Just to point out some testing issues here:
- I'm tested it with my admin account - this is not a valid test. The admin account has many overriding privileges so not all conditions will match, and you'll get unexpected behaviour (unless this is functionality specifically designed for the admin user)
- As a test i set admin rights to this user - again, not only will this invalidate the test (unless the user has admin rights normally, but no normal functionality should be dependent upon this role) but giving a user admin rights also means ACLs are bypassed.
- I setted an ACL Rule to this view - consequently, testing with a user holding the "admin" role is futile.
It helps to observe positive and negative testing:
- create a user that definitely DOES have access to this functionality, check it works as them
- create a user that definitely DOES NOT have access to the functionality, check it does NOT work as them
A general rule of thumb: "testing with the admin role is not testing at all"
