Authorize operation details by admin scope and isolate scoped clients

tests/test_accounts.py

@@ -125,3 +125,19 @@ def test_openapi_describes_cookie_auth_and_docs_csrf(client):
         "security"
     ]
     assert "X-CSRF-Token" in client.get("/docs").text
+
+
+def test_browser_admin_can_read_other_clients_operation(client, app, service):
+    operation_id = service.submit(
+        "render",
+        {"template": "quote"},
+        "living-room",
+        "scheduler",
+        "fixture-request",
+        None,
+    )
+    assert login(client, app).status_code == 200
+    assert client.get("/api/v1/operations/" + operation_id).status_code == 200
+    assert operation_id in [
+        op["operation_id"] for op in client.get("/api/v1/operations").json()
+    ]