Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Numberverify verify Test definition #124

Merged
merged 28 commits into from
Aug 27, 2024
Merged

Numberverify verify Test definition #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
a03682d
initial commit
AxelNennker Jul 24, 2024
849e20d
use Scenario Outline for common tests
AxelNennker Jul 26, 2024
6e52ca9
new case access token expired
AxelNennker Jul 26, 2024
bcc87e9
rename NumberVerification.feature to NumberVerification_verify.feature
AxelNennker Jul 26, 2024
cfe09c0
add verify
AxelNennker Jul 26, 2024
564359d
remove x-correlator format test
AxelNennker Jul 26, 2024
9fe46ce
remove CIBA
AxelNennker Jul 26, 2024
79181e6
some lines about testing environment and assets
AxelNennker Jul 26, 2024
da3c3bb
single cause of failure
AxelNennker Jul 26, 2024
d012be8
better text if phone number from access token and from parameter do n…
AxelNennker Jul 26, 2024
82f02e9
And the request body does not have the field phoneNumber
AxelNennker Jul 26, 2024
ada4a18
NumberVerificationMatchResponse
AxelNennker Jul 26, 2024
2c488bf
remove over a mobile connection
AxelNennker Jul 26, 2024
fc899f8
remove mobile connection
AxelNennker Jul 26, 2024
e0e2c58
initial commit of "share" test definitions
AxelNennker Jul 26, 2024
fcea400
add hashed numbers test definitions
AxelNennker Jul 26, 2024
50949f4
re-added "And the connection the request is sent over originates from…
AxelNennker Jul 27, 2024
796b9c6
Update NumberVerification_device_phone_number_share.feature
AxelNennker Aug 2, 2024
414a57f
Update NumberVerification_verify.feature
AxelNennker Aug 2, 2024
6d6d58f
added test NumberVerification_verify203_both_phone_number_and_hashed_…
AxelNennker Aug 8, 2024
f8513aa
missing scope error is 403
AxelNennker Aug 21, 2024
4c775ca
missing scope is error code 403
AxelNennker Aug 21, 2024
81072eb
Update code/Test_Definitions/NumberVerification_verify.feature
AxelNennker Aug 21, 2024
f3fbd39
added NumberVerification_phone_number_share203_no_phonenumber_associa…
AxelNennker Aug 22, 2024
fa334b2
addedd NumberVerification_phone_number_verify204_no_phonenumber_assoc…
AxelNennker Aug 22, 2024
393d7da
added @NumberVerification_phone_number_verify205_must_have_used_netwo…
AxelNennker Aug 24, 2024
a61b1c4
fix indentation
AxelNennker Aug 24, 2024
5b35bde
added @NumberVerification_phone_number_share205_must_have_used_networ…
AxelNennker Aug 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 104 additions & 0 deletions code/Test_Definitions/NumberVerification_device_phone_number_share.feature
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test included for share operation:

  1. ✅ @NumberVerification_phone_number_share100_match_true
  2. ⚠️ @NumberVerification_phone_number_share201_missing_scope
  3. ✅ @NumberVerification_phone_number_share202_expired_access_token

Pending test to be included:

  1. ❌ The access token is valid but it has been generated with an auth method other than network auth (user/password, otp-sms, etc) --> error NUMBER_VERIFICATION.USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK
  2. ❌ The phone number cannot be deducted from access token --> error INVALID_TOKEN_CONTEXT

cc: @bigludo7 @AxelNennker

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

regarding "pending tests" 1.

Maybe the authorization server should never create an access token if the scope is a "number verification"-scope and never did network authentication?! There is probably no way for the resource server / API endpoint to identify the authentication method used.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

regarding "pending tests" 2.

This also sounds like an internal authorization server error and should never happen - like the access token creation without network authentication for nv-scopes.

The resource server / API-endpoint can detect this condition

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/camaraproject/NumberVerification/blob/main/code/API_definitions/number_verification.yaml#L270 talks about AMR
As Camara does not specify the access token nor the information associated with it other than the API's subject like phoneNumber, this would be a NV requirement on the telco issuing access tokens

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wdyt @bigludo7? I don't know if we can leave that validation to the authserver as something external to the API.
The auth process will validate if a phone number has access to certain scopes but I don't know if it can also check the auth method at token generation time.
And being Auth Code where the authentication is not done by the authserver itself but maybe something like an IDP.
I tend to think that is better to include the test mainly because is an error specified in the API yaml and we should cover it.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not as expert that both of you on this specific point but as we have the error in the YAML we must have a test case covered it.
By preference it to have it and then we can always discuss in the future to remove it.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a test to "verify" that uses USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a test to "share" that uses USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK

https://github.com/camaraproject/NumberVerification/blob/test_definition/code/Test_Definitions/NumberVerification_device_phone_number_share.feature#L90

Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@


@NumberVerification_device_phone_number_share
Feature: Camara Number Verification API device phone number share

# Input to be provided by the implementation to the tests
# References to OAS spec schemas refer to schemas specified in
# https://raw.githubusercontent.com/camaraproject/NumberVerification/main/code/API_definitions/number_verification.yaml
#
# Implementation indications:
# * api_root: API root of the server URL
#
# Testing assets:
# * a mobile device with SIM card with NUMBERVERIFY_SHARE_PHONENUMBER1
# * a mobile device with SIM card with NUMBERVERIFY_SHARE_PHONENUMBER2

Background: Common Number Verification phone number share setup
Given the resource "/device-phone-number/v0" as base url
And the header "Content-Type" is set to "application/json"
And the header "Authorization" is set to a valid access token
And the header "x-correlator" is set to a UUID value
And the request body is compliant with the schema NumberVerificationRequestBody
And the response body is compliant with the schema NumberVerificationMatchResponse
And the header "x-correlator" is set to a UUID value
And NUMBERVERIFY_SHARE_PHONENUMBER1 is compliant with the schema DevicePhoneNumber
And NUMBERVERIFY_SHARE_PHONENUMBER2 is compliant with the schema DevicePhoneNumber
And NUMBERVERIFY_SHARE_PHONENUMBER1 is different to NUMBERVERIFY_SHARE_PHONENUMBER2
And they acquired a valid access token associated with NUMBERVERIFY_SHARE_PHONENUMBER1 through OIDC authorization code flow

@NumberVerification_phone_number_share100_match_true
Scenario: share phone number NUMBERVERIFY_SHARE_PHONENUMBER1, network connection and access token matches NUMBERVERIFY_SHARE_PHONENUMBER1
Given they use the base url
And the resource is "/device-phone-number"
And one of the scopes associated with the access token is number-verification:device-phone-number:read
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response body complies with the OAS schema at "/components/schemas/NumberVerificationShareResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumber" is set to NUMBERVERIFY_SHARE_PHONENUMBER1

@NumberVerification_phone_number_share201_missing_scope
Scenario: share phone number with valid access token but scope number-verification:device-phone-number:read is missing
Given they use the base url
And the resource is "/device-phone-number"
And none of the scopes associated with the access token is number-verification:device-phone-number:read
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_SHARE_PHONENUMBER1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 403
And the response property "$.status" is 403
And the response property "$.code" is "UNAUTHENTICATED"
And the response property "$.message" is "Request not authenticated due to missing, invalid, or expired credentials."

@NumberVerification_phone_number_share202_expired_access_token
Scenario: share phone number with expired access token
Given they use the base url
And the resource is "/device-phone-number"
And one of the scopes associated with the access token is number-verification:device-phone-number:read
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the access token has expired
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 401
And the response property "$.status" is 401
And the response property "$.code" is "AUTHENTICATION_REQUIRED"
And the response property "$.message" is "New authentication is required."

