Skip to content

384 — should check when user does not have any role

Description

Verifies that an employee added to a team without any team role sees only their own time records — adding them to a team alone doesn't expose other members' data.

Preconditions

  • A signed-in owner plus an invited employee.
  • A team is created and the employee is added to it via API with no roles.
  • Seed data: two projects with one task each and one time record per project (one for the employee on client 1, one for the owner on client 2).

Steps

  1. As the owner, create a team and add the employee as a member with an empty roles array via API. Expected: the API confirms 1 member added.
  2. Sign in as the employee and open Time tracking. Expected: the area shows "Dashboard", "Calendar", "Timesheet", "Time entries", "Team calendar" tabs.
  3. View the calendar. Expected: only 1 time record is visible (the employee's own).
  4. Switch to the Users (multi-user) calendar view. Expected: still only 1 time record is visible.
  5. Check the user avatars list. Expected: exactly 1 avatar is shown — the employee's.
  • Spec: playwright/tests/integration/permissions.spec.ts (line 744)