tests will pass. _This will help work out what the current behaviour is, and what you need to do to correct this._