test: add 7 role-boundary tests for GuideFamilyTaskController, extract TestRoles constants

cfc-backend/src/test/java/com/etotem/cfc/common/TestRoles.java

@@ -0,0 +1,35 @@
+package com.etotem.cfc.common;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * 测试角色常量与断言辅助方法。
+ * 系统四种角色: parent(家长), child(孩子), teacher(成长规划师), admin(管理员)
+ */
+public class TestRoles {
+
+    public static final String ROLE_PARENT = "parent";
+    public static final String ROLE_CHILD = "child";
+    public static final String ROLE_TEACHER = "teacher";
+    public static final String ROLE_ADMIN = "admin";
+
+    /** 所有非 teacher 角色，用于验证 teacher-only 接口的拒绝行为 */
+    public static final String[] NON_TEACHER_ROLES = {ROLE_PARENT, ROLE_CHILD, ROLE_ADMIN};
+
+    /** 全部四种角色 */
+    public static final String[] ALL_ROLES = {ROLE_PARENT, ROLE_CHILD, ROLE_TEACHER, ROLE_ADMIN};
+
+    /** 断言教师角色的操作成功 (code=200) */
+    public static void assertSuccess(Result<?> result) {
+        assertEquals(200, result.getCode(), "Expected success(200) for teacher role");
+    }
+
+    /** 断言非 teacher 角色的操作被拒绝：code=500, message 包含 "Access denied" */
+    public static void assertRoleDenied(Result<?> result) {
+        assertEquals(500, result.getCode(),
+            "Expected 500 for role denied but got " + result.getCode() + ": " + result.getMessage());
+        assertNotNull(result.getMessage(), "Expected error message");
+        assertTrue(result.getMessage().contains("Access denied"),
+            "Expected 'Access denied' but got: " + result.getMessage());
+    }
+}

cfc-backend/src/test/java/com/etotem/cfc/controller/GuideFamilyTaskControllerTest.java

@@ -22,6 +22,7 @@ import java.util.*;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.when;
+import static com.etotem.cfc.common.TestRoles.*;
 
 @SpringBootTest
 public class GuideFamilyTaskControllerTest {
@@ -81,8 +82,68 @@ public class GuideFamilyTaskControllerTest {
 
     @Test
     public void getBoundFamilies_NonTeacherRole_AccessDenied() {
-        Result<?> result = controller.getBoundFamilies(2L, "parent");
-        assertNotNull(result);
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.getBoundFamilies(2L, role);
+            assertRoleDenied(result);
+        }
+    }
+
+    @Test
+    public void getChildTasks_NonTeacherRole_AccessDenied() {
+        Map<String, Object> params = new HashMap<>();
+        params.put("page", 1);
+        params.put("size", 10);
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.getChildTasks(100L, 20L, role, params);
+            assertRoleDenied(result);
+        }
+    }
+
+    @Test
+    public void getPendingReviewTasks_NonTeacherRole_AccessDenied() {
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.getPendingReviewTasks(100L, 20L, role);
+            assertRoleDenied(result);
+        }
+    }
+
+    @Test
+    public void reviewTask_NonTeacherRole_AccessDenied() {
+        TaskReviewDTO dto = new TaskReviewDTO();
+        dto.setApproved(true);
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.reviewTask(100L, 1L, role, dto);
+            assertRoleDenied(result);
+        }
+    }
+
+    @Test
+    public void batchReviewTasks_NonTeacherRole_AccessDenied() {
+        Map<String, Object> params = new HashMap<>();
+        params.put("taskIds", Arrays.asList(1L, 2L));
+        params.put("approved", true);
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.batchReviewTasks(100L, role, params);
+            assertRoleDenied(result);
+        }
+    }
+
+    @Test
+    public void updateTask_NonTeacherRole_AccessDenied() {
+        Map<String, Object> taskData = new HashMap<>();
+        taskData.put("title", "新标题");
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.updateTask(100L, 1L, role, taskData);
+            assertRoleDenied(result);
+        }
+    }
+
+    @Test
+    public void deleteTask_NonTeacherRole_AccessDenied() {
+        for (String role : NON_TEACHER_ROLES) {
+            Result<?> result = controller.deleteTask(100L, 1L, role);
+            assertRoleDenied(result);
+        }
     }
 
     // --- New tests ---