adding test which list clocks but show date/time

[davidamitchell]

@pond, I am not 100% sure if I have set these tests up correctly, but in some testing of the calculation creation when hoodoo was attempting to lookup the additional_permissions (in middleware#augment_session_with_permissions_for_action):

additional_permissions = ( interface.additional_permissions() || {} )[ action ]

for the CalculationInterface which have been setup as such:

    additional_permissions_for( :create ) do | p |
      p.set_resource( :Currency, :list, Hoodoo::Services::Permissions::ALLOW )
    end```

the `action` it was looking for was `:create` not `:list`.  

It seems like the `action` is being gotten from the originating call not the inter-resource calls action.

[pond]

Yes, very good catch - it was stupid of me to just use "show" for all the chained resources. A very thorough set of tests caught out by one daft oversight! It shouldn't be hard to fix the internal screwup in the local and remote inter-resource calls.

EDIT: SEE BELOW: I misinterpreted what you were saying. The behaviour was correct, but I'm bolstering the tests to call into different action names to make sure there are no bugs of the kind I thought you were actually describing! I'm also correcting the incorrect tests brought in by the merge.

[pond]

Oops, I should've read this more closely before merging. You said the reverse of what I thought you were saying.

Your PR assigns a new action to the Clock resource which is 'list'. It then grants top-level session permissions permitting that. But the action 'list' tries to call 'show' in another resource. You did not grant permissions for Clock's "list" action to do this. Therefore, I would expect the test at line 404 to fail, with the response at line 411 being 403 (correctly), while the test requires 200 (incorrect).

If service A calls service B, then service A must add permissions for THE ACTIONS IN A which call other things. You're saying "hey, someone called me. But for action, I also need to call ".

So without an additional_permissions_for( :list ) do ... inside ...ClockInterface..., Clock should be unable to do #list. Which is exactly what we see.