1588: Create Right: Manage Users

Test Case #:1588

	Test Case Name: Create Right: Manage Users
System: openLMIS	Subsystem: blue
Test case designed by: Lucyna Laska	Design Date:31.01.2017
Short description: there is a new Administrative type of right named USERS_MANAGE in Reference Data the endpoint's that GET, PUT, POST & DELETE should require the right USERS_MANAGE or a Service token, otherwise a 403 should be returned for: /api/users /api/users/{userId} /api/users/{userId}/roleAssignments /api/users/{userId}/hasRight /api/users/{userId}/programs /api/users/{userId}/supervisedFacilities /api/users/{userId}/fulfillmentFacilities /api/users/search RAML is updated Check to ensure clients of updated endpoints don't break - raise an issue to the larger group if it does.

Pre – conditions:

Step	Action	Expected system response	Comment
1	As a devadmin without USERS_MANAGE permission check, if it's possible to view all users: GET URL: http://test.openlmis.org/api/users?access_token=be16d4f8-776c-480a-af2d-c03aa5f99433	View the list of all users is only possible when USERS_MANAGE right is assigned with user.
2	As a devadmin without USERS_MANAGE permission check, if it's possible to search all users: GET URL: http://test.openlmis.org/api/users/search?access_token=be16d4f8-776c-480a-af2d-c03aa5f99433 Body: { "username": "administrator" }	Searching users is only possible when USERS_MANAGE right is assigned with user.
3	As a devadmin without USERS_MANAGE permission, try to reset password: GET URL: http://test.openlmis.org/api/users/passwordReset?access_token=be16d4f8-776c-480a-af2d-c03aa5f99433	The resetPassword is only possible when USERS_MANAGE right is assigned with user.
4	As a devadmin without USERS_MANAGE permission, try to view his details using. URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222?access_token=62e740fd-8fd8-4951-9aad-234f38e44b0c Method: GET	It's possible to check user's own details.
5	As a devadmin without USERS_MANAGE permission, try to view his own roleAssignments. Method: GET URL:	It's possible to check own details.
6	As a devadmin without USERS_MANAGE permission, try to check if I have right with certain criteria. Method: GET URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222/hasRight?rightId=e96017ff-af8c-4313-a070-caa70465c949&access_token=62e740fd-8fd8-4951-9aad-234f38e44b0c	It's possible to check user's own details.
7	As a devadmin without USERS_MANAGE permission, try to get the programs at a user's home facility or programs that the user supervises. Method: GET URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222/programs?access_token=62e740fd-8fd8-4951-9aad-234f38e44b0c	It's possible to check user's own details.
8	As a devadmin without USERS_MANAGE permission, try get all the facilities that the user supervises, by right and program. Method: GET URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222/supervisedFacilities?rightId=ebad51c3-f7c3-4fab-97e1-839973b045d4&programId=10845cb9-d365-4aaa-badd-b4fa39c6a26a&access_token=62e740fd-8fd8-4951-9aad-234f38e44b0c	It's possible to check user's own details.
9	As a devadmin without USERS_MANAGE permission, try to get all the facilities that the user has fulfillment rights for. Method: GET URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222/fulfillmentFacilities?rightId=ebad51c3-f7c3-4fab-97e1-839973b045d4&access_token=62e740fd-8fd8-4951-9aad-234f38e44b0c	It's possible to check user's own details.
10	As an administrator with USERS_MANAGE permission, try to view the list of all users. URL: http://test.openlmis.org/api/users?access_token=a11c9dd0-8d0c-4a5b-be87-639f4d917599 Method: GET	It's possible to view the details of all users.
11	As an administrator with USERS_MANAGE permission, try to search a user. URL: http://test.openlmis.org/api/users/search?access_token=a11c9dd0-8d0c-4a5b-be87-639f4d917599 Method: POST Body: { "username": "devadmin" }	It's possible to search the user.
12	As an administrator with USERS_MANAGE permission, try to view the details of particular user. URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222?access_token=a11c9dd0-8d0c-4a5b-be87-639f4d917599 Method: GET	It's possible to view the particular user.
13	As an administrator with USERS_MANAGE permission, try to delete the user. URL: http://test.openlmis.org/api/users/56a50e9a-9668-437d-a09c-7e709ce22222?access_token=a11c9dd0-8d0c-4a5b-be87-639f4d917599	It's possible to delete the particular user.	Note: user can delete his own record.
14	As an administrator with USERS_MANAGE permission, try to reset password: URL: http://test.openlmis.org/api/users/passwordReset?access_token=98e0fc36-7551-4d56-a11b-bb2cd49fce17 Method: POST Body: { "username": "devadmin", "newPassword": "password1" }	It's possible to reset password for every user.
16
17
18

Post – conditions: