Proyectos de Subversion Moodle

Rev

Autoría | Ultima modificación | Ver Log | 

@tool @tool_dataprivacy
Feature: Data delete from the privacy API
  In order to delete data for users and meet legal requirements
  As an admin, user, or parent
  I need to be able to request a user and their data data be deleted

  Background:
    Given the following "users" exist:
      | username       | firstname       | lastname |
      | victim         | Victim User     | 1        |
      | parent         | Long-suffering  | Parent   |
      | privacyofficer | Privacy Officer | One      |
    And the following "roles" exist:
      | shortname | name  | archetype |
      | tired     | Tired |           |
    And the following "permission overrides" exist:
      | capability                                           | permission | role    | contextlevel | reference |
      | tool/dataprivacy:makedatarequestsforchildren         | Allow      | tired   | System       |           |
      | tool/dataprivacy:makedatadeletionrequestsforchildren | Allow      | tired   | System       |           |
      | tool/dataprivacy:managedatarequests                  | Allow      | manager | System       |           |
    And the following "role assigns" exist:
      | user   | role  | contextlevel | reference |
      | parent | tired | User         | victim    |
    And the following "system role assigns" exist:
      | user           | role    | contextlevel |
      | privacyofficer | manager | User         |
    And the following config values are set as admin:
      | contactdataprotectionofficer | 1  | tool_dataprivacy |
    And the following data privacy "categories" exist:
      | name          |
      | Site category |
    And the following data privacy "purposes" exist:
      | name         | retentionperiod |
      | Site purpose | P10Y           |
    And the following config values are set as admin:
      | contactdataprotectionofficer | 1  | tool_dataprivacy |
      | privacyrequestexpiry         | 55 | tool_dataprivacy |
      | dporoles                     | 1  | tool_dataprivacy |
    And I set the site category and purpose to "Site category" and "Site purpose"

  @javascript
  Scenario: As admin, delete a user and their data
    Given I log in as "victim"
    And I should see "Victim User 1"
    And I log out

    And I log in as "admin"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I follow "New request"
    And I set the field "User" to "Victim User 1"
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    Then I should see "Victim User 1"
    And I should see "Awaiting approval" in the "Victim User 1" "table_row"
    And I open the action menu in "Victim User 1" "table_row"
    And I follow "Approve request"
    And I press "Approve request"
    And I should see "Approved" in the "Victim User 1" "table_row"
    And I run all adhoc tasks
    And I reload the page
    And I should see "Deleted" in the "Victim User 1" "table_row"

    And I log out
    And I log in as "victim"
    And I should see "Invalid login"

  @javascript
  Scenario: As a student, request deletion of account and data
    Given I log in as "victim"
    And I follow "Profile" in the user menu
    And I follow "Data requests"
    And I follow "New request"
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    Then I should see "Delete all of my personal data"
    And I should see "Awaiting approval" in the "Delete all of my personal data" "table_row"

    And I log out
    And I log in as "admin"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I open the action menu in "Victim User 1" "table_row"
    And I follow "Approve request"
    And I press "Approve request"

    And I log out
    And I log in as "victim"
    And I follow "Profile" in the user menu
    And I follow "Data requests"
    And I should see "Approved" in the "Delete all of my personal data" "table_row"
    And I run all adhoc tasks
    And I reload the page
    And I should see "Your session has timed out"
    And I log in as "victim"
    And I should see "Invalid login"

    And I log in as "admin"
    And I am on site homepage
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I should see "Deleted"

  @javascript
  Scenario: As a parent, request account and data deletion for my child
    Given I log in as "parent"
    And I follow "Profile" in the user menu
    And I follow "Data requests"
    And I follow "New request"
    And I set the field "User" to "Victim User 1"
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    Then I should see "Victim User 1"
    And I should see "Awaiting approval" in the "Victim User 1" "table_row"

    And I log out
    And I log in as "admin"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I open the action menu in "Victim User 1" "table_row"
    And I follow "Approve request"
    And I press "Approve request"

    And I log out
    And I log in as "parent"
    And I follow "Profile" in the user menu
    And I follow "Data requests"
    And I should see "Approved" in the "Victim User 1" "table_row"
    And I run all adhoc tasks
    And I reload the page
    And I should see "You don't have any personal data requests"

  @javascript
  Scenario: As a Privacy Officer, I cannot create data deletion request unless I have permission.
    Given I log in as "privacyofficer"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I follow "New request"
    And I open the autocomplete suggestions list
    And I click on "Victim User 1" item in the autocomplete list
    Then I should see "Export all of my personal data"
    And "Type" "select" should not be visible
    And the following "permission overrides" exist:
      | capability                                 | permission | role    | contextlevel | reference |
      | tool/dataprivacy:requestdeleteforotheruser | Allow      | manager | System       |           |
    And I reload the page
    And I open the autocomplete suggestions list
    And I click on "Victim User 1" item in the autocomplete list
    And "Type" "select" should be visible

  @javascript
  Scenario: As a student, I cannot create data deletion request unless I have permission.
    Given I log in as "victim"
    And I follow "Profile" in the user menu
    And I follow "Data requests"
    And I follow "New request"
    Then "Type" "select" should exist
    And the following "permission overrides" exist:
      | capability                     | permission | role | contextlevel | reference |
      | tool/dataprivacy:requestdelete | Prevent    | user | System       |           |
    And I reload the page
    And I should see "Export all of my personal data"
    And "Type" "select" should not exist

  @javascript
  Scenario: As a parent, I cannot create data deletion request unless I have permission.
    Given I log in as "parent"
    And the following "permission overrides" exist:
      | capability                                           | permission | role  | contextlevel | reference |
      | tool/dataprivacy:makedatadeletionrequestsforchildren | Prevent    | tired | System       | victim    |
    And I follow "Profile" in the user menu
    And I follow "Data requests"
    And I follow "New request"
    And I open the autocomplete suggestions list
    And I click on "Victim User 1" item in the autocomplete list
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    And I should see "You don't have permission to create deletion request for this user."
    And the following "permission overrides" exist:
      | capability                                           | permission | role  | contextlevel | reference |
      | tool/dataprivacy:makedatadeletionrequestsforchildren | Allow      | tired | System       | victim    |
      | tool/dataprivacy:requestdelete                       | Prevent    | user  | System       |           |
    And I open the autocomplete suggestions list
    And I click on "Long-suffering Parent" item in the autocomplete list
    And I press "Save changes"
    And I should see "You don't have permission to create deletion request for yourself."

  @javascript
  Scenario: As a student, link to create data deletion should not be shown if I don't have permission.
    Given the following "permission overrides" exist:
      | capability                     | permission | role | contextlevel | reference |
      | tool/dataprivacy:requestdelete | Prohibit   | user | System       |           |
    When I log in as "victim"
    And I follow "Profile" in the user menu
    Then I should not see "Delete my account"

  @javascript
  Scenario: As a primary admin, the link to create a data deletion request should not be shown.
    Given I log in as "admin"
    When I follow "Profile" in the user menu
    Then I should not see "Delete my account"

  @javascript
  Scenario: As a Privacy Officer, I cannot Approve to Deny deletion data request without permission.
    Given the following "permission overrides" exist:
      | capability                                 | permission | role    | contextlevel | reference |
      | tool/dataprivacy:requestdeleteforotheruser | Allow      | manager | System       |           |
    When I log in as "privacyofficer"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I follow "New request"
    And I open the autocomplete suggestions list
    And I click on "Victim User 1" item in the autocomplete list
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    And the following "permission overrides" exist:
      | capability                                 | permission | role    | contextlevel | reference |
      | tool/dataprivacy:requestdeleteforotheruser | Prohibit   | manager | System       |           |
    And I reload the page
    Then ".selectrequests" "css_element" should not exist
    And I open the action menu in "region-main" "region"
    And I should not see "Approve request"
    And I should not see "Deny request"
    And I choose "View the request" in the open action menu
    And "Approve" "button" should not exist
    And "Deny" "button" should not exist

  @javascript
  Scenario: As a Privacy Officer, I cannot re-submit deletion data request without permission.
    Given the following "permission overrides" exist:
      | capability                                 | permission | role    | contextlevel | reference |
      | tool/dataprivacy:requestdeleteforotheruser | Allow      | manager | System       |           |
    When I log in as "privacyofficer"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I follow "New request"
    And I open the autocomplete suggestions list
    And I click on "Victim User 1" item in the autocomplete list
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    And I open the action menu in "region-main" "region"
    And I follow "Deny request"
    And I press "Deny request"
    And the following "permission overrides" exist:
      | capability                                 | permission | role    | contextlevel | reference |
      | tool/dataprivacy:requestdeleteforotheruser | Prohibit   | manager | System       |           |
    And I reload the page
    And I open the action menu in "region-main" "region"
    Then I should not see "Resubmit as new request"

  Scenario: Request data deletion as student with automatic approval turned on
    Given the following config values are set as admin:
      | automaticdatadeletionapproval | 1  | tool_dataprivacy |
    And I log in as "victim"
    And I follow "Profile" in the user menu
    And I follow "Delete my account"
    When I press "Save changes"
    Then I should see "Your request has been submitted and will be processed soon."
    And I should see "Approved" in the "Delete all of my personal data" "table_row"

  @javascript
  Scenario: Delete flow stay the same even allow filtering of exports by course setting is enabled.
    Given the following config values are set as admin:
      | allowfiltering | 1 | tool_dataprivacy |
    And I log in as "victim"
    And I should see "Victim User 1"
    And I log out

    And I log in as "admin"
    And I navigate to "Users > Privacy and policies > Data requests" in site administration
    And I follow "New request"
    And I set the field "User" to "Victim User 1"
    And I set the field "Type" to "Delete all of my personal data"
    And I press "Save changes"
    Then I should see "Victim User 1"
    And I should see "Awaiting approval" in the "Victim User 1" "table_row"
    And I open the action menu in "Victim User 1" "table_row"
    And I follow "Approve request"
    And I press "Approve request"
    And I should see "Approved" in the "Victim User 1" "table_row"
    And I run all adhoc tasks
    And I reload the page
    And I should see "Deleted" in the "Victim User 1" "table_row"

    And I log out
    And I log in as "victim"
    And I should see "Invalid login"