How to write test(s) with specific config to test custom access checks?

Question

I have built a custom module that alters some of the User routes (view, edit, delete) to do 3 things:

• Forbid account editing, except a user who has 'administer users' permission

• Forbid account deleting, except a user who has 'administer users' permission

• Forbid account page viewing (/user/{user}) unless that account being viewed has a specific role AND has a boolean field value of TRUE

The accounts are synced from a remote source and logins provisioned by SSO, so, there is no point for anyone to access edit/delete except an admin/dev checking if accounts look correct.

The first two seem straightforward enough as it requires nothing but setting up some test users with different role permissions and checking the response from an edit or delete route.

For the third, what is the best way to provide simple configuration to get the field added to the User entity under test? Do I install my entire project config (seems heavy)? Is there a way I can selectively install some config for test only? I think I would just need one or two of the 800 config files to be installed. I checked some of the core tests, but couldn't quite locate one close to what I am asking.

Answer 1

Wound up figuring this out I suppose, although I have no idea if this is the proper way.

Under the custom module I wanted to test, I created a 'tests' directory with a test module and within that new module placed 3 configuration files from my project config ("Show Profile" field storage, "Show Profile" field instance, user form display configuration).

In a functional test, I required that module:

<?php

namespace Drupal\Tests\mymodule\Functional;

use Drupal\Tests\BrowserTestBase;
use Drupal\user\Entity\Role;

/**
 * Class ProfileAccessTest
 * @package Drupal\Tests\mymodule\Functional
 */
class ProfileAccessTest extends BrowserTestBase {

  /**
   * A set of test users.
   */
  protected $user1, $user2, $user3, $user4;

  /**
   * {@inheritdoc}
   */
  protected static $modules = ['node', 'user', 'mymodule', 'system', 'mymodule_test'];

  /**
   * {@inheritdoc}
   */
  protected function setUp() {
    parent::setUp();

    $anon_role = Role::load(Role::ANONYMOUS_ID);
    $this->grantPermissions($anon_role, ['access user profiles']);

    $this->user1 = $this->drupalCreateUser(['access content', 'access user profiles'], 'regular_user');
    $this->user2 = $this->drupalCreateUser(['administer users'], 'john', TRUE);
    $this->user3 = $this->drupalCreateUser([], 'zzz', FALSE);
    $this->user4 = $this->drupalCreateUser([], 'yyy', FALSE);
  }

  public function testProfileAccess() {
    // The average user should not be able to do anything to their own account.
    $this->drupalLogin($this->user1);
    $this->drupalGet('/user/' . $this->user1->id());
    $this->assertResponse(403);
    $this->drupalGet('/user/' . $this->user1->id() . '/edit');
    $this->assertResponse(403);
    $this->drupalGet('/user/' . $this->user1->id() . '/cancel');
    $this->assertResponse(403);

    $this->drupalLogin($this->user2);
    $this->drupalGet('user/' . $this->user3->id() . '/edit');
    $edit['edit-field-show-profile-value'] = 1;
    $this->drupalPostForm("user/" . $this->user3->id() . "/edit", $edit, t('Save'));

    $this->drupalGet('user/' . $this->user4->id() . '/edit');
    $edit['edit-field-show-profile-value'] = 0;
    $this->drupalPostForm("user/" . $this->user4->id() . "/edit", $edit, t('Save'));

    // Any user should be able to view an account with SHOW PROFILE true.
    $this->drupalLogin($this->user1);
    $this->drupalGet('/user/' . $this->user3->id());
    $this->assertResponse(200);

    // But not if SHOW PROFILE is false.
    $this->drupalGet('/user/' . $this->user4->id());
    $this->assertResponse(403);
  }
}

The tests all pass, which is good.