How to test if user is denied access when her role has no "access content"

Question

Wanting to test that only users with "access content" have access:

public function testOnlyAccessContentAccessible() {
  $web_user = $this->drupalCreateUser();
  $this->drupalLogin($web_user);
  $this->drupalGet("foo");
  $this->assertResponse(403);
}

The module under test, relevant hook_menu-entry:

$items['foo'] = array(
  'title' => 'Foo',
  'page callback' => 'foo',
  'access arguments' => array("access content"),
  'expanded' => TRUE,
);

What is wrong here? My drupalCreateUser has not recieved an array with permissions, so it did not receive the "access content" permission either; yet Drupal hands out this permission by default, so I guess this is a permission that is "default" when nothing is posted.

So, how to check that only users with permission "access content" can access a page?

Answer 1

I recommend saving out your permissions using Features and then loading your custom feature in your test. By doing that, you can test out your configuration settings.

If you really just want to turn programmatically create a user that does not have the 'access content' permission, try this before you create your $web_user:

user_role_revoke_permissions(1, array('access content'));

This will revoke the 'access content' permission for anonymous users (role 1). See http://api.drupal.org/api/drupal/modules%21user%21user.module/function/user_role_revoke_permissions/7 for more help.

Answer 2

A couple of issue going on here.

The default installation profile is going to grant both anonymous and authenticated users access to the "access content" permission.

If this is a custom module which will be running in a custom profile then a simple way around this is to set up your own Testing profile which doesn't give any roles any permissions by default.

At 1st I was going to recommend you switch your test to use the Testing profile (Which you can still do if you're using the default profile, since thats faster). Sadly after checking the testing profile also grants access to both anonymous and authenticated users the "access content" permission.

So that's one issue, combined with when you create a user with the drupalCreateUser and log that user in that user is always going to have the the default permissions derived from the "authenticated users" role.

If you really want to "uncheck" that permission you need to remember to do it inside the same test case because the Test environment will be rebuild in each test case which means the default permissions will be reassign to the authenticated role when you run your test.

So in short:

• Either disable the permission inside your testOnlyAccessContentAccessible test case
• or create a custom testing profile that doesn't assign that permission to the authenticated role. (An make sure you change your web test class to use that profile).

Answer 3

Access content is granted by default by Drupal to all users, even if they are anonymous.

If you need your site to behave any different, you should unset the view published content permission for anonymous users. This is normally done, in Drupal 7, by visiting the page admin/people/permissions and remove the checkmark for view published content for the user.