Skip to content

Commit 97529ea

Browse files
arnav-goel05arnav-goel05
authored
[#13304] Refactoring for Unit Test Access Controls (#13357)
* Refactor access control methods
1 parent 5e8a38d commit 97529ea

10 files changed

+38
-395
lines changed

‎src/test/java/teammates/sqlui/webapi/RegenerateInstructorKeyActionTest.java‎

Lines changed: 2 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -194,50 +194,11 @@ void testExecute_missingCourseId_throwsInvalidHttpParameterException() {
194194
}
195195

196196
@Test
197-
void testSpecificAccessControl_admin_canAccess() {
198-
loginAsAdmin();
199-
197+
void testAccessControl() {
200198
String[] params = {
201199
Const.ParamsNames.COURSE_ID, instructor.getCourseId(),
202200
Const.ParamsNames.INSTRUCTOR_EMAIL, instructor.getEmail(),
203201
};
204-
205-
verifyCanAccess(params);
206-
}
207-
208-
@Test
209-
void testSpecificAccessControl_instructor_cannotAccess() {
210-
loginAsInstructor("instructor-googleId");
211-
212-
String[] params = {
213-
Const.ParamsNames.COURSE_ID, instructor.getCourseId(),
214-
Const.ParamsNames.INSTRUCTOR_EMAIL, instructor.getEmail(),
215-
};
216-
217-
verifyCannotAccess(params);
218-
}
219-
220-
@Test
221-
void testSpecificAccessControl_student_cannotAccess() {
222-
loginAsStudent("student-googleId");
223-
224-
String[] params = {
225-
Const.ParamsNames.COURSE_ID, instructor.getCourseId(),
226-
Const.ParamsNames.INSTRUCTOR_EMAIL, instructor.getEmail(),
227-
};
228-
229-
verifyCannotAccess(params);
230-
}
231-
232-
@Test
233-
void testSpecificAccessControl_loggedOut_cannotAccess() {
234-
logoutUser();
235-
236-
String[] params = {
237-
Const.ParamsNames.COURSE_ID, instructor.getCourseId(),
238-
Const.ParamsNames.INSTRUCTOR_EMAIL, instructor.getEmail(),
239-
};
240-
241-
verifyCannotAccess(params);
202+
verifyOnlyAdminsCanAccess(params);
242203
}
243204
}

‎src/test/java/teammates/sqlui/webapi/RegenerateStudentKeyActionTest.java‎

Lines changed: 2 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -196,50 +196,11 @@ void testExecute_missingCourseId_throwsInvalidHttpParameterException() {
196196
}
197197

198198
@Test
199-
void testSpecificAccessControl_admin_canAccess() {
200-
loginAsAdmin();
201-
199+
void testAccessControl() {
202200
String[] params = {
203201
Const.ParamsNames.COURSE_ID, student.getCourseId(),
204202
Const.ParamsNames.STUDENT_EMAIL, student.getEmail(),
205203
};
206-
207-
verifyCanAccess(params);
208-
}
209-
210-
@Test
211-
void testSpecificAccessControl_instructor_cannotAccess() {
212-
loginAsInstructor("instructor-googleId");
213-
214-
String[] params = {
215-
Const.ParamsNames.COURSE_ID, student.getCourseId(),
216-
Const.ParamsNames.STUDENT_EMAIL, student.getEmail(),
217-
};
218-
219-
verifyCannotAccess(params);
220-
}
221-
222-
@Test
223-
void testSpecificAccessControl_student_cannotAccess() {
224-
loginAsStudent("student-googleId");
225-
226-
String[] params = {
227-
Const.ParamsNames.COURSE_ID, student.getCourseId(),
228-
Const.ParamsNames.STUDENT_EMAIL, student.getEmail(),
229-
};
230-
231-
verifyCannotAccess(params);
232-
}
233-
234-
@Test
235-
void testSpecificAccessControl_loggedOut_cannotAccess() {
236-
logoutUser();
237-
238-
String[] params = {
239-
Const.ParamsNames.COURSE_ID, student.getCourseId(),
240-
Const.ParamsNames.STUDENT_EMAIL, student.getEmail(),
241-
};
242-
243-
verifyCannotAccess(params);
204+
verifyOnlyAdminsCanAccess(params);
244205
}
245206
}

‎src/test/java/teammates/sqlui/webapi/ResetAccountActionTest.java‎

Lines changed: 10 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -277,70 +277,35 @@ void testExecute_instructorResetAccountThrowsEntityDoesNotExistException_throwsE
277277
}
278278

279279
@Test
280-
void testSpecificAccessControl_admin_canAccess() {
281-
loginAsAdmin();
282-
283-
String[] params1 = {
280+
void testAccessControl() {
281+
String[] params1 = {};
282+
String[] params2 = {
284283
Const.ParamsNames.STUDENT_EMAIL, stubStudent.getEmail(),
285284
Const.ParamsNames.COURSE_ID, stubStudent.getCourseId(),
286285
};
287-
verifyCanAccess(params1);
288-
289-
String[] params2 = {};
290-
verifyCanAccess(params2);
291-
292286
String[] params3 = {
293287
Const.ParamsNames.INSTRUCTOR_EMAIL, stubInstructor.getEmail(),
294288
};
295-
verifyCanAccess(params3);
296-
297289
String[] params4 = {
298290
Const.ParamsNames.STUDENT_EMAIL, stubStudent.getEmail(),
299291
};
300-
verifyCanAccess(params4);
301-
302292
String[] params5 = {
303293
Const.ParamsNames.INSTRUCTOR_EMAIL, stubInstructor.getEmail(),
304294
Const.ParamsNames.STUDENT_EMAIL, stubStudent.getEmail(),
305295
};
306-
verifyCanAccess(params5);
307-
308296
String[] params6 = {
309297
Const.ParamsNames.COURSE_ID, stubInstructor.getCourseId(),
310298
};
311-
verifyCanAccess(params6);
312-
313299
String[] params7 = {
314300
"random-params", "random-value",
315301
};
316-
verifyCanAccess(params7);
317-
}
318-
319-
@Test
320-
void testSpecificAccessControl_notAdmin_cannotAccess() {
321-
String[] params = {
322-
Const.ParamsNames.STUDENT_EMAIL, stubStudent.getEmail(),
323-
Const.ParamsNames.COURSE_ID, stubStudent.getCourseId(),
324-
};
325-
verifyCannotAccess(params);
326-
327-
loginAsInstructor(stubInstructor.getGoogleId());
328-
verifyCannotAccess(params);
329302

330-
logoutUser();
331-
loginAsStudent(stubStudent.getGoogleId());
332-
verifyCannotAccess(params);
333-
334-
logoutUser();
335-
loginAsMaintainer();
336-
verifyCannotAccess(params);
337-
338-
logoutUser();
339-
loginAsStudentInstructor(stubStudent.getGoogleId());
340-
verifyCannotAccess(params);
341-
342-
logoutUser();
343-
loginAsUnregistered(stubInstructor.getGoogleId());
344-
verifyCannotAccess(params);
303+
verifyOnlyAdminsCanAccess(params1);
304+
verifyOnlyAdminsCanAccess(params2);
305+
verifyOnlyAdminsCanAccess(params3);
306+
verifyOnlyAdminsCanAccess(params4);
307+
verifyOnlyAdminsCanAccess(params5);
308+
verifyOnlyAdminsCanAccess(params6);
309+
verifyOnlyAdminsCanAccess(params7);
345310
}
346311
}

‎src/test/java/teammates/sqlui/webapi/ResetAccountRequestActionTest.java‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -119,32 +119,10 @@ void testExecute_missingAccountRequestId_throwsInvalidHttpParameterException()
119119
}
120120

121121
@Test
122-
void testSpecificAccessControl_admin_canAccess() {
123-
loginAsAdmin();
124-
125-
String[] params = {
126-
Const.ParamsNames.ACCOUNT_REQUEST_ID, accountRequest.getId().toString(),
127-
};
128-
129-
verifyCanAccess(params);
130-
}
131-
132-
@Test
133-
void testSpecificAccessControl_notAdmin_cannotAccess() {
122+
void testAccessControl() {
134123
String[] params = {
135124
Const.ParamsNames.ACCOUNT_REQUEST_ID, accountRequest.getId().toString(),
136125
};
137-
138-
loginAsUnregistered("unregistered");
139-
verifyCannotAccess(params);
140-
141-
loginAsStudent("student");
142-
verifyCannotAccess(params);
143-
144-
loginAsInstructor("instructor");
145-
verifyCannotAccess(params);
146-
147-
logoutUser();
148-
verifyCannotAccess(params);
126+
verifyOnlyAdminsCanAccess(params);
149127
}
150128
}

‎src/test/java/teammates/sqlui/webapi/RestoreFeedbackSessionActionTest.java‎

Lines changed: 7 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import org.testng.annotations.BeforeMethod;
1111
import org.testng.annotations.Test;
1212

13-
import teammates.common.datatransfer.InstructorPrivileges;
1413
import teammates.common.exception.EntityDoesNotExistException;
1514
import teammates.common.util.Const;
1615
import teammates.storage.sqlentity.Course;
@@ -151,89 +150,20 @@ void testExecute_restoreFeedbackSessionThrowsEntityDoesNotExist_throwsEntityNotF
151150
}
152151

153152
@Test
154-
void testAccessControl_notLoggedIn_cannotAccess() {
155-
String[] params = new String[] {
156-
Const.ParamsNames.COURSE_ID, COURSE_ID,
157-
Const.ParamsNames.FEEDBACK_SESSION_NAME, FEEDBACK_SESSION_NAME,
158-
};
159-
160-
logoutUser();
161-
verifyCannotAccess(params);
162-
}
163-
164-
@Test
165-
void testAccessControl_unregisteredUser_cannotAccess() {
166-
String[] params = new String[] {
167-
Const.ParamsNames.COURSE_ID, COURSE_ID,
168-
Const.ParamsNames.FEEDBACK_SESSION_NAME, FEEDBACK_SESSION_NAME,
169-
};
170-
171-
loginAsUnregistered(GOOGLE_ID);
172-
verifyCannotAccess(params);
173-
}
174-
175-
@Test
176-
void testAccessControl_student_cannotAccess() {
177-
String[] params = new String[] {
178-
Const.ParamsNames.COURSE_ID, COURSE_ID,
179-
Const.ParamsNames.FEEDBACK_SESSION_NAME, FEEDBACK_SESSION_NAME,
180-
};
181-
182-
loginAsStudent(GOOGLE_ID);
183-
verifyCannotAccess(params);
184-
}
185-
186-
@Test
187-
void testAccessControl_instructorOfOtherCourses_cannotAccess() {
188-
when(mockLogic.getFeedbackSessionFromRecycleBin(FEEDBACK_SESSION_NAME, COURSE_ID))
189-
.thenReturn(stubFeedbackSession);
190-
Course otherCourse = getTypicalCourse();
191-
otherCourse.setId("other-course-id");
192-
stubInstructor.setCourse(otherCourse);
193-
when(mockLogic.getInstructorByGoogleId(COURSE_ID, GOOGLE_ID)).thenReturn(stubInstructor);
194-
195-
String[] params = new String[] {
196-
Const.ParamsNames.COURSE_ID, COURSE_ID,
197-
Const.ParamsNames.FEEDBACK_SESSION_NAME, FEEDBACK_SESSION_NAME,
198-
};
199-
200-
loginAsInstructor(GOOGLE_ID);
201-
verifyCannotAccess(params);
202-
}
203-
204-
@Test
205-
void testAccessControl_instructorOfSameCourseWithoutCorrectCoursePrivilege_cannotAccess() {
206-
when(mockLogic.getFeedbackSessionFromRecycleBin(FEEDBACK_SESSION_NAME, COURSE_ID))
207-
.thenReturn(stubFeedbackSession);
208-
InstructorPrivileges privileges = new InstructorPrivileges();
209-
privileges.updatePrivilege(Const.InstructorPermissions.CAN_MODIFY_SESSION, false);
210-
stubInstructor.setPrivileges(privileges);
211-
when(mockLogic.getInstructorByGoogleId(COURSE_ID, GOOGLE_ID)).thenReturn(stubInstructor);
212-
213-
String[] params = new String[] {
214-
Const.ParamsNames.COURSE_ID, COURSE_ID,
215-
Const.ParamsNames.FEEDBACK_SESSION_NAME, FEEDBACK_SESSION_NAME,
216-
};
217-
218-
loginAsInstructor(GOOGLE_ID);
219-
verifyCannotAccess(params);
220-
}
221-
222-
@Test
223-
void testAccessControl_instructorOfSameCourseWithCorrectCoursePrivilege_canAccess() {
153+
void testAccessControl() {
224154
when(mockLogic.getFeedbackSessionFromRecycleBin(FEEDBACK_SESSION_NAME, COURSE_ID))
225155
.thenReturn(stubFeedbackSession);
226-
InstructorPrivileges privileges = new InstructorPrivileges();
227-
privileges.updatePrivilege(Const.InstructorPermissions.CAN_MODIFY_SESSION, true);
228-
stubInstructor.setPrivileges(privileges);
229-
when(mockLogic.getInstructorByGoogleId(COURSE_ID, GOOGLE_ID)).thenReturn(stubInstructor);
230156

231157
String[] params = new String[] {
232158
Const.ParamsNames.COURSE_ID, COURSE_ID,
233159
Const.ParamsNames.FEEDBACK_SESSION_NAME, FEEDBACK_SESSION_NAME,
234160
};
235161

236-
loginAsInstructor(GOOGLE_ID);
237-
verifyCanAccess(params);
162+
verifyOnlyInstructorsOfTheSameCourseWithCorrectCoursePrivilegeCanAccess(
163+
stubFeedbackSession.getCourse(),
164+
Const.InstructorPermissions.CAN_MODIFY_SESSION,
165+
params
166+
);
167+
verifyInstructorsOfOtherCoursesCannotAccess(params);
238168
}
239169
}

‎src/test/java/teammates/sqlui/webapi/SearchAccountRequestsActionTest.java‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -139,32 +139,10 @@ void testExecute_nullSearchKey_throwsInvalidHttpParameterException() {
139139
}
140140

141141
@Test
142-
void testSpecificAccessControl_admin_canAccess() {
143-
loginAsAdmin();
144-
145-
String[] params = {
146-
Const.ParamsNames.SEARCH_KEY, searchKey,
147-
};
148-
149-
verifyCanAccess(params);
150-
}
151-
152-
@Test
153-
void testSpecificAccessControl_notAdmin_cannotAccess() {
142+
void testAccessControl() {
154143
String[] params = {
155144
Const.ParamsNames.SEARCH_KEY, searchKey,
156145
};
157-
158-
loginAsUnregistered("unregistered");
159-
verifyCannotAccess(params);
160-
161-
loginAsStudent("student");
162-
verifyCannotAccess(params);
163-
164-
loginAsInstructor("instructor");
165-
verifyCannotAccess(params);
166-
167-
logoutUser();
168-
verifyCannotAccess(params);
146+
verifyOnlyAdminsCanAccess(params);
169147
}
170148
}

0 commit comments

Comments
 (0)