test(controller): cover user policy authorization

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Author: vitormattos

tests/php/Unit/Controller/PolicyControllerTest.php

@@ -652,6 +652,11 @@ public function testClearGroupReturnsForbiddenWhenGlobalDefaultBlocksLowerLevelO
 	}
 
 	public function testSetUserPolicyForTargetUserReturnsSavedExplicitPolicy(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
 		$persistedPolicy = (new PolicyLayer())
 			->setScope('user')
 			->setValue('ordered_numeric');
@@ -677,6 +682,11 @@ public function testSetUserPolicyForTargetUserReturnsSavedExplicitPolicy(): void
 	}
 
 	public function testClearUserPolicyForTargetUserReturnsClearedExplicitPolicy(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
 		$this->l10n
 			->expects($this->once())
 			->method('t')
@@ -698,6 +708,11 @@ public function testClearUserPolicyForTargetUserReturnsClearedExplicitPolicy():
 	}
 
 	public function testSetUserPolicyForTargetUserReturnsBadRequestWhenServiceBlocksSave(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
 		$this->policyService
 			->expects($this->once())
 			->method('saveUserPreferenceForUserId')
@@ -726,6 +741,11 @@ public function testSetUserPreferenceBubblesUnexpectedExceptions(): void {
 	}
 
 	public function testSetUserPolicyForTargetUserBubblesUnexpectedExceptions(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
 		$this->policyService
 			->expects($this->once())
 			->method('saveUserPreferenceForUserId')
@@ -752,6 +772,11 @@ public function testClearUserPreferenceBubblesUnexpectedExceptions(): void {
 	}
 
 	public function testClearUserPolicyForTargetUserBubblesUnexpectedExceptions(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
 		$this->policyService
 			->expects($this->once())
 			->method('clearUserPreferenceForUserId')
@@ -764,6 +789,56 @@ public function testClearUserPolicyForTargetUserBubblesUnexpectedExceptions(): v
 		$this->controller->clearUserPolicyForUser('user1', 'signature_flow');
 	}
 
+	public function testSetUserPolicyForTargetUserReturnsForbiddenWhenCurrentActorCannotManageTargetUser(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(false);
+		$this->subAdmin
+			->method('isSubAdmin')
+			->with($this->currentUser)
+			->willReturn(false);
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Not allowed to manage this user policy')
+			->willReturn('Not allowed to manage this user policy');
+
+		$this->policyService->expects($this->never())->method('saveUserPreferenceForUserId');
+
+		$response = $this->controller->setUserPolicyForUser('user1', 'signature_flow', 'ordered_numeric');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+		$this->assertSame([
+			'error' => 'Not allowed to manage this user policy',
+		], $response->getData());
+	}
+
+	public function testClearUserPolicyForTargetUserReturnsForbiddenWhenCurrentActorCannotManageTargetUser(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(false);
+		$this->subAdmin
+			->method('isSubAdmin')
+			->with($this->currentUser)
+			->willReturn(false);
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Not allowed to manage this user policy')
+			->willReturn('Not allowed to manage this user policy');
+
+		$this->policyService->expects($this->never())->method('clearUserPreferenceForUserId');
+
+		$response = $this->controller->clearUserPolicyForUser('user1', 'signature_flow');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+		$this->assertSame([
+			'error' => 'Not allowed to manage this user policy',
+		], $response->getData());
+	}
+
 	public function testSetUserPreferenceReadsBodyParamsFromRequest(): void {
 		$request = $this->createMock(IRequest::class);
 		$request