public async Task Update_UpdateForbidden_ReturnsForbidden()
        {
            // Arrange
            var restrictedController = new AnyAsyncReadOnlyController(repository, logger);
            int id     = 1;
            var entity = new AnyEntity();

            // Act
            var result = await restrictedController.Update(id, entity) as ObjectResult;

            // Assert
            result.Should().NotBeNull();
            result.StatusCode.Should().Be(403);
            A.CallTo(() => repository.Update(id, entity)).MustNotHaveHappened();
        }
        public async Task Update_UpdateForbidden_ReturnsForbidden()
        {
            // TODO: ReadOnly
            // Arrange
            var    readOnlyController = new AnyAsyncReadOnlyController(_repository, _logger);
            string id    = ObjectId.GenerateNewId().ToString();
            var    model = new AnyModel();

            // Act
            var result = await readOnlyController.Update(id, model) as ObjectResult;

            // Assert
            result.Should().NotBeNull();
            result.StatusCode.Should().Be(403);
            A.CallTo(() => _repository.UpdateAsync(id, model)).MustNotHaveHappened();
        }