From da0f9699298711706d1e6c38a20eb7d48a874832 Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Wed, 6 Mar 2019 17:28:39 -0700 Subject: [PATCH] NamespaceExpressionHandlerTests groovy->java Issue: gh-4939 --- ...NamespaceHttpExpressionHandlerTests.groovy | 56 --------- .../NamespaceHttpExpressionHandlerTests.java | 113 ++++++++++++++++++ 2 files changed, 113 insertions(+), 56 deletions(-) delete mode 100644 config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.groovy create mode 100644 config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.java diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.groovy deleted file mode 100644 index ac9984315f..0000000000 --- a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.groovy +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright 2002-2013 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.springframework.security.config.annotation.web.configurers - -import org.springframework.context.annotation.Configuration -import org.springframework.expression.spel.standard.SpelExpressionParser -import org.springframework.security.access.expression.SecurityExpressionHandler -import org.springframework.security.config.annotation.BaseSpringSpec -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.BaseWebConfig; -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; - -/** - * Tests to verify that all the functionality of attributes is present - * - * @author Rob Winch - * - */ -public class NamespaceHttpExpressionHandlerTests extends BaseSpringSpec { - def "http/expression-handler@ref"() { - when: - def parser = new SpelExpressionParser() - ExpressionHandlerConfig.EXPRESSION_HANDLER = Mock(SecurityExpressionHandler.class) - ExpressionHandlerConfig.EXPRESSION_HANDLER.getExpressionParser() >> parser - loadConfig(ExpressionHandlerConfig) - then: - noExceptionThrown() - } - - @EnableWebSecurity - static class ExpressionHandlerConfig extends BaseWebConfig { - static EXPRESSION_HANDLER; - - protected void configure(HttpSecurity http) { - http - .authorizeRequests() - .expressionHandler(EXPRESSION_HANDLER) - .antMatchers("/users**","/sessions/**").hasRole("ADMIN") - .antMatchers("/signup").permitAll() - .anyRequest().hasRole("USER") - } - } -} diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.java new file mode 100644 index 0000000000..506d2fc447 --- /dev/null +++ b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpExpressionHandlerTests.java @@ -0,0 +1,113 @@ +/* + * Copyright 2002-2019 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.security.config.annotation.web.configurers; + + +import java.security.Principal; + +import org.junit.Rule; +import org.junit.Test; +import org.junit.runner.RunWith; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.annotation.Bean; +import org.springframework.expression.ExpressionParser; +import org.springframework.expression.spel.standard.SpelExpressionParser; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.config.test.SpringTestRule; +import org.springframework.security.test.context.annotation.SecurityTestExecutionListeners; +import org.springframework.security.test.context.support.WithMockUser; +import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.servlet.config.annotation.EnableWebMvc; + +import static org.mockito.Mockito.spy; +import static org.mockito.Mockito.verify; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content; + +/** + * Tests to verify that all the functionality of attributes is present + * + * @author Rob Winch + * @author Josh Cummings + * + */ +@RunWith(SpringJUnit4ClassRunner.class) +@SecurityTestExecutionListeners +public class NamespaceHttpExpressionHandlerTests { + + @Rule + public final SpringTestRule spring = new SpringTestRule(); + + @Autowired + MockMvc mvc; + + @Test + @WithMockUser + public void getWhenHasCustomExpressionHandlerThenMatchesNamespace() throws Exception { + this.spring.register(ExpressionHandlerController.class, ExpressionHandlerConfig.class).autowire(); + this.mvc.perform(get("/whoami")).andExpect(content().string("user")); + verifyBean("expressionParser", ExpressionParser.class).parseExpression("hasRole('USER')"); + } + + @EnableWebMvc + @EnableWebSecurity + private static class ExpressionHandlerConfig extends WebSecurityConfigurerAdapter { + public ExpressionHandlerConfig() {} + + @Override + protected void configure(AuthenticationManagerBuilder auth) throws Exception { + auth + .inMemoryAuthentication() + .withUser("rod").password("password").roles("USER", "ADMIN"); + } + + @Override + protected void configure(HttpSecurity http) throws Exception { + DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler(); + handler.setExpressionParser(expressionParser()); + + http + .authorizeRequests() + .expressionHandler(handler) + .anyRequest().access("hasRole('USER')"); + } + + @Bean + ExpressionParser expressionParser() { + return spy(new SpelExpressionParser()); + } + } + + @RestController + private static class ExpressionHandlerController { + @GetMapping("/whoami") + String whoami(Principal user) { + return user.getName(); + } + } + + private T verifyBean(String beanName, Class beanClass) { + return verify(this.spring.getContext().getBean(beanName, beanClass)); + } +}