Hi Dominik,
It is not persé a security risk. However, we define server actions normally only public if they need to be consumed by other modules. Now, if you would make a private server action public just for testing. It will impact the outcome of seeing where your public (private) action is used. Furthermore, developers might start defining references to it, which they should not do.
This is what I did in the past:
- Copy the private server action to service action
- Rename the service action to <server action name>_Test
- Replace the logic in the service action by a call to the server action
- Make sure to map the output parameters of the server action to the output parameters of the service action.
What do you achieve with the above:
- The server action can stay private, impact analysis is simple, only within the module
- The server action can stay private, thus it cannot unintentionally be referenced and consumed.
- Using a naming convention on the ServiceAction it is clear this action is ment for testing, it could unintentionally be called, but calling a _Test action in production code should be an easy red flag during code review.
- Using service action, you now have a less tightly coupled test, meaning that the module with the BDD test doesn't need to be refreshed and republished every time the server action changes. Only with an additional mandatory input or output parameter on the server action, you would need to republish your test, as it would also affect the input and output parameters of the service action.
Regards,
Daniel