3.7 KiB
Test Evidence: Attendance and global-calendar web authorization
- Test type: Web
- Requirement IDs:
AUTH-001,AUTH-002,AUTH-003,ATT-007,ATT-010,ATT-016,CAL-001,CAL-007,RPT-004,UI-013 - Scenario IDs:
AC-ATT-003,AC-ATT-004,AC-CAL-004 - Test class/method:
com.lab.labtimesheet.feature.attendance.controller.AttendanceControllerTest - Implementation commit:
8b48e281f7e860af435ae35b16c4edeb139286dc
Protected behavior
Authenticated Intern punch routes use the server-resolved user ID, own history
renders attached policy details, Mentor inspection routes preserve the target
scope, and calendar management rejects non-Admin access. Calendar updates carry
the submitted optimistic version. History renders policy-local 24-hour times,
dd/MM/yyyy dates, and every simultaneous violation; On time appears only
when no violation applies.
Test method
@WebMvcTest runs Spring Security filters, CSRF protection, MVC binding, route
selection, controller authorization, Thymeleaf rendering, and service-call
arguments while mocking only application-service and current-user boundaries.
The presentation regression supplies a row that is both late and early and
asserts the attached Asia/Ho_Chi_Minh timezone conversion.
Hand-derived expected result
An Intern authenticated as user 42 can punch only ID 42. A Mentor can inspect
target 42 but receives HTTP 403 for Admin calendar management. Attached policy
grace renders as 30 min. An event form with version 3 calls update with 3.
2026-08-14T02:00:00.001Z renders as local 09:00, and a 15:00 local checkout
on that late row renders both Late and Early departure, never On time.
RED
Command
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
./mvnw -Dtest=AttendanceControllerTest test
Observed result
[ERROR] cannot find symbol: class AttendanceCurrentUserService
[ERROR] cannot find symbol: class AttendanceController
[ERROR] cannot find symbol: class CalendarController
[INFO] 3 errors
[INFO] BUILD FAILURE
Process exited 1 because the required authenticated web endpoints did not exist.
The review presentation regression was separately observed RED:
./mvnw -Dtest=AttendanceApplicationServiceTest,AttendanceControllerTest test
AttendanceControllerTest.historyRendersPolicyLocalDisplayValuesAndEveryViolation:
Expected a string containing "14/08/2026" but rendered "2026-08-14";
the same row rendered one nested-ternary result, "Early departure", and raw UTC instants.
Tests run: 13, Failures: 3, Errors: 1, Skipped: 0
BUILD FAILURE
Process exited 1. The eligible behavioral failures were the missing local presentation
values and simultaneous violation output; the checkout fixture error was corrected
before its own focused RED and is not claimed as behavioral evidence.
GREEN
Command
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
./mvnw -Dtest=AttendanceControllerTest test
Observed result
Tests run: 8, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Process exited 0.
Affected suite
Command and result
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest='*Attendance*Test' test
Tests run: 32, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Process exited 0.
External-test boundaries
This MVC slice does not prove the platform's production login/session setup, shared shell and navigation, browser layout, or accessibility beyond semantic labels, table headers, status roles, CSRF, and route authorization.