[CMS-Security] Test Cases 3 & 4

[ASPactores]

Test Case 3 - Single Global Permission (Homepage Config Global)

• Step 1: In Admin UI, create a Service Account with:
  • Enable API Key: Enabled
  • Permissions:
    • Resource: Select "Homepage Config"
    • Access Level: Select "Read & Write"
• Step 2: Send GET /api/globals/durianpy-website-homepage-config.
• Step 3: Send POST /api/globals/durianpy-website-homepage-config with update data.

Acceptance Criteria

• GET /api/globals/durianpy-website-homepage-config returns 200 OK.
• POST /api/globals/durianpy-website-homepage-config returns 200 OK.

Sample Request (curl)

# GET Global
curl --location 'http://localhost:3000/api/globals/durianpy-website-homepage-config' \
--header 'Authorization: service-accounts API-Key YOUR_API_KEY_HERE'

# POST Update Global
curl --location 'http://localhost:3000/api/globals/durianpy-website-homepage-config' \
--header 'Authorization: service-accounts API-Key YOUR_API_KEY_HERE' \
--header 'Content-Type: application/json' \
--data '{ "heroTitle": "DurianPy Davao Group" }'

Evidence

• Attach screenshot/video evidence directly in the comment.

---

Test Case 4 - Multi-Permission with Selective Access Control

• Step 1: In Admin UI, create a Service Account with two permissions:
  • Permission 1: Resource: Select "Events", Access Level: Select "Full Access"
  • Permission 2: Resource: Select "Homepage Config", Access Level: Select "Read"
• Step 2: Send GET /api/durianpy-website-events (Events collection - granted).
• Step 3: Send GET /api/globals/durianpy-website-homepage-config (Homepage Config global - granted).
• Step 4: Send GET /api/categories (Categories collection - NOT granted).

Acceptance Criteria

• Requests to /api/durianpy-website-events and /api/globals/durianpy-website-homepage-config return 200 OK.
• Request to /api/categories returns 403 Forbidden (only unassigned resources raise forbidden).

Sample Request (curl)

# Granted Collection (Events)
curl --location 'http://localhost:3000/api/durianpy-website-events' \
--header 'Authorization: service-accounts API-Key YOUR_API_KEY_HERE'

# Granted Global (Homepage Config)
curl --location 'http://localhost:3000/api/globals/durianpy-website-homepage-config' \
--header 'Authorization: service-accounts API-Key YOUR_API_KEY_HERE'

# Unassigned Collection (Categories - Forbidden)
curl --location 'http://localhost:3000/api/categories' \
--header 'Authorization: service-accounts API-Key YOUR_API_KEY_HERE'

Evidence

• Attach screenshot/video evidence directly in the comment.