我应该测试每个Web应用程序路由的授权吗？

Question

I have a question about testing coverage. I'm developing a basic CRUD application that has certain access rules. Authenticated users can create/edit forms, and allow other users either edit or view access to a form. What I'm wondering is should I write a feature test for every possible authorisation scenario, i.e:

• A guest can't edit a form
• A user can edit their own form
• A user can't edit another users form
• A user can edit another users form they have 'edit' access to
• A user can't edit another users form they have 'view' access to

These will then need to be written for every feature, such as deleting a form, viewing the form's responses etc.

Do these all need to be included to ensure that authorisation is applied at the right level for every feature? Or should just the basic functionality be feature tested (i.e. a user can edit their form), and then have a unit test to check the authorisation middleware and trust that's enough?

Edit: I know how to add the authorisation I need, I'm just asking whether on not to test it at every level.

Answer 1

MY ANSWER IS FOR

I'm developing a basic CRUD application

if you are doing muliple user types application implement roles and permissions

can be found here

https://laravel-news.com/two-best-roles-permissions-packages

Or Implement Your Own

else

Question 1:

A guest can't edit a form

Route::middleware(['web', 'auth'])->group(function () 
{
    //authenticated user functions
    Route::get('testmiddleware',function(){return 'user is loggend in';});
    Route::get('/posts/{post}/edit',  'PostController@edit')->name('posts.edit');
    Route::put('/posts/{post}',  'PostController@update')->name('post.update');

});

Question 2 & 3:

A user can edit their own form AND A user can't edit another users form

For Example consider that i have a filed user_id in post in the posts table

public function edit($id,Post $Post)
    {
       $post = Post::findOrFail($id);        

        if ($post->user_id != auth()->user()->id) 
        {
            abort(401);
        }

        $viewShare = ['post'];
        return view('post.edit',compact($viewShare));
    }

Question 4 & 5:

A user can edit another users form they have 'edit' access to

A user can't edit another users form they have 'view' access to

I have no idea to do it but you can do it by role-based access control.