Given a system with static permissions (1 permission for every action that can be made: create a resource, update a resource, etc), and dynamic roles (can be created and assign permissions to it dynamically). The system have a preconfigured set of roles with the purpose of initial setup and/or testing. These can be deleted or modified after the initial setup, hence dynamic.When acting as a user with one of these preconfigured roles on a [functional/acceptance] test to assert a use case works properly, do tests that assert a user with a role that does not have the permission to execute that use case have any value?
Do tests that asserts a user can't do an action have any value?
unit testing;testing;integration tests;acceptance testing
Yes. It tests that the roles are taken into account when checking for permission.It also tests that the permission for the role are setup correctly.Note that these are unit-testing the permission system, not whatever the operation with the permission is. So the tests will be creating a role and changing the permissions and testing a (mocked) operation to see if the permission is actually taken into account.Having said that, a duo of tests (one with the permission and one without the permission) for each operation to make sure the permission is wired correctly for that operation is also of value.