WIP: start implementing tests for permissions

tests/test_permissions.py

+from invenio_config_tuw.permissions.policies import TUWRecordPermissionPolicy
+from invenio_access.permissions import system_identity as system
+
+
+def can(identity, action, **kwargs):
+    """Check if the identity has permission to perform the action."""
+    return TUWRecordPermissionPolicy(action, **kwargs).allows(identity)
+
+
+def test_reading_deleted():
+    assert can(system, "read_deleted")
+    # TODO any user, authenticated, trusted-user, ...
+
+
+def test_record_creation():
+    assert can(system, "create")
+    # TODO more
+
+
+# TODO more interesting cases: who can read drafts, etc.