I have built a custom module that alters some of the User routes (view, edit, delete) to do 3 things:

  • Forbid account editing, except a user who has 'administer users' permission

  • Forbid account deleting, except a user who has 'administer users' permission

  • Forbid account page viewing (/user/{user}) unless that account being viewed has a specific role AND has a boolean field value of TRUE

The accounts are synced from a remote source and logins provisioned by SSO, so, there is no point for anyone to access edit/delete except an admin/dev checking if accounts look correct.

The first two seem straightforward enough as it requires nothing but setting up some test users with different role permissions and checking the response from an edit or delete route.

For the third, what is the best way to provide simple configuration to get the field added to the User entity under test? Do I install my entire project config (seems heavy)? Is there a way I can selectively install some config for test only? I think I would just need one or two of the 800 config files to be installed. I checked some of the core tests, but couldn't quite locate one close to what I am asking.

  • This is probably too opinionated. My opinion is that if you want to test that the route is successfully altered, a kernel test to assert that some checks are called, would work, and then unit test the classes themselves with an unit test.
    – mradcliffe
    Aug 19, 2019 at 11:47

1 Answer 1


Wound up figuring this out I suppose, although I have no idea if this is the proper way.

Under the custom module I wanted to test, I created a 'tests' directory with a test module and within that new module placed 3 configuration files from my project config ("Show Profile" field storage, "Show Profile" field instance, user form display configuration).

In a functional test, I required that module:


namespace Drupal\Tests\mymodule\Functional;

use Drupal\Tests\BrowserTestBase;
use Drupal\user\Entity\Role;

 * Class ProfileAccessTest
 * @package Drupal\Tests\mymodule\Functional
class ProfileAccessTest extends BrowserTestBase {

   * A set of test users.
  protected $user1, $user2, $user3, $user4;

   * {@inheritdoc}
  protected static $modules = ['node', 'user', 'mymodule', 'system', 'mymodule_test'];

   * {@inheritdoc}
  protected function setUp() {

    $anon_role = Role::load(Role::ANONYMOUS_ID);
    $this->grantPermissions($anon_role, ['access user profiles']);

    $this->user1 = $this->drupalCreateUser(['access content', 'access user profiles'], 'regular_user');
    $this->user2 = $this->drupalCreateUser(['administer users'], 'john', TRUE);
    $this->user3 = $this->drupalCreateUser([], 'zzz', FALSE);
    $this->user4 = $this->drupalCreateUser([], 'yyy', FALSE);

  public function testProfileAccess() {
    // The average user should not be able to do anything to their own account.
    $this->drupalGet('/user/' . $this->user1->id());
    $this->drupalGet('/user/' . $this->user1->id() . '/edit');
    $this->drupalGet('/user/' . $this->user1->id() . '/cancel');

    $this->drupalGet('user/' . $this->user3->id() . '/edit');
    $edit['edit-field-show-profile-value'] = 1;
    $this->drupalPostForm("user/" . $this->user3->id() . "/edit", $edit, t('Save'));

    $this->drupalGet('user/' . $this->user4->id() . '/edit');
    $edit['edit-field-show-profile-value'] = 0;
    $this->drupalPostForm("user/" . $this->user4->id() . "/edit", $edit, t('Save'));

    // Any user should be able to view an account with SHOW PROFILE true.
    $this->drupalGet('/user/' . $this->user3->id());

    // But not if SHOW PROFILE is false.
    $this->drupalGet('/user/' . $this->user4->id());

The tests all pass, which is good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.