GET returns requested Handset Device

Given I am authenticated as K0002
And there is a Base Device with MAC ABCDEF012345 and it has active Handset with port Port0 and BLUETOOTH_PIN option set to 6130
which has been created at 2015-10-12 04:25 which has been created at 2015-10-12 04:25 When I send /api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 200 OK with following body:

{
  "href": "/api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0",
  "links": [{
    "rel": "base",
    "href": "/api/customers/K0002/devices/base/ABCDEF012345"
  }, {
    "rel": "activation",
    "href": "/api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0/activate"
  }, {
    "rel": "extension",
    "href": null
  }],
  "data": [{
    "name": "port",
    "value": "Port0"
  }, {
    "name": "bluetoothPin",
    "value": "6130"
  }, {
    "name": "active",
    "value": true
  }, {
    "name": "suppressLineno",
    "value": "DEFAULT"
  }, {
    "name": "note",
    "value": null
  }]
}

GET returns 404 if device does not exist

Given I am authenticated as K0002
and there is a Base Device with MAC ABCDEF012345 and it has no Handsets assigned
When I send /api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 404 Not Found with following body:

{
  "described_by": "http://api.nfon.net/probs/device-not-found",
  "title": "Device not found",
  "detail": "Device with unique identifier Port0 has not been found"
}

Cannot read data for missing Customer

Given I am authenticated as Admin
When I send /api/customers/K0404/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 404 Not Found
with following body:

{
  "described_by": "http://api.nfon.net/probs/customer-not-found",
  "title": "Customer not found",
  "detail": "Customer with identifier K0404 has not been found"
}

Customer cannot read other Customer's data

Given I am authenticated as K0003
and there is a Base Device with MAC ABCDEF012345 and it has no Handsets assigned
and it it owned by Customer K0002
which has been created at 2015-10-12 04:25 When I send /api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 403 Forbidden with following body:

{
  "title": "Access forbidden",
  "detail": "Access denied to [Customer] with id [K0002]",
  "described_by": "http://api.nfon.net/probs/invalid-authorization"
}

System integrator can see sipUsername

Given I am authenticated as System Integrator S0002
And there is which has been created at 2015-10-12 04:25 a Base Device with MAC ABCDEF012345 and it has active Handset with port Port0 which has been created at 2015-10-12 04:25 and BLUETOOTH_PIN option set to 6130
When I send /api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 200 OK with following body:

{
  "href": "/api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0",
  "links": [{
    "rel": "base",
    "href": "/api/customers/K0002/devices/base/ABCDEF012345"
  }, {
    "rel": "activation",
    "href": "/api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0/activate"
  }],
  "data": [{
    "name": "port",
    "value": "Port0"
  }, {
    "name": "bluetoothPin",
    "value": "6130"
  }, {
    "name": "active",
    "value": true
  }, {
    "name": "sipUsername",
    "value": "K0002"
  }]
}

Operator can see sipSecret

Given I am authenticated as Operator C0002
And there is a Base Device with MAC ABCDEF012345 and it has active Handset with port Port0 and BLUETOOTH_PIN option set to 6130
and it has sipSecret set to kSIzxm76EE2
which has been created at 2015-10-12 04:25 which has been created at 2015-10-12 04:25 When I send /api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 200 OK with following body:

{
  "href": "/api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0",
  "links": [{
    "rel": "base",
    "href": "/api/customers/K0002/devices/base/ABCDEF012345"
  }, {
    "rel": "activation",
    "href": "/api/customers/K0002/devices/base/ABCDEF012345/handsets/Port0/activate"
  }],
  "data": [{
    "name": "port",
    "value": "Port0"
  }, {
    "name": "bluetoothPin",
    "value": "6130"
  }, {
    "name": "active",
    "value": true
  }, {
    "name": "sipUsername",
    "value": "K0002"
  }, {
    "name": "sipSecret",
    "value": "kSIzxm76EE2"
  }]
}

System Integrator cannot access Handset of Customer that does not belong to him

Given I am authenticated as System Integrator S0002
When I send /api/customers/K0003/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 403 Forbidden
with following body

{
  "title": "Access forbidden",
  "detail": "Access denied to [Customer] with id [K0003]",
  "described_by": "http://api.nfon.net/probs/invalid-authorization"
}

Operator cannot access Handset of Customer that does not belong to him

Given I am authenticated as Operator C0002
When I send /api/customers/K0003/devices/base/ABCDEF012345/handsets/Port0
Then I should receive HTTP/1.1 403 Forbidden
with following body

{
  "title": "Access forbidden",
  "detail": "Access denied to [Customer] with id [K0003]",
  "described_by": "http://api.nfon.net/probs/invalid-authorization"
}

Service Portal REST API

GET /api/customers/{customer-id}/devices/base/{baseDeviceId}/handsets/{handsetId}