Configuration and ReadingGroup ownership models are not used for acceptance tests

[rafamanzo]

Create test cases qhere the user does not own them!

[beatrizrezener]

But, if I create test cases where the user does not own them, the mezuro_configuration_ownership and reading_group_ownership models will keep uncovered, won't it?

[rafamanzo]

You are correct, maybe I was momentarily crazy while writing this :)

There is a chance that the uncovered methods of these models are never used maybe. But we still need some tests for when the user does not own them even that they will not raise the coverage.

[beatrizrezener]

I removed these methods in the pull request #160 . They were only used by some methods that are not used anywhere. Ok?

[beatrizrezener]

About the case where user does not own them, I think that the following scenarios already test this:

• Scenario: Should not show edit links from configurations that doesn't belongs to me
  https://github.com/mezuro/prezento/blob/master/features/mezuro_configuration/edition.feature
• Scenario: Should not show edit links from reading groups that doesn't belongs to me
  https://github.com/mezuro/prezento/blob/master/features/reading_group/edit.feature

What you think? Further testing is required?

[mezurometrics]

I think it is necessary.

Suppose a user knows how to write the URL to access the edit pages (or
update and delete) of a Configuration or ReadingGroup that he does not own.
If there is no user authentication before, he will gain access to a
resource that he should not.

Notice that this case, when you are using meaningful routes is actually
likely to happen since it is easy to guess the URLs.

Em Wed Nov 26 2014 at 2:02:15 PM, Beatriz Rezener [email protected]
escreveu:

About the case where user does not own them, I think that the following
scenarios already test this:

Scenario: Should not show edit links from configurations that doesn't
belongs to me

https://github.com/mezuro/prezento/blob/master/features/mezuro_configuration/edition.feature

Scenario: Should not show edit links from reading groups that doesn't
belongs to me

https://github.com/mezuro/prezento/blob/master/features/reading_group/edit.feature

What you think? Further testing is required?

—
Reply to this email directly or view it on GitHub
#42 (comment).

[jgbrittos]

Hi,

These scenarios has already been tested in rspec too. I think this issue may be closed...

Reading Group: https://github.com/mezuro/prezento/blob/master/spec/controllers/reading_groups_controller_spec.rb

Mezuro Configuration:
https://github.com/mezuro/prezento/blob/master/spec/controllers/mezuro_configurations_controller_spec.rb

[rafamanzo]

These are unit tests.

This issue is about acceptance tests using cucumber :)