bemade-addons/bemade_sports_clinic/tests/README_MAIL_ACTIVITY_TESTS.md

Mail Activity Portal Access Tests

This directory contains comprehensive tests for the mail activity portal access functionality implemented for treatment professionals in the bemade_sports_clinic module.

Test Files Overview

1. test_mail_activity_portal_access.py

Purpose: Unit and integration tests for mail.activity CRUD operations via ORM
Test Count: 20 comprehensive tests
Coverage:

• Activity creation, reading, updating, deletion
• Access control validation (authorized vs unauthorized records)
• Activity type access and filtering
• Mail message and attachment access control
• Record rule domain evaluation
• Security validation and minimal sudo() usage
• Mail followers access control
• Bus notification access

Key Test Categories:

• CRUD Operations (tests 01-08): Basic create, read, update, delete operations
• Access Control (tests 03-06): Unauthorized access prevention
• Related Models (tests 09-13): Activity types, messages, attachments
• Security Features (tests 14-20): Record rules, search filtering, security validation

2. test_mail_activity_portal_integration.py

Purpose: HTTP integration tests for portal web interface
Test Count: 16 comprehensive tests
Coverage:

• Portal page access and navigation
• HTTP form submissions (create, update, complete, delete)
• Web interface security (CSRF protection)
• Activity filtering, searching, and pagination
• Error handling and user feedback
• Attachment handling in portal interface

Key Test Categories:

• Portal Access (tests 01-03): Page access and form rendering
• HTTP Operations (tests 04-09): Form submissions and data processing
• Web Features (tests 10-15): Filtering, search, pagination
• Security & Error Handling (tests 12, 16): CSRF protection and error handling

3. test_mail_activity_portal_runner.py

Purpose: Test runner and reporting utility
Features:

• Run all tests or specific test classes/methods
• Environment validation
• Comprehensive test reporting
• Command-line interface for test execution

Running the Tests

Prerequisites

1. Ensure you're in the Odoo root directory
2. Have a test database configured
3. Module is installed and up-to-date

Run All Tests

cd /Users/ddurepos/src/fitcrew
python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py

Run Specific Test Class

# Run only unit tests
python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py --class TestMailActivityPortalAccess

# Run only integration tests
python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py --class TestMailActivityPortalIntegration

Run Individual Tests via Odoo

# Run unit tests
python odoo-bin --test-enable --test-tags bemade_sports_clinic.tests.test_mail_activity_portal_access --stop-after-init --database test_db

# Run integration tests
python odoo-bin --test-enable --test-tags bemade_sports_clinic.tests.test_mail_activity_portal_integration --stop-after-init --database test_db

Validate Environment

python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py --validate

Generate Test Report Only

python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py --report

Test Coverage Details

Security Features Tested

1. Access Control Lists (ACLs)

• ✅ mail.activity full CRUD access for portal treatment professionals
• ✅ mail.activity.type read access with model filtering
• ✅ mail.message access for activity-related messages
• ✅ ir.attachment access for activity attachments
• ✅ mail.followers access for subscription management
• ✅ bus.bus access for real-time notifications
• ✅ System dependencies (ir.model, res.users, res.partner)

2. Record Rules

• ✅ Team-based access restrictions
• ✅ Patient/injury relationship validation
• ✅ User assignment-based access
• ✅ Complex domain evaluation with OR/AND logic
• ✅ Cross-team data isolation

3. HTTP Security

• ✅ CSRF token validation on all form submissions
• ✅ Form input validation and sanitization
• ✅ Unauthorized access prevention
• ✅ Error handling without information disclosure

4. Data Isolation

• ✅ Activities visible only to authorized users
• ✅ Messages accessible based on record access
• ✅ Attachments restricted to authorized records
• ✅ Search and filtering respect access rules

Functional Features Tested

1. Activity Management

• ✅ Create activities on patients and injuries
• ✅ Update activity details (summary, notes, deadlines)
• ✅ Complete activities with feedback
• ✅ Delete activities when authorized
• ✅ Activity assignment to different users

2. Portal Interface

• ✅ Activity list with filtering and pagination
• ✅ Activity creation forms with validation
• ✅ Activity update forms with pre-population
• ✅ Activity completion workflow
• ✅ Search functionality across activities

3. Integration Features

• ✅ Mail message creation on activity completion
• ✅ Attachment handling and access
• ✅ Follower subscription management
• ✅ Real-time notifications via bus system

Test Data Setup

Each test class sets up comprehensive test data including:

Organizations and Teams

• Authorized team (therapist has access)
• Unauthorized team (therapist has no access)

Users and Roles

• Treatment professional with portal access
• Multiple therapists for cross-access testing
• Proper group assignments and team staff relationships

Patients and Injuries

• Patients in authorized and unauthorized teams
• Active injuries with proper consent and team assignments
• Various injury stages and types for testing

Activity Types

• Patient-specific activity types
• Injury-specific activity types
• Generic activity types
• Restricted activity types for negative testing

Expected Test Results

Success Criteria

• All 36 tests should pass (20 unit + 16 integration)
• No AccessError exceptions for authorized operations
• Proper AccessError exceptions for unauthorized operations
• All HTTP responses return expected status codes
• Database state matches expected outcomes

Common Issues and Troubleshooting

1. ACL-Related Failures

• Symptom: AccessError on basic operations
• Solution: Verify ACL entries in ir.model.access.csv
• Check: Module upgrade completed successfully

2. Record Rule Failures

• Symptom: Cannot access authorized records
• Solution: Check record rule domains in mail_activity_portal_rules.xml
• Check: Team staff relationships are properly created

3. HTTP Test Failures

• Symptom: 500 errors or unexpected redirects
• Solution: Check controller implementation and CSRF handling
• Check: Portal templates render without errors

4. Environment Issues

• Symptom: Tests fail to start or timeout
• Solution: Verify test database and Odoo configuration
• Check: All dependencies are installed

Maintenance and Updates

When to Run Tests

• After any changes to security files (ir.model.access.csv, record rules)
• After controller modifications
• After template updates
• Before deploying to production
• As part of CI/CD pipeline

Adding New Tests

1. Follow existing naming conventions (test_##_descriptive_name)
2. Include both positive and negative test cases
3. Test both ORM and HTTP interfaces where applicable
4. Update this documentation with new test descriptions

Test Data Management

• Tests use TransactionCase for automatic rollback
• Each test is isolated and doesn't affect others
• Test data is created in setUpClass for efficiency
• Clean up is handled automatically by the test framework

Integration with CI/CD

These tests are designed to be integrated into continuous integration pipelines:

# Example GitHub Actions workflow
- name: Run Mail Activity Portal Tests
  run: |
    python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py
        
- name: Generate Test Report
  run: |
    python addons/bemade_sports_clinic/tests/test_mail_activity_portal_runner.py --report    

Security Compliance

These tests validate compliance with:

• GDPR: Data access restrictions and audit trails
• Quebec Law 25: Privacy and data protection requirements
• Healthcare Privacy: Patient data access controls
• Odoo Security Best Practices: Proper ACL and record rule usage

The comprehensive test suite ensures that the mail activity portal access functionality maintains security boundaries while providing the necessary functionality for treatment professionals to manage patient care activities effectively.