Test Evidence: Attendance and global-calendar web authorization

Test type: Web
Requirement IDs: AUTH-001, AUTH-002, AUTH-003, ATT-007, ATT-010, CAL-001, CAL-007, RPT-004
Scenario IDs: AC-ATT-003, AC-ATT-004, AC-CAL-004
Test class/method: com.lab.labtimesheet.feature.attendance.controller.AttendanceControllerTest
Implementation commit: pending (committed with this evidence)

Protected behavior

Authenticated Intern punch routes use the server-resolved user ID, own history renders attached policy details, Mentor inspection routes preserve the target scope, and calendar management rejects non-Admin access. Calendar updates carry the submitted optimistic version.

Test method

@WebMvcTest runs Spring Security filters, CSRF protection, MVC binding, route selection, controller authorization, Thymeleaf rendering, and service-call arguments while mocking only application-service and current-user boundaries.

Hand-derived expected result

An Intern authenticated as user 42 can punch only ID 42. A Mentor can inspect target 42 but receives HTTP 403 for Admin calendar management. Attached policy grace renders as 30 min. An event form with version 3 calls update with 3.

RED

Command

export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
./mvnw -Dtest=AttendanceControllerTest test

Observed result

[ERROR] cannot find symbol: class AttendanceCurrentUserService
[ERROR] cannot find symbol: class AttendanceController
[ERROR] cannot find symbol: class CalendarController
[INFO] 3 errors
[INFO] BUILD FAILURE
Process exited 1 because the required authenticated web endpoints did not exist.

GREEN

Command

export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
./mvnw -Dtest=AttendanceControllerTest test

Observed result

Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Process exited 0.

Affected suite

Command and result

export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest='*Attendance*Test' test
Tests run: 26, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Process exited 0.

External-test boundaries

This MVC slice does not prove the platform's production login/session setup, shared shell and navigation, browser layout, or accessibility beyond semantic labels, table headers, status roles, CSRF, and route authorization.

2.5 KiB Raw Blame History