@NumberVerification_phone_number_share203_no_phonenumber_associated_with_access_token
Scenario: share phone number with valid access token that is not associated with a phone number
Given they use the base url
And the resource is "/device-phone-number"
And one of the scopes associated with the access token is number-verification:device-phone-number:read
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the access token is not associated with a phone number
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 403
And the response property "$.status" is 403
And the response property "$.code" is "INVALID_TOKEN_CONTEXT"
And the response property "$.message" is "Phone number cannot be deducted from access token context."

@NumberVerification_phone_number_share205_must_have_used_network_authentication
Scenario: share phone number with valid access token but network authentication was not used
Given they use the base url
And the resource is "/device-phone-number"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the information, e.g. authentication method reference, associated with the access token indicates that network authentication was NOT used
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 403
And the response property "$.status" is 403
And the response property "$.code" is "NUMBER_VERIFICATION.USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK"
And the response property "$.message" is "The subscription must be identified via the mobile network to use this servicet."
207 changes: 207 additions & 0 deletions code/Test_Definitions/NumberVerification_verify.feature
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test included for veryfy operation:

  1. ✅ @NumberVerification_verify0_phoneNumber_does_not_match_schema --> Invalid phone number
  2. ✅ @NumberVerification_verify100_match_true -->Token associated with phoneNumber1 matches phoneNumber1 sent in the body
  3. ✅ @NumberVerification_verify300_match_hashed_true --> Token associated with phoneNumber1 matches hashedPhoneNumber1 sent in the body
  4. ✅ @NumberVerification_verify101_match_false --> Token associated with phoneNumber2 doesn't match phoneNumber1 in the body
  5. ⚠️ @NumberVerification_verify301_match_ hashed _false --> Token associated with phoneNumber2 doesn't match hashedPhoneNumber1 in the body
  6. ⚠️ @NumberVerification_verify200_missing_phone_number_in_request --> neither phoneNumber nor hashedPhoneNumber
  7. ⚠️ @NumberVerification_verify201_missing_scope
  8. ⚠️ @NumberVerification_verify202_expired_access_token
  9. ✅ @NumberVerification_verify203_both_phone_number_and_hashed_in_request

Pending test to be included:

  1. ❌ The access token is valid but it has been generated with an auth method other than network auth (user/password, otp-sms, etc) --> error NUMBER_VERIFICATION.USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK
  2. ❌ The phone number cannot be deducted from access token --> error INVALID_TOKEN_CONTEXT

cc: @bigludo7 @AxelNennker

Original file line number Diff line number Diff line change
@@ -0,0 +1,207 @@


@NumberVerification_verify
Feature: Camara Number Verification API verify

# Input to be provided by the implementation to the tests
# References to OAS spec schemas refer to schemas specified in
# https://raw.githubusercontent.com/camaraproject/NumberVerification/main/code/API_definitions/number_verification.yaml
#
# Implementation indications:
# * api_root: API root of the server URL
#
# Testing assets:
# * a mobile device with SIM card with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
# * a mobile device with SIM card with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2
# * a mobile device with SIM card with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER_HASHED1
# * a mobile device with SIM card with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER_HASHED2



Background: Common Number Verification verify setup
Given the resource "/number-verification/v0" as base url
And the header "Content-Type" is set to "application/json"
And the header "Authorization" is set to a valid access token
And the header "x-correlator" is set to a UUID value
And the request body is compliant with the schema NumberVerificationRequestBody
And the response body is compliant with the schema NumberVerificationMatchResponse
And the header "x-correlator" is set to a UUID value
And NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 is compliant with the schema DevicePhoneNumber
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved
And NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2 is compliant with the schema DevicePhoneNumber
And NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 is different to NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2

@NumberVerification_verify0_phoneNumber_does_not_match_schema
Scenario Outline: phoneNumber value does not comply with the schema
Given the request body property "$.phoneNumber" is set to: <phone_number_value>
When the HTTP "POST" request is sent
Then the response status code is 400
And the response property "$.status" is 400
And the response property "$.code" is "INVALID_ARGUMENT"
And the response property "$.message" contains a user friendly text
And they acquired a valid access token associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 through OIDC authorization code flow

Examples:
| phone_number_value |
| string_value |
| 1234567890 |
| +12334foo22222 |
| +00012230304913849 |
| 123 |
| ++49565456787 |


@NumberVerification_verify100_match_true
Scenario: verify phone number NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1, network connection and access token matches NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/NumberVerificationMatchResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumberVerified" is true

@NumberVerification_verify300_match_hashed_true
Scenario: verify hashed phone number hashed NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1, network connection and access token matches NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field hashedPhoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER_HASHED1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/NumberVerificationMatchResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumberVerified" is true


@NumberVerification_verify101_match_false
Scenario: verify phone number NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 but access token is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/NumberVerificationMatchResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumberVerified" is false

@NumberVerification_verify301_match_false
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think this one should be match_hashed_false

Scenario: verify hashed phone number NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1 but access token is associated with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER2
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field hashedPhoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER_HASHED2
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/NumberVerificationMatchResponse"
Then the response status code is 200
And the response property "$.devicePhoneNumberVerified" is false

@NumberVerification_verify200_missing_phone_number_in_request
Scenario: verify phone number but no phonenumber in request
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has NO the field phoneNumber or hashedPhoneNumber
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 400
And the response property "$.status" is 400
And the response property "$.code" is "INVALID_ARGUMENT"
And the response property "$.message" contains a user friendly text

@NumberVerification_verify201_missing_scope
Scenario: verify phone number with valid access token but scope number-verification:verify is missing
Given they use the base url
And the resource is "/verify"
And none of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 403
And the response property "$.status" is 403
And the response property "$.code" is "UNAUTHENTICATED"
And the response property "$.message" is "Request not authenticated due to missing, invalid, or expired credentials."

@NumberVerification_verify202_expired_access_token
Scenario: verify phone number with expired access token
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the access token has expired
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 401
And the response property "$.status" is 401
And the response property "$.code" is "AUTHENTICATION_REQUIRED"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or UNAUTHENTICATED, still don't know which one should apply in this case

And the response property "$.message" is "New authentication is required."
AxelNennker marked this conversation as resolved.
Show resolved Hide resolved

@NumberVerification_verify203_both_phone_number_and_hashed_in_request
Scenario: verify phone number but no phonenumber in request
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "POST" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field phoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the request body has the field hashedPhoneNumber with a value of NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER_HASHED1
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 400
And the response property "$.status" is 400
And the response property "$.code" is "INVALID_ARGUMENT"
And the response property "$.message" contains a user friendly text

@NumberVerification_phone_number_verify204_no_phonenumber_associated_with_access_token
Scenario: verify phone number with valid access token that is not associated with a phone number
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the access token is not associated with a phone number
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 403
And the response property "$.status" is 403
And the response property "$.code" is "INVALID_TOKEN_CONTEXT"
And the response property "$.message" is "Phone number cannot be deducted from access token context."


@NumberVerification_phone_number_verify205_must_have_used_network_authentication
Scenario: verify phone number with valid access token but network authentication was not used
Given they use the base url
And the resource is "/verify"
And one of the scopes associated with the access token is number-verification:verify
When the HTTPS "GET" request is sent
And the connection the request is sent over originates from a device with NUMBERVERIFY_VERIFY_MATCH_PHONENUMBER1
And the information, e.g. authentication method reference, associated with the access token indicates that network authentication was NOT used
And the response header "x-correlator" has same value as the request header "x-correlator"
And the response header "Content-Type" is "application/json"
And the response body complies with the OAS schema at "/components/schemas/ErrorInfo"
Then the response status code is 403
And the response property "$.status" is 403
And the response property "$.code" is "NUMBER_VERIFICATION.USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK"
And the response property "$.message" is "The subscription must be identified via the mobile network to use this servicet."