mengw15 commented on code in PR #7229:
URL: https://github.com/apache/texera/pull/7229#discussion_r3694962326
##########
amber/src/test/scala/org/apache/texera/web/resource/dashboard/file/WorkflowResourceSpec.scala:
##########
@@ -901,4 +904,133 @@ class WorkflowResourceSpec
assert(result.coverImage.isEmpty)
}
+ // ─── read/query and mutation endpoints (issue #7224)
────────────────────────
+
+ // Each test seeds its own workflow (createWorkflow mutates the pojo's wid,
so a
+ // shared fixture cannot be re-created); afterEach deletes them.
+ private def seedWorkflow(
+ user: SessionUser,
+ name: String,
+ description: String = "desc",
+ content: String = "{}"
+ ): DashboardWorkflow = {
+ val workflow = new Workflow()
+ workflow.setName(name)
+ workflow.setDescription(description)
+ workflow.setContent(content)
+ workflowResource.createWorkflow(workflow, user)
+ }
+
+ "WorkflowResource.retrieveWorkflow" should "return the workflow for a user
with access" in {
+ val wid = seedWorkflow(sessionUser1, "retrieve-me", "the-desc",
"{\"a\":1}").workflow.getWid
+ val result: WorkflowWithPrivilege = workflowResource.retrieveWorkflow(wid,
sessionUser1)
+ assert(result.wid == wid)
+ assert(result.name == "retrieve-me")
+ assert(result.description == "the-desc")
+ assert(!result.readonly) // the owner has write access
+ }
+
+ it should "throw ForbiddenException for a user without access" in {
+ val wid = seedWorkflow(sessionUser1, "no-access-wf").workflow.getWid
+ assertThrows[ForbiddenException](workflowResource.retrieveWorkflow(wid,
sessionUser2))
+ }
+
+ "WorkflowResource.retrieveIDs" should "return the ids of the user's
accessible workflows" in {
+ val wid = seedWorkflow(sessionUser1, "id-wf").workflow.getWid
+
assert(workflowResource.retrieveIDs(sessionUser1).asScala.contains(wid.toString))
+ }
+
+ "WorkflowResource.retrieveOwners" should "list owners only for accessible
workflows" in {
+ assert(workflowResource.retrieveOwners(sessionUser2).isEmpty) // user2
owns nothing yet
+ seedWorkflow(sessionUser1, "owned-wf")
+ assert(!workflowResource.retrieveOwners(sessionUser1).isEmpty)
+ }
Review Comment:
Strengthened — now asserts the exact owner email: the owner sees itself, and
a user granted read access to another user's workflow sees that owner's email
(not its own), covering the access-vs-ownership join.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
