86 lines
2.5 KiB
Markdown
86 lines
2.5 KiB
Markdown
# Test Evidence: Attendance and global-calendar web authorization
|
|
|
|
- **Test type:** Web
|
|
- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-003`, `ATT-007`, `ATT-010`, `CAL-001`, `CAL-007`, `RPT-004`
|
|
- **Scenario IDs:** `AC-ATT-003`, `AC-ATT-004`, `AC-CAL-004`
|
|
- **Test class/method:** `com.lab.labtimesheet.feature.attendance.controller.AttendanceControllerTest`
|
|
- **Implementation commit:** `pending (committed with this evidence)`
|
|
|
|
## Protected behavior
|
|
|
|
Authenticated Intern punch routes use the server-resolved user ID, own history
|
|
renders attached policy details, Mentor inspection routes preserve the target
|
|
scope, and calendar management rejects non-Admin access. Calendar updates carry
|
|
the submitted optimistic version.
|
|
|
|
## Test method
|
|
|
|
`@WebMvcTest` runs Spring Security filters, CSRF protection, MVC binding, route
|
|
selection, controller authorization, Thymeleaf rendering, and service-call
|
|
arguments while mocking only application-service and current-user boundaries.
|
|
|
|
## Hand-derived expected result
|
|
|
|
An Intern authenticated as user 42 can punch only ID 42. A Mentor can inspect
|
|
target 42 but receives HTTP 403 for Admin calendar management. Attached policy
|
|
grace renders as `30 min`. An event form with version 3 calls update with 3.
|
|
|
|
## RED
|
|
|
|
**Command**
|
|
|
|
```text
|
|
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
|
export PATH="$JAVA_HOME/bin:$PATH"
|
|
./mvnw -Dtest=AttendanceControllerTest test
|
|
```
|
|
|
|
**Observed result**
|
|
|
|
```text
|
|
[ERROR] cannot find symbol: class AttendanceCurrentUserService
|
|
[ERROR] cannot find symbol: class AttendanceController
|
|
[ERROR] cannot find symbol: class CalendarController
|
|
[INFO] 3 errors
|
|
[INFO] BUILD FAILURE
|
|
Process exited 1 because the required authenticated web endpoints did not exist.
|
|
```
|
|
|
|
## GREEN
|
|
|
|
**Command**
|
|
|
|
```text
|
|
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
|
export PATH="$JAVA_HOME/bin:$PATH"
|
|
./mvnw -Dtest=AttendanceControllerTest test
|
|
```
|
|
|
|
**Observed result**
|
|
|
|
```text
|
|
Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
|
|
BUILD SUCCESS
|
|
Process exited 0.
|
|
```
|
|
|
|
## Affected suite
|
|
|
|
**Command and result**
|
|
|
|
```text
|
|
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
|
export PATH="$JAVA_HOME/bin:$PATH"
|
|
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
|
|
./mvnw -Dtest='*Attendance*Test' test
|
|
Tests run: 26, Failures: 0, Errors: 0, Skipped: 0
|
|
BUILD SUCCESS
|
|
Process exited 0.
|
|
```
|
|
|
|
## External-test boundaries
|
|
|
|
This MVC slice does not prove the platform's production login/session setup,
|
|
shared shell and navigation, browser layout, or accessibility beyond semantic
|
|
labels, table headers, status roles, CSRF, and route authorization.
|