Customer can see all his emergency-sites data

Given I am authenticated as Customer K0002
And there is a Site with salesforceId a062000000HbAsd
And with:

name set to Site Name
street set to Site Street
zip set to 00999
city set to Berlin
country set to DE

and there is a Trunk +48 (22) 1111 And there is another Customer with ID K0003
Which has another Site with salesforceId a062000000HbDES
When I send /api/customers/K0002/emergency-sites
Then I should receive HTTP/1.1 200 OK
with following body

{
  "href": "/api/customers/K0002/emergency-sites?_offset=0&_pagesize=16",
  "offset": 0,
  "total": 2,
  "size": 2,
  "links": [],
  "items": [{
    "href": "/api/customers/K0002/sites/INHERIT",
    "data": [{
      "name": "salesForceId",
      "value": "INHERIT"
    }, {
      "name": "name",
      "value": "INHERIT"
    }, {
      "name": "street",
      "value": ""
    }, {
      "name": "zip",
      "value": ""
    }, {
      "name": "city",
      "value": ""
    }, {
      "name": "country",
      "value": ""
    }]
  }, {
    "href": "/api/customers/K0002/sites/a062000000HbAsd",
    "links": [],
    "data": [{
      "name": "salesForceId",
      "value": "a062000000HbAsd"
    }, {
      "name": "name",
      "value": "Site Name"
    }, {
      "name": "street",
      "value": "Site Street"
    }, {
      "name": "zip",
      "value": "00999"
    }, {
      "name": "city",
      "value": "Berlin"
    }, {
      "name": "country",
      "value": "DE"
    }]
  }]
}

Missing Customer

Given I am authenticated as Admin
When I send /api/customers/K404/emergency-sites
Then I should receive HTTP/1.1 404 Not Found
And Content-Type header should be
with following body:

{
  "title": "Customer not found",
  "detail": "Customer with identifier K404 has not been found",
  "described_by": "http://api.nfon.net/probs/customer-not-found"
}

Customer should not be able to GET another Customer's Sites

Given I am authenticated as Customer K0003
When I send /api/customers/K0002/emergency-sites
Then I should receive HTTP/1.1 403 Forbidden
And Content-Type header should be
with following body:

{
  "title": "Access forbidden",
  "detail": "Access denied to [Customer] with id [K0002]",
  "described_by": "http://api.nfon.net/probs/invalid-authorization"
}

System Integrator cannot access Sites of Customer that does not belong to him

Given I am authenticated as System Integrator S0002
When I send /api/customers/K0003/emergency-sites
Then I should receive HTTP/1.1 403 Forbidden
with following body

{
  "title": "Access forbidden",
  "detail": "Access denied to [Customer] with id [K0003]",
  "described_by": "http://api.nfon.net/probs/invalid-authorization"
}

Operator cannot access Sites of Customer that does not belong to him

Given I am authenticated as Operator C0002
When I send /api/customers/K0003/emergency-sites
Then I should receive HTTP/1.1 403 Forbidden
with following body

{
  "title": "Access forbidden",
  "detail": "Access denied to [Customer] with id [K0003]",
  "described_by": "http://api.nfon.net/probs/invalid-authorization"
}

Service Portal REST API

GET /api/customers/{identifier}/sites