Merge commit '8b48e281f7e860af435ae35b16c4edeb139286dc' into work/reports-ui

2026-08-15 00:47:16 +07:00
parent 6fac593fcd 8b48e281f7
commit 61938875d3
41 changed files with 2547 additions and 0 deletions
@@ -0,0 +1,85 @@
+# Test Evidence: Attendance and global-calendar web authorization
+
+- **Test type:** Web
+- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-003`, `ATT-007`, `ATT-010`, `CAL-001`, `CAL-007`, `RPT-004`
+- **Scenario IDs:** `AC-ATT-003`, `AC-ATT-004`, `AC-CAL-004`
+- **Test class/method:** `com.lab.labtimesheet.feature.attendance.controller.AttendanceControllerTest`
+- **Implementation commit:** `pending (committed with this evidence)`
+
+## Protected behavior
+
+Authenticated Intern punch routes use the server-resolved user ID, own history
+renders attached policy details, Mentor inspection routes preserve the target
+scope, and calendar management rejects non-Admin access. Calendar updates carry
+the submitted optimistic version.
+
+## Test method
+
+`@WebMvcTest` runs Spring Security filters, CSRF protection, MVC binding, route
+selection, controller authorization, Thymeleaf rendering, and service-call
+arguments while mocking only application-service and current-user boundaries.
+
+## Hand-derived expected result
+
+An Intern authenticated as user 42 can punch only ID 42. A Mentor can inspect
+target 42 but receives HTTP 403 for Admin calendar management. Attached policy
+grace renders as `30 min`. An event form with version 3 calls update with 3.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=AttendanceControllerTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] cannot find symbol: class AttendanceCurrentUserService
+[ERROR] cannot find symbol: class AttendanceController
+[ERROR] cannot find symbol: class CalendarController
+[INFO] 3 errors
+[INFO] BUILD FAILURE
+Process exited 1 because the required authenticated web endpoints did not exist.
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=AttendanceControllerTest test
+```
+
+**Observed result**
+
+```text
+Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
+BUILD SUCCESS
+Process exited 0.
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest='*Attendance*Test' test
+Tests run: 26, Failures: 0, Errors: 0, Skipped: 0
+BUILD SUCCESS
+Process exited 0.
+```
+
+## External-test boundaries
+
+This MVC slice does not prove the platform's production login/session setup,
+shared shell and navigation, browser layout, or accessibility beyond semantic
+labels, table headers, status roles, CSRF, and route authorization.