diff --git a/backend/api/tests/api/test_upload.py b/backend/api/tests/api/test_upload.py
index 3966443b..3873bd70 100644
--- a/backend/api/tests/api/test_upload.py
+++ b/backend/api/tests/api/test_upload.py
@@ -1,24 +1,36 @@
-from django.contrib.auth.models import User
 from django.test import override_settings
+from rest_framework import status
 from rest_framework.reverse import reverse
-from rest_framework.test import APITestCase
 
-from .utils import create_default_roles
+from ...models import DOCUMENT_CLASSIFICATION
+from .utils import CRUDMixin, create_default_roles, make_user, prepare_project
 
 
-class TestFeatures(APITestCase):
+class TestFeatures(CRUDMixin):
+
     @classmethod
     def setUpTestData(cls):
-        cls.user_name = 'user_name'
-        cls.user_pass = 'user_pass'
         create_default_roles()
-        cls.user = User.objects.create_user(username=cls.user_name, password=cls.user_pass, email='fizz@buzz.com')
-
-    def setUp(self):
-        self.client.login(username=self.user_name, password=self.user_pass)
+        cls.user = make_user()
+        cls.url = reverse('features')
 
     @override_settings(CLOUD_BROWSER_APACHE_LIBCLOUD_PROVIDER=None)
     def test_no_cloud_upload(self):
-        response = self.client.get(reverse('features'))
-
+        response = self.assert_fetch(self.user, status.HTTP_200_OK)
         self.assertFalse(response.json().get('cloud_upload'))
+
+
+class TestImportCatalog(CRUDMixin):
+
+    def setUp(self):
+        self.project = prepare_project(task=DOCUMENT_CLASSIFICATION)
+        self.url = reverse(viewname='catalog', args=[self.project.item.id])
+
+    def test_allows_project_admin_to_list_catalog(self):
+        response = self.assert_fetch(self.project.users[0], status.HTTP_200_OK)
+        for item in response.data:
+            self.assertIn('name', item)
+
+    def test_denies_non_project_admin_to_list_catalog(self):
+        for member in self.project.users[1:]:
+            self.assert_fetch(member, status.HTTP_403_FORBIDDEN)