Index: branches/HeuristicLab.Hive-3.4/sources/HeuristicLab.Services.Hive.Tests/ServiceTests.cs
===================================================================
--- branches/HeuristicLab.Hive-3.4/sources/HeuristicLab.Services.Hive.Tests/ServiceTests.cs	(revision 6452)
+++ branches/HeuristicLab.Hive-3.4/sources/HeuristicLab.Services.Hive.Tests/ServiceTests.cs	(revision 6457)
@@ -26,4 +26,5 @@
 using HeuristicLab.Services.Hive.Common.DataTransfer;
 using HeuristicLab.Services.Hive.Common.ServiceContracts;
+using HeuristicLab.Services.Hive.Tests.Mocks;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using DT = HeuristicLab.Services.Hive.Common.DataTransfer;
@@ -32,8 +33,11 @@
   [TestClass]
   public class ServiceTests {
+    // use the mock service locator to modify service properties (such as current user)
+    private static MockServiceLocator mockServiceLocator;
 
     [ClassInitialize]
     public static void MyClassInitialize(TestContext testContext) {
-      ServiceLocator.Instance = new MockServiceLocator(ServiceLocator.Instance);
+      mockServiceLocator = new MockServiceLocator(ServiceLocator.Instance);
+      ServiceLocator.Instance = mockServiceLocator;
     }
 
@@ -47,15 +51,8 @@
 
       // create hive experiment
-      DT.HiveExperiment experiment = new DT.HiveExperiment() {
-        Name = "TestExperiment",
-        Description = ""
-      };
+      DT.HiveExperiment experiment = new DT.HiveExperiment() { Name = "TestExperiment", Description = "" };
 
       // create job
-      DT.Job job = new DT.Job() {
-        CoresNeeded = 1,
-        MemoryNeeded = 0,
-        Priority = 0
-      };
+      DT.Job job = new DT.Job() { CoresNeeded = 1, MemoryNeeded = 0, Priority = 0 };
       job.State = JobState.Offline;
       job.StateLog.Add(new StateLog { State = JobState.Offline, DateTime = DateTime.Now });
@@ -78,5 +75,5 @@
       plugin1.DateCreated = DateTime.Now;
       plugin1.Hash = hash;
-      
+
       DT.PluginData pluginData1 = new DT.PluginData();
       pluginData1.FileName = "Tests.MyPlugin-1.0.dll";
@@ -206,8 +203,5 @@
 
       // create hive experiment
-      DT.HiveExperiment experiment = new DT.HiveExperiment() {
-        Name = "TestExperiment",
-        Description = ""
-      };
+      DT.HiveExperiment experiment = new DT.HiveExperiment() { Name = "TestExperiment", Description = "" };
 
       // create parent job
@@ -304,4 +298,69 @@
       service.DeleteSlave(slave.Id);
     }
+
+
+    [TestMethod]
+    public void TestHiveExperimentPermissions() {
+      var service = GetLocalService();
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId1);
+
+      // create hive experiment
+      DT.HiveExperiment e1 = new DT.HiveExperiment() { Name = "TestExperiment", Description = "" };
+      e1.Id = service.AddHiveExperiment(e1);
+      
+      var e1loaded = service.GetHiveExperiment(e1.Id);
+      Assert.AreEqual(Permission.Full, e1loaded.Permission);
+
+      // change to user2
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId2);
+      e1loaded = service.GetHiveExperiment(e1.Id);
+      Assert.AreEqual(null, e1loaded); // no access
+
+      // user2 should not be able to grant permissions
+      try {
+        service.GrantPermission(e1.Id, MockAuthorizationManager.MockUserId2, Permission.ReadOnly);
+        Assert.Fail("Should not be possible to grant permission due to missing permission for User2");
+      }
+      catch { /* ok, cool */ }
+
+      // switch back to user1 (owner) and grant user2 permissions
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId1);
+      service.GrantPermission(e1.Id, MockAuthorizationManager.MockUserId2, Permission.ReadOnly);
+
+      // back to user2
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId2);
+      e1loaded = service.GetHiveExperiment(e1.Id);
+      Assert.AreEqual(Permission.ReadOnly, e1loaded.Permission);
+
+      // user2 should still not be able to grant permissions
+      try {
+        service.GrantPermission(e1.Id, MockAuthorizationManager.MockUserId2, Permission.ReadOnly);
+        Assert.Fail("Should not be possible to grant permission due to missing permission for User2");
+      }
+      catch { /* ok, cool */ }
+
+      // back to user1
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId1);
+      service.GrantPermission(e1.Id, MockAuthorizationManager.MockUserId2, Permission.Full);
+
+      // back to user2
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId2);
+      e1loaded = service.GetHiveExperiment(e1.Id);
+      Assert.AreEqual(Permission.Full, e1loaded.Permission);
+
+      // grant rights to user3, now this should be possible due to full permissions
+      service.GrantPermission(e1.Id, MockAuthorizationManager.MockUserId3, Permission.ReadOnly);
+
+      // back to user1 and revoke rights for user2
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId1);
+      service.RevokePermission(e1.Id, MockAuthorizationManager.MockUserId2);
+
+      // back to user2
+      mockServiceLocator.SetCurrentUser(MockAuthorizationManager.MockUserId2);
+      e1loaded = service.GetHiveExperiment(e1.Id);
+      Assert.AreEqual(null, e1loaded); // no access
+
+      service.DeleteHiveExperiment(e1.Id);
+    }
   }
 }
