My opinion : we must start by a simple "Global settings" update Permission test suite ?
No ?

Well, our current approach was to grow a test suite from new features. That was my idea, at least. But should be collaborative effort by contributors and core GmbH team.

PS : i don't mind of new form action test …

Well, our current approach was to grow a test suite from new features. That was my idea, at least. But should be collaborative effort by contributors and core GmbH team.

Yes, i understand : and it's in my todo list since month to add SurveysGroup permission checker when there are a solution to do action other than superadmin :)

But you are right : i didn't mind of GUI test suite here …

Update category (clearly not encryption here)

@ollehar : i can easily add Survey permision checker
BUT :

• I don't see without DB usage : check https://bugs.limesurvey.org/view.php?id=14551 «user can grant more permissions on a survey than he has himself»
• Check inherited permission by Survey groups on Survey

Maybe i try an update of login user id directly in session ?

user can grant more permissions on a survey than he has himself

To make a test for this without database, you need to take the controller action and rip out everything that's not related to database or request parsing, and put it in a service class with injection or possibility to mock. In other words, business logic should be in service classes to be testable. :) But, let me merge your PR first and have a look.

Then : mock Permission->save() and check if data sent via our mocked POST was in save data ?

And even if Permission->save happen for specific permission …

To mock :

• Survey->havePermission() : send false to the current user for permisison1 and true for permission2
• Permission->save() : check is save
  • didn't happen for permisison1
  • happen for permisison2