4.1 KiB
Test Evidence: Authorized Project pages
- Test type: Web
- Requirement IDs:
AUTH-001,AUTH-002,AUTH-006,PRJ-001,PRJ-004–PRJ-006,PRJ-012,SEC-001,ERR-001 - Scenario IDs:
AC-AUTH-001,AC-AUTH-002,AC-AUTH-007,AC-PRJ-006,I1-PRJ-04,I1-PRJ-05 - Test class/method:
com.lab.labtimesheet.feature.project.controller.ProjectControllerTest - Implementation commits:
25a855e,a9ee99a,2f25731,dbf1202
Protected behavior
Authenticated users receive only authorized Project routes; guessed IDs return a non-disclosing not-found response; valid Mentor create requests use the authenticated identity; invalid forms do not mutate; the planned-Project activation action is shown only to the owning Mentor; state changes require CSRF.
Test method
MockMvc exercises the real controller, binding, Bean Validation, exception mapping, view selection, redirect, Spring Security authentication, and CSRF filter. Only application/query services are mocked.
Hand-derived expected result
An authorized list request renders projects/list. An unauthorized direct ID returns 404. Member and leadership routes authorize through actor plus Project ID. A valid create redirects to the created detail ID; a blank name and zero Leader ID render field errors and make no service call. An owning Mentor can submit activation and is redirected to detail; non-owners do not receive that control. POST without CSRF returns 403.
RED
Command
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
./mvnw -Dtest=ProjectControllerTest test
Observed result
[ERROR] cannot find symbol: class ProjectController
[ERROR] cannot find symbol: class ProjectPageService
[INFO] BUILD FAILURE
GREEN
Command
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
./mvnw -Dtest=ProjectControllerTest test
Observed result
[INFO] Running com.lab.labtimesheet.feature.project.controller.ProjectControllerTest
[INFO] Tests run: 10, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
Affected suite
Command and result
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw test
[INFO] Tests run: 111, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
Mentor-only control regression
RED: the focused MockMvc run reported two expected failures: GET /projects/new returned 200 for an Intern instead of non-disclosing 404, and the member page rendered the Add member form for a non-owner.
GREEN: rerunning ./mvnw -Dtest=ProjectControllerTest test after the controller/DTO/template correction passed 7 tests with zero failures, errors, or skips.
Role-aware Project-list action regression
RED: the focused MockMvc run reported two expected failures after adding the list-action regression: the controller still resolved only a user ID, so the Mentor fixture was queried as user 0, and an Intern-facing Project list rendered the Create Project link.
GREEN: rerunning ./mvnw -Dtest=ProjectControllerTest test after resolving the public actor view and conditionally rendering the link passed 8 tests with zero failures, errors, or skips.
Activation-route regression
RED: the focused MockMvc run reported two expected failures: POST /projects/30/activate returned 404, and the owning Mentor's planned-Project detail did not render the Activate action.
GREEN: after adding the CSRF-protected POST route and owner/status-conditional Thymeleaf form, the two focused tests passed; the full ProjectControllerTest class passed 10 tests with zero failures, errors, or skips.
External-test boundaries
This slice does not prove PostgreSQL query correctness, a real login flow, shared-shell navigation, browser accessibility, or Iteration 2 invitation/exit/completion pages. Server-side activation authorization and Task-assignee atomicity are covered by Project domain and PostgreSQL integration tests.