From 98bfe349966c04f7ad9b5df3304ee32c670ddaf5 Mon Sep 17 00:00:00 2001 From: Thomas Darimont Date: Wed, 17 Jun 2015 12:24:55 +0200 Subject: [PATCH] #105 - Added example for filtering data solely on Role in jpa-security sample. Added example for dynamic filtering in query solely based on the current principals role. --- .../SecureBusinessObjectRepository.java | 8 +++ .../security/SecurityIntegrationTests.java | 69 ++++++++++++++----- 2 files changed, 58 insertions(+), 19 deletions(-) diff --git a/jpa/security/src/main/java/example/springdata/jpa/security/SecureBusinessObjectRepository.java b/jpa/security/src/main/java/example/springdata/jpa/security/SecureBusinessObjectRepository.java index e08a65ab..4c923dc0 100644 --- a/jpa/security/src/main/java/example/springdata/jpa/security/SecureBusinessObjectRepository.java +++ b/jpa/security/src/main/java/example/springdata/jpa/security/SecureBusinessObjectRepository.java @@ -43,4 +43,12 @@ public interface SecureBusinessObjectRepository extends Repository findBusinessObjectsForCurrentUser(); + + /** + * Here we apply a dynamic filter condition in there query depending of the role of the current principal. + * + * @return + */ + @Query("select o from BusinessObject o where o.owner.id = ?#{principal.id} or 1=?#{hasRole('ROLE_ADMIN') ? 1 : 0}") + List findBusinessObjectsForCurrentUserById(); } diff --git a/jpa/security/src/test/java/example/springdata/jpa/security/SecurityIntegrationTests.java b/jpa/security/src/test/java/example/springdata/jpa/security/SecurityIntegrationTests.java index 7bb47579..647d70f3 100644 --- a/jpa/security/src/test/java/example/springdata/jpa/security/SecurityIntegrationTests.java +++ b/jpa/security/src/test/java/example/springdata/jpa/security/SecurityIntegrationTests.java @@ -15,11 +15,10 @@ */ package example.springdata.jpa.security; -import static org.hamcrest.Matchers.contains; -import static org.hamcrest.collection.IsCollectionWithSize.hasSize; -import static org.junit.Assert.assertThat; +import static java.util.Collections.*; +import static org.hamcrest.Matchers.*; +import static org.junit.Assert.*; -import java.util.Collections; import java.util.List; import org.junit.Before; @@ -57,11 +56,11 @@ public class SecurityIntegrationTests { BusinessObject object3; @Before - public void setup(){ + public void setup() { - tom = userRepository.save(new User("thomas","darimont","tdarimont@example.org")); - olli = userRepository.save(new User("oliver","gierke","ogierke@example.org")); - admin = userRepository.save(new User("admin","admin","admin@example.org")); + tom = userRepository.save(new User("thomas", "darimont", "tdarimont@example.org")); + olli = userRepository.save(new User("oliver", "gierke", "ogierke@example.org")); + admin = userRepository.save(new User("admin", "admin", "admin@example.org")); object1 = businessObjectRepository.save(new BusinessObject("object1", olli)); object2 = businessObjectRepository.save(new BusinessObject("object2", olli)); @@ -69,31 +68,63 @@ public class SecurityIntegrationTests { } @Test - public void findBusinessObjectsForCurrentUserShouldReturnOnlyBusinessObjectsWhereCurrentUserIsOwner(){ + public void findBusinessObjectsForCurrentUserShouldReturnOnlyBusinessObjectsWhereCurrentUserIsOwner() { - SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(tom,"x")); + SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(tom, "x")); List businessObjects = secureBusinessObjectRepository.findBusinessObjectsForCurrentUser(); - assertThat(businessObjects,hasSize(1)); - assertThat(businessObjects,contains(object3)); + assertThat(businessObjects, hasSize(1)); + assertThat(businessObjects, contains(object3)); - SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(olli,"x")); + SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(olli, "x")); businessObjects = secureBusinessObjectRepository.findBusinessObjectsForCurrentUser(); - assertThat(businessObjects,hasSize(2)); - assertThat(businessObjects,contains(object1,object2)); + assertThat(businessObjects, hasSize(2)); + assertThat(businessObjects, contains(object1, object2)); } @Test - public void findBusinessObjectsForCurrentUserShouldReturnAllObjectsForAdmin(){ + public void findBusinessObjectsForCurrentUserShouldReturnAllObjectsForAdmin() { - SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(admin,"x", Collections.singleton(new SimpleGrantedAuthority("ROLE_ADMIN")))); + SecurityContextHolder.getContext().setAuthentication( + new UsernamePasswordAuthenticationToken(admin, "x", singleton(new SimpleGrantedAuthority("ROLE_ADMIN")))); List businessObjects = secureBusinessObjectRepository.findBusinessObjectsForCurrentUser(); - assertThat(businessObjects,hasSize(3)); - assertThat(businessObjects,contains(object1,object2, object3)); + assertThat(businessObjects, hasSize(3)); + assertThat(businessObjects, contains(object1, object2, object3)); + } + + @Test + public void findBusinessObjectsForCurrentUserByIdShouldReturnOnlyBusinessObjectsWhereCurrentUserIsOwner() { + + SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(tom, "x")); + + List businessObjects = secureBusinessObjectRepository.findBusinessObjectsForCurrentUserById(); + + assertThat(businessObjects, hasSize(1)); + assertThat(businessObjects, contains(object3)); + + SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(olli, "x")); + + businessObjects = secureBusinessObjectRepository.findBusinessObjectsForCurrentUserById(); + + assