test: add tests for unprotected behavior

[nilsreichardt]

Objective

Continuously improve reliability by adding high-value tests for unprotected behaviors that could cause incorrect permissions or visibility.

What is now protected

1. Group Content & Admin Permissions: Ensured hasPermission extension on MemberRole appropriately verifies content creation and administration rights. Verified isUserAdminOrOwnerOfGroup allows only owner/admin roles.
2. Timetable Permissions: Ensured hasPermissionToManageLessons checks content creation and hasPermissionToManageEvents adequately checks both role and authorship, allowing proper management of schedules.
3. Submission Permissions: Validated the SubmissionPermissions class correctly blocks standard students from viewing submissions while allowing teachers holding an admin/owner course role.

What bugs it prevents

• Unprivileged users (e.g. standard students) gaining accidental edit capabilities or viewing permissions.
• Data exposure from incorrect evaluations of course roles vs user roles when viewing homework submissions.
• Users mistakenly editing or scheduling events on global timetables they are not authors or admins of.

---

PR created automatically by Jules for task 13501131065073978994 started by @nilsreichardt

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request adds a valuable set of tests for permission-related logic, improving the reliability of the application. The tests are well-structured and cover the intended scenarios correctly. I've suggested some refactorings to reduce boilerplate code in the test files, which will make them more concise and easier to maintain in the future.

[gemini-code-assist]

The tests in these groups are repetitive. You can use a data-driven approach with a map of test cases to make the code more concise and maintainable. This pattern can also be applied to the isUserAdminOrOwnerOfGroup test group.

    group('hasPermission for administration', () {
      final testCases = <MemberRole, bool>{
        MemberRole.owner: true,
        MemberRole.admin: true,
        MemberRole.creator: false,
        MemberRole.standard: false,
      };

      for (final entry in testCases.entries) {
        test('should be ${entry.value} for ${entry.key.name}', () {
          expect(
            entry.key.hasPermission(GroupPermission.administration),
            entry.value,
          );
        });
      }
    });

    group('hasPermission for contentCreation', () {
      final testCases = <MemberRole, bool>{
        MemberRole.owner: true,
        MemberRole.admin: true,
        MemberRole.creator: true,
        MemberRole.standard: false,
      };

      for (final entry in testCases.entries) {
        test('should be ${entry.value} for ${entry.key.name}', () {
          expect(
            entry.key.hasPermission(GroupPermission.contentCreation),
            entry.value,
          );
        });
      }
    });

[gemini-code-assist]

The tests in this group are very similar and contain duplicated code. You can refactor this using a data-driven approach to make the tests more concise and easier to maintain and extend.

  group('SubmissionPermissions.isAllowedToViewSubmittedPermissions', () {
    final homework = HomeworkDto.create(courseID: 'course1');

    final testCases = <String, ({TypeOfUser userType, MemberRole? role, bool expected})>{
      'allow when user is teacher and is admin in course': (
        userType: TypeOfUser.teacher,
        role: MemberRole.admin,
        expected: true,
      ),
      'allow when user is teacher and is owner in course': (
        userType: TypeOfUser.teacher,
        role: MemberRole.owner,
        expected: true,
      ),
      'deny when user is teacher but only standard in course': (
        userType: TypeOfUser.teacher,
        role: MemberRole.standard,
        expected: false,
      ),
      'deny when user is student even if admin in course': (
        userType: TypeOfUser.student,
        role: MemberRole.admin,
        expected: false,
      ),
      'deny when course role is null (defaults to standard)': (
        userType: TypeOfUser.teacher,
        role: null,
        expected: false,
      ),
    };

    for (final entry in testCases.entries) {
      test('should ${entry.key}', () async {
        when(mockCourseGateway.getRoleFromCourseNoSync(any))
            .thenReturn(entry.value.role);
        final stream = Stream.value(entry.value.userType);
        final permissions = SubmissionPermissions(stream, mockCourseGateway);

        final result =
            await permissions.isAllowedToViewSubmittedPermissions(homework);

        expect(result, entry.value.expected);
      });
    }
  });

[gemini-code-assist]

The test groups in this file contain repetitive test cases. You can use a data-driven approach to make them more concise and maintainable, reducing boilerplate code.

  group('hasPermissionToManageLessons', () {
    final testCases = <MemberRole, bool>{
      MemberRole.owner: true,
      MemberRole.admin: true,
      MemberRole.creator: true,
      MemberRole.standard: false,
    };

    for (final entry in testCases.entries) {
      test('should be ${entry.value} for ${entry.key.name}', () {
        expect(hasPermissionToManageLessons(entry.key), entry.value);
      });
    }
  });

  group('hasPermissionToManageEvents', () {
    group('when user is author', () {
      final testCases = <MemberRole, bool>{
        MemberRole.owner: true,
        MemberRole.admin: true,
        MemberRole.creator: true,
        MemberRole.standard: true,
      };
      for (final entry in testCases.entries) {
        test('should be ${entry.value} for role ${entry.key.name}', () {
          expect(hasPermissionToManageEvents(entry.key, true), entry.value);
        });
      }
    });

    group('when user is not author', () {
      final testCases = <MemberRole, bool>{
        MemberRole.owner: true,
        MemberRole.admin: true,
        MemberRole.creator: false,
        MemberRole.standard: false,
      };
      for (final entry in testCases.entries) {
        test('should be ${entry.value} for role ${entry.key.name}', () {
          expect(hasPermissionToManageEvents(entry.key, false), entry.value);
        });
      }
    });
  });

[github-actions]

Visit the preview URL for this PR (updated for commit d11e2ad):

https://sharezone-test--pr2203-add-unprotected-beha-2fzs6qpr.web.app

_{(expires Wed, 04 Mar 2026 16:43:49 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 4cb3ae61e1e018abfd9841fd3239f5b49ccc034b}