Skip to content

Commit a08be5b

Browse files
jzheauxjzheaux
committed
UrlAuthorizationsTests groovy->java
Issue gh-4939
1 parent 870d83e commit a08be5b

File tree

2 files changed

+170
-79
lines changed

2 files changed

+170
-79
lines changed

‎config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationsTests.groovy

-79
This file was deleted.

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationsTests.java

+170
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
/*
2+
* Copyright 2002-2019 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.security.config.annotation.web.configurers;
17+
18+
import java.util.List;
19+
import javax.servlet.Filter;
20+
21+
import org.junit.Rule;
22+
import org.junit.Test;
23+
import org.junit.runner.RunWith;
24+
25+
import org.springframework.beans.factory.annotation.Autowired;
26+
import org.springframework.context.ApplicationContext;
27+
import org.springframework.security.access.vote.AffirmativeBased;
28+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
29+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
30+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
31+
import org.springframework.security.config.test.SpringTestRule;
32+
import org.springframework.security.test.context.annotation.SecurityTestExecutionListeners;
33+
import org.springframework.security.test.context.support.WithMockUser;
34+
import org.springframework.security.web.FilterChainProxy;
35+
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
36+
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
37+
import org.springframework.test.web.servlet.MockMvc;
38+
39+
import static org.assertj.core.api.Assertions.assertThat;
40+
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
41+
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
42+
43+
/**
44+
*
45+
* @author Rob Winch
46+
* @author Josh Cummings
47+
*
48+
*/
49+
@RunWith(SpringJUnit4ClassRunner.class)
50+
@SecurityTestExecutionListeners
51+
public class UrlAuthorizationsTests {
52+
53+
@Rule
54+
public final SpringTestRule spring = new SpringTestRule();
55+
56+
@Autowired
57+
MockMvc mvc;
58+
59+
@Test
60+
@WithMockUser(authorities = "ROLE_USER")
61+
public void hasAnyAuthorityWhenAuthoritySpecifiedThenMatchesAuthority() throws Exception {
62+
this.spring.register(RoleConfig.class).autowire();
63+
64+
this.mvc.perform(get("/role-user-authority"))
65+
.andExpect(status().isNotFound());
66+
this.mvc.perform(get("/role-user"))
67+
.andExpect(status().isNotFound());
68+
this.mvc.perform(get("/role-admin-authority"))
69+
.andExpect(status().isForbidden());
70+
}
71+
72+
@Test
73+
@WithMockUser(authorities = "ROLE_ADMIN")
74+
public void hasAnyAuthorityWhenAuthoritiesSpecifiedThenMatchesAuthority() throws Exception {
75+
this.spring.register(RoleConfig.class).autowire();
76+
77+
this.mvc.perform(get("/role-user-admin-authority"))
78+
.andExpect(status().isNotFound());
79+
this.mvc.perform(get("/role-user-admin"))
80+
.andExpect(status().isNotFound());
81+
this.mvc.perform(get("/role-user-authority"))
82+
.andExpect(status().isForbidden());
83+
}
84+
85+
@Test
86+
@WithMockUser(roles = "USER")
87+
public void hasAnyRoleWhenRoleSpecifiedThenMatchesRole() throws Exception {
88+
this.spring.register(RoleConfig.class).autowire();
89+
90+
this.mvc.perform(get("/role-user"))
91+
.andExpect(status().isNotFound());
92+
this.mvc.perform(get("/role-admin"))
93+
.andExpect(status().isForbidden());
94+
}
95+
96+
@Test
97+
@WithMockUser(roles = "ADMIN")
98+
public void hasAnyRoleWhenRolesSpecifiedThenMatchesRole() throws Exception {
99+
this.spring.register(RoleConfig.class).autowire();
100+
101+
this.mvc.perform(get("/role-admin-user"))
102+
.andExpect(status().isNotFound());
103+
this.mvc.perform(get("/role-user"))
104+
.andExpect(status().isForbidden());
105+
}
106+
107+
@Test
108+
@WithMockUser(authorities = "USER")
109+
public void hasAnyRoleWhenRoleSpecifiedThenDoesNotMatchAuthority() throws Exception {
110+
this.spring.register(RoleConfig.class).autowire();
111+
112+
this.mvc.perform(get("/role-user"))
113+
.andExpect(status().isForbidden());
114+
this.mvc.perform(get("/role-admin"))
115+
.andExpect(status().isForbidden());
116+
}
117+
118+
@EnableWebSecurity
119+
static class RoleConfig extends WebSecurityConfigurerAdapter {
120+
@Override
121+
protected void configure(HttpSecurity http) throws Exception {
122+
// @formatter:off
123+
http
124+
.authorizeRequests()
125+
.antMatchers("/role-user-authority").hasAnyAuthority("ROLE_USER")
126+
.antMatchers("/role-admin-authority").hasAnyAuthority("ROLE_ADMIN")
127+
.antMatchers("/role-user-admin-authority").hasAnyAuthority("ROLE_USER", "ROLE_ADMIN")
128+
.antMatchers("/role-user").hasAnyRole("USER")
129+
.antMatchers("/role-admin").hasAnyRole("ADMIN")
130+
.antMatchers("/role-user-admin").hasAnyRole("USER", "ADMIN");
131+
// @formatter:on
132+
}
133+
}
134+
135+
@Test
136+
public void configureWhenNoAccessDecisionManagerThenDefaultsToAffirmativeBased() {
137+
this.spring.register(NoSpecificAccessDecisionManagerConfig.class).autowire();
138+
139+
FilterSecurityInterceptor interceptor = getFilter(FilterSecurityInterceptor.class);
140+
assertThat(interceptor).isNotNull();
141+
assertThat(interceptor).extracting("accessDecisionManager")
142+
.first().isInstanceOf(AffirmativeBased.class);
143+
}
144+
145+
private <T extends Filter> T getFilter(Class<T> filterType) {
146+
FilterChainProxy proxy = this.spring.getContext().getBean(FilterChainProxy.class);
147+
List<Filter> filters = proxy.getFilters("/");
148+
for (Filter filter : filters) {
149+
if (filterType.isAssignableFrom(filter.getClass())) {
150+
return (T) filter;
151+
}
152+
}
153+
return null;
154+
}
155+
156+
@EnableWebSecurity
157+
static class NoSpecificAccessDecisionManagerConfig extends WebSecurityConfigurerAdapter {
158+
159+
@Override
160+
protected void configure(HttpSecurity http) throws Exception {
161+
ApplicationContext context = getApplicationContext();
162+
UrlAuthorizationConfigurer<HttpSecurity>.StandardInterceptUrlRegistry registry =
163+
http.apply(new UrlAuthorizationConfigurer(context)).getRegistry();
164+
165+
registry
166+
.antMatchers("/a").hasRole("ADMIN")
167+
.anyRequest().hasRole("USER");
168+
}
169+
}
170+
}

0 commit comments

Comments
 (0)