The tavern's security has already given way once (remember the stolen keys). Now Gorm wants tests that check every access rule, for every role:
| Who | In the kitchen (/kitchen/new-dish) |
Editing a dish (/kitchen/dish/{slug}/edit) |
|---|---|---|
| Visitor, not logged in | redirected to /login |
redirected to /login |
| Pippin, no role | 403 | 403 |
| Bruna, cook | 200 | her own dishes only (403 for the others) |
| Gorm, the boss | 200 (he has the rights of a cook) | every dish |
Your mission
In tests/Taverne/DroitsTest.php (the rights test), prepare the staff members and the dishes, then test this table.
Logging in during a test
No need to fill in the login form in every test: $client->loginUser($employe) opens a session in their name straight away. The connecter($email) (log in) helper is already there.
Testing both sides
A security test that only checks what is allowed lets doors left open slip through. A test that only checks what is forbidden lets doors closed by mistake slip through. You need both.
Four mutants 🐛, one per rule.