86 lines
3.4 KiB
Markdown
86 lines
3.4 KiB
Markdown
# Test Evidence: Authorized Project pages
|
||
|
||
- **Test type:** Web
|
||
- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-006`, `PRJ-001`, `PRJ-004`–`PRJ-006`, `SEC-001`, `ERR-001`
|
||
- **Scenario IDs:** `AC-AUTH-001`, `AC-AUTH-002`, `AC-AUTH-007`, `I1-PRJ-05`
|
||
- **Test class/method:** `com.lab.labtimesheet.feature.project.controller.ProjectControllerTest`
|
||
- **Implementation commits:** `25a855e`, `a9ee99a`
|
||
|
||
## Protected behavior
|
||
|
||
Authenticated users receive only authorized Project routes; guessed IDs return a non-disclosing not-found response; valid Mentor create requests use the authenticated identity; invalid forms do not mutate; state changes require CSRF.
|
||
|
||
## Test method
|
||
|
||
MockMvc exercises the real controller, binding, Bean Validation, exception mapping, view selection, redirect, Spring Security authentication, and CSRF filter. Only application/query services are mocked.
|
||
|
||
## Hand-derived expected result
|
||
|
||
An authorized list request renders `projects/list`. An unauthorized direct ID returns 404. Member and leadership routes authorize through actor plus Project ID. A valid create redirects to the created detail ID; a blank name and zero Leader ID render field errors and make no service call. POST without CSRF returns 403.
|
||
|
||
## RED
|
||
|
||
**Command**
|
||
|
||
```text
|
||
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
||
export PATH="$JAVA_HOME/bin:$PATH"
|
||
./mvnw -Dtest=ProjectControllerTest test
|
||
```
|
||
|
||
**Observed result**
|
||
|
||
```text
|
||
[ERROR] cannot find symbol: class ProjectController
|
||
[ERROR] cannot find symbol: class ProjectPageService
|
||
[INFO] BUILD FAILURE
|
||
```
|
||
|
||
## GREEN
|
||
|
||
**Command**
|
||
|
||
```text
|
||
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
||
export PATH="$JAVA_HOME/bin:$PATH"
|
||
./mvnw -Dtest=ProjectControllerTest test
|
||
```
|
||
|
||
**Observed result**
|
||
|
||
```text
|
||
[INFO] Running com.lab.labtimesheet.feature.project.controller.ProjectControllerTest
|
||
[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
|
||
[INFO] BUILD SUCCESS
|
||
```
|
||
|
||
## Affected suite
|
||
|
||
**Command and result**
|
||
|
||
```text
|
||
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
||
export PATH="$JAVA_HOME/bin:$PATH"
|
||
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
|
||
./mvnw test
|
||
|
||
[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0
|
||
[INFO] BUILD SUCCESS
|
||
```
|
||
|
||
## Mentor-only control regression
|
||
|
||
**RED:** the focused MockMvc run reported two expected failures: `GET /projects/new` returned `200` for an Intern instead of non-disclosing `404`, and the member page rendered the `Add member` form for a non-owner.
|
||
|
||
**GREEN:** rerunning `./mvnw -Dtest=ProjectControllerTest test` after the controller/DTO/template correction passed 7 tests with zero failures, errors, or skips.
|
||
|
||
## Role-aware Project-list action regression
|
||
|
||
**RED:** the focused MockMvc run reported two expected failures after adding the list-action regression: the controller still resolved only a user ID, so the Mentor fixture was queried as user `0`, and an Intern-facing Project list rendered the `Create Project` link.
|
||
|
||
**GREEN:** rerunning `./mvnw -Dtest=ProjectControllerTest test` after resolving the public actor view and conditionally rendering the link passed 8 tests with zero failures, errors, or skips.
|
||
|
||
## External-test boundaries
|
||
|
||
This slice does not prove PostgreSQL query correctness, a real login flow, shared-shell navigation, browser accessibility, or Iteration 2 invitation/exit/completion pages. The activation route remains deferred with `I1-PRJ-04` until the Task feature query dependency is available.
|