Context: we operate in a highly regulated industry (medical), and aim to have automated test cases to cover all of our requirements - allowing us to still release quickly, but safely.
We have a requirement or acceptance criteria that reads something like:
x object should be read-only for users
Editing this object not a piece of functionality that is available in our web application (or via an API) - this state can only be created by the backend (kotlin) application itself, but it is important to do what we can to verify this, (and ideally in an automated way).
The problem: how do you test for the absence of some functionality?
Our current thinking is similar to this answer, specifically:
tests are just examples and not a proof
Therefore all our tests are examples of a sort, and it's acceptable to have a slightly wooly test, for example the absence of an edit button. It's likely that if we weren't in a regulated industry we'd not put as much thought into it, and accept that you have to trust the design to some extent for this type of requirement.
Some good thoughts from below (thanks for all the decent discussions):
- Code reviews/verification: yep, we do this
- API testing: testing the resource returned is read-only is something we do
- Security testing: absolutely will do this