Copilot commented on code in PR #7229:
URL: https://github.com/apache/texera/pull/7229#discussion_r3694924168
##########
amber/src/test/scala/org/apache/texera/web/resource/dashboard/file/WorkflowResourceSpec.scala:
##########
@@ -901,4 +904,133 @@ class WorkflowResourceSpec
assert(result.coverImage.isEmpty)
}
+ // ─── read/query and mutation endpoints (issue #7224)
────────────────────────
+
+ // Each test seeds its own workflow (createWorkflow mutates the pojo's wid,
so a
+ // shared fixture cannot be re-created); afterEach deletes them.
+ private def seedWorkflow(
+ user: SessionUser,
+ name: String,
+ description: String = "desc",
+ content: String = "{}"
+ ): DashboardWorkflow = {
+ val workflow = new Workflow()
+ workflow.setName(name)
+ workflow.setDescription(description)
+ workflow.setContent(content)
+ workflowResource.createWorkflow(workflow, user)
+ }
+
+ "WorkflowResource.retrieveWorkflow" should "return the workflow for a user
with access" in {
+ val wid = seedWorkflow(sessionUser1, "retrieve-me", "the-desc",
"{\"a\":1}").workflow.getWid
+ val result: WorkflowWithPrivilege = workflowResource.retrieveWorkflow(wid,
sessionUser1)
+ assert(result.wid == wid)
+ assert(result.name == "retrieve-me")
+ assert(result.description == "the-desc")
+ assert(!result.readonly) // the owner has write access
+ }
+
+ it should "throw ForbiddenException for a user without access" in {
+ val wid = seedWorkflow(sessionUser1, "no-access-wf").workflow.getWid
+ assertThrows[ForbiddenException](workflowResource.retrieveWorkflow(wid,
sessionUser2))
+ }
+
+ "WorkflowResource.retrieveIDs" should "return the ids of the user's
accessible workflows" in {
+ val wid = seedWorkflow(sessionUser1, "id-wf").workflow.getWid
+
assert(workflowResource.retrieveIDs(sessionUser1).asScala.contains(wid.toString))
+ }
+
+ "WorkflowResource.retrieveOwners" should "list owners only for accessible
workflows" in {
+ assert(workflowResource.retrieveOwners(sessionUser2).isEmpty) // user2
owns nothing yet
+ seedWorkflow(sessionUser1, "owned-wf")
+ assert(!workflowResource.retrieveOwners(sessionUser1).isEmpty)
+ }
Review Comment:
The `retrieveOwners` test is too weak to validate behavior: it only asserts
empty/non-empty and never verifies the returned owner values for an
actually-accessible workflow. This can pass even if the endpoint returns the
wrong owner identifiers or ignores access rules. Strengthen the test by
granting access to `sessionUser2` for a seeded workflow and asserting the
expected owner email is returned.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
