Issue #3231184 by mglaman, smustgrave, longwave:...

  /**

   * Sets up the necessary authorization.

   *

   * In case of a test verifying publicly accessible REST resources: grant

   * permissions to the anonymous user role.

   *

   * In case of a test verifying behavior when using a particular authentication

   * provider: create a user with a particular set of permissions.

   *

   * Because of the $method parameter, it's possible to first set up

   * authentication for only GET, then add POST, et cetera. This then also

   * authorization for only GET, then add POST, et cetera. This then also

   * allows for verifying a 403 in case of missing authorization.

   *

   * @param string $method

   *   The HTTP method for which to set up authentication.

   *   The HTTP method for which to set up authorization.

   *

   * @see ::grantPermissionsToAnonymousRole()

   * @see ::grantPermissionsToAuthenticatedRole()

   * @see ::grantPermissionsToTestedRole()

   */

  abstract protected function setUpAuthorization($method);