CakePHP & AuthComponent unit test doesn't appear to call isAuthorized() - unit-testing

Question

I am writing unit tests for my UsersController so that users can only edit their own profile. I am using CakePHP 2.4.2 and AuthComponent with Controller authorize to do this.
Auth config:
public $components = array(
'Auth' => array(
'loginRedirect' => '/',
'logoutRedirect' => '/',
'authenticate' => array('Ldap'),
'authError' => 'You are not allowed to access this page',
'authorize' => 'Controller'));
isAuthorized() in UsersController:
public function isAuthorized($user = null) {
if($this->Auth->loggedIn()) {
return $this->request->params['pass'][0] == $user['id'];
}
return false;
}
Unit test for edit:
public function testEdit() {
$result = $this->testAction('/users/view/1', array('return' => 'view'));
$this->assertRegExp('/Adam C Hobaugh/', $result);
$user = $this->generate('Users', array(
'components' => array(
'Session',
'Auth' => array('user'))));
$test = array('id' => 1);
$user->Auth->expects($this->once())->method('loggedIn')
->with($this->returnValue(true));
$user->Auth->expects($this->any())->method('user')
->with($this->returnValue($test));
$user->Session->expects($this->any())->method('setFlash');
$result = $this->testAction('/users/edit/1', array(
'return' => 'headers',
'data' => array('User' => array( {user array} ))));
debug($result);
$this->assertContains('/users', #$result['Location']);
$result = $this->testAction('/users/view/1', array('return' => 'view'));
$this->assertRegExp('/John Jacob Doe/', $result);
}
I am getting Expectation failed for method name is equal to <string:loggedIn> when invoked 1 time(s). Method was expected to be called 1 times, actually called 0 times. when I run the test. Also when I changed this->once() to $this->any() and the id in the $test array to 2, a situation that should fail and does from the browser, it succeeds in passing the test.
With those combined, it appears that isAuthorized() is not being called during the unit test. I am at a loss. Thanks for any help that you could give.

Answer 1

First: In your test code you call the view method and not the edit method
Second: isAuthorized() is not for this. With this method you should just define who could acces what functions, there should not be any application business logic.
Third: If you want to limit normal users to edit just their own profile you should change the dit() method to something like this.
public function edit() {
$this->request->data['User']['id'] = $this->Auth->User('id');
if ($this->request->is('post') || $this->request->is('put')) {
if ($this->User->save($this->request->data)) {
$this->Session->setFlash(__('The user has been saved.'));
return $this->redirect(array('action' => 'index'));
} else {
$this->Session->setFlash(__('The user could not be saved. Please, try again.'));
}
} else {
$this->request->data = array('User' => $this->Auth->User());
}
}
And remove echo $this->Form->input('id'); from your edit view.
I am writing a book about this topic. It will be available here soon: https://leanpub.com/CakePHPUserAuthentication/