Testing magento 2 admin user _isAllowed

Question

Started off building my first module in M2. I'm trying to write a test to prove whether an admin role has the correct resource for the module im building and if not check that the correct return status is received.

First question is - should I actually be testing this? It seemed like a pretty good test in terms of functionality being correct, but then i was thinking that Magento have probably already covered the testing of ACL.

Secondly here is where im at, but don't seem to be having much luck mainly due to not getting my head around fixtures I think:

The test:

    /**
     *
     * @magentoAppArea adminhtml
     * @magentoDataFixture Magento/User/_files/user_with_role.php
     * @magentoDataFixture loadFixture
     */

    public function testLockedAdminHasNoAccessToRoute()
    {
        /** @var User $role */
        $user = $this->objectManager->create(User::class);
        $adminUser = $user->loadByUsername('adminUser');
        /** @var Session $adminSession */
        $adminSession = $this->objectManager->create(Session::class);
        $adminSession->start();
        $adminSession->setUser($adminUser);
        $adminSession->processLogin();
        $loggedInUser = $adminSession->getUser();

        $this->assertFalse($adminSession->isAllowed('Vendor_Module::manage'));
    }

And I am using the magento user_with_role.php fixture to create an admin user, and then using a custom fixture i've written to create a role without access to my modules resource:

<?php
/** @var \Magento\Authorization\Model\Role $model */
$model = Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create('Magento\Authorization\Model\Role');
$model->setName('No Access')
    ->setPid(0)
    ->setRoleType(\Magento\Authorization\Model\Acl\Role\Group::ROLE_TYPE)
    ->setUserType(\Magento\Authorization\Model\UserContextInterface::USER_TYPE_ADMIN)
    ->setUserId(3);
$model->save();

$resource=[
    'Magento_backend::admin',
    'Magento_Sales::sales',
    'Magento_Sales::create',
    'Magento_Sales::actions_view',
    'Magento_Sales::cancel'
];

$rules = Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create('Magento\Authorization\Model\Rules');
$rules
    ->setRoleId($model->getId())
    ->setResources($resource)
    ->saveRel();

The test is pretty self explanatory and all seems to work except the fact that the test always fails as it thinks the user has got access to my resource even though i've assigned the user to my custom role without it.

I think i'm getting confused :(

Any help much appreciated.

Answer 1

First question is - should I actually be testing this? It seemed like a pretty good test in terms of functionality being correct, but then i was thinking that Magento have probably already covered the testing of ACL.

That's a good question to ask yourself. Usually you don't want to test core functionality. However, you want to test that your module is using this core functionality in the right way. In this case it means that you want to have an integration test that checks if your controller uses the right ACL resource.

Good news is, the AbstractBackendController test case already contains two reusable tests:

1. if access is allowed with the given ACL resource
2. if acccess is denied without the given ACL resource

To use it, extend this base class and override the setUp method as follows:

use Magento\TestFramework\TestCase\AbstractBackendController;

class ConfigTest extends AbstractBackendController
{

    protected function setUp()
    {
        parent::setUp();
        $this->uri = 'backend/admin/my_module/my_action';
        $this->resource = 'My_Module::my_action';
    }
}

See also: Test configuration pages with AbstractBackendController: testAclNoAccess fails (there I describe a test for a system configuration area which needs a special treatment)