sechmachine/labtimesheet
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commit '2a9a1495203830ed0434649c153ee75e812ffe51' into work/reports-ui

Browse Source 
# Conflicts:
#	src/main/resources/templates/projects/detail.html
This commit is contained in:
sechmachine
2026-08-15 01:36:32 +07:00
parent 401f67671a 2a9a149520
commit 4849e0ba3d
11 changed files with 192 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tests/web/projects-pages.md
+14 -8
View File
@@ -1,14 +1,14 @@
# Test Evidence: Authorized Project pages
- **Test type:** Web
- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-006`, `PRJ-001`, `PRJ-004`–`PRJ-006`, `SEC-001`, `ERR-001`
- **Scenario IDs:** `AC-AUTH-001`, `AC-AUTH-002`, `AC-AUTH-007`, `I1-PRJ-05`
- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-006`, `PRJ-001`, `PRJ-004`–`PRJ-006`, `PRJ-012`, `SEC-001`, `ERR-001`
- **Scenario IDs:** `AC-AUTH-001`, `AC-AUTH-002`, `AC-AUTH-007`, `AC-PRJ-006`, `I1-PRJ-04`, `I1-PRJ-05`
- **Test class/method:** `com.lab.labtimesheet.feature.project.controller.ProjectControllerTest`
- **Implementation commits:** `25a855e`, `a9ee99a`
- **Implementation commits:** `25a855e`, `a9ee99a`, `2f25731`, `dbf1202`
## Protected behavior
Authenticated users receive only authorized Project routes; guessed IDs return a non-disclosing not-found response; valid Mentor create requests use the authenticated identity; invalid forms do not mutate; state changes require CSRF.
Authenticated users receive only authorized Project routes; guessed IDs return a non-disclosing not-found response; valid Mentor create requests use the authenticated identity; invalid forms do not mutate; the planned-Project activation action is shown only to the owning Mentor; state changes require CSRF.
## Test method
@@ -16,7 +16,7 @@ MockMvc exercises the real controller, binding, Bean Validation, exception mappi
## Hand-derived expected result
An authorized list request renders `projects/list`. An unauthorized direct ID returns 404. Member and leadership routes authorize through actor plus Project ID. A valid create redirects to the created detail ID; a blank name and zero Leader ID render field errors and make no service call. POST without CSRF returns 403.
An authorized list request renders `projects/list`. An unauthorized direct ID returns 404. Member and leadership routes authorize through actor plus Project ID. A valid create redirects to the created detail ID; a blank name and zero Leader ID render field errors and make no service call. An owning Mentor can submit activation and is redirected to detail; non-owners do not receive that control. POST without CSRF returns 403.
## RED
@@ -50,7 +50,7 @@ export PATH="$JAVA_HOME/bin:$PATH"
```text
[INFO] Running com.lab.labtimesheet.feature.project.controller.ProjectControllerTest
[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
[INFO] Tests run: 10, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
```
@@ -64,7 +64,7 @@ export PATH="$JAVA_HOME/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw test
[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0
[INFO] Tests run: 111, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
```
@@ -80,6 +80,12 @@ export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
**GREEN:** rerunning `./mvnw -Dtest=ProjectControllerTest test` after resolving the public actor view and conditionally rendering the link passed 8 tests with zero failures, errors, or skips.
## Activation-route regression
**RED:** the focused MockMvc run reported two expected failures: `POST /projects/30/activate` returned `404`, and the owning Mentor's planned-Project detail did not render the `Activate` action.
**GREEN:** after adding the CSRF-protected POST route and owner/status-conditional Thymeleaf form, the two focused tests passed; the full `ProjectControllerTest` class passed 10 tests with zero failures, errors, or skips.
## External-test boundaries
This slice does not prove PostgreSQL query correctness, a real login flow, shared-shell navigation, browser accessibility, or Iteration 2 invitation/exit/completion pages. The activation route remains deferred with `I1-PRJ-04` until the Task feature query dependency is available.
This slice does not prove PostgreSQL query correctness, a real login flow, shared-shell navigation, browser accessibility, or Iteration 2 invitation/exit/completion pages. Server-side activation authorization and Task-assignee atomicity are covered by Project domain and PostgreSQL integration tests.