Extend TokenPolicy spec

src/api/spec/policies/token_policy_spec.rb

@@ -20,7 +20,7 @@
     it { is_expected.to permit(token_user, user_token) }
   end
 
-  permissions :show? do
+  permissions :show?, :create?, :update? do
     it { is_expected.to permit(token_user, workflow_token) }
   end
 
@@ -29,6 +29,18 @@
     it { is_expected.not_to permit(unconfirmed_user, token_of_unconfirmed_user) }
   end
 
+  # New action is permitted on any kind of token and user
+  permissions :new? do
+    it { is_expected.to permit(token_user, Token.new) }
+    it { is_expected.to permit(unconfirmed_user, Token.new) }
+  end
+
+  # Create and update are permitted when the user and the executor are the same
+  permissions :create?, :update? do
+    it { is_expected.to permit(token_user, rss_token) }
+    it { is_expected.not_to permit(other_user, rss_token) }
+  end
+
   describe TokenPolicy::Scope do
     describe '#resolve' do
       let!(:scope) { Token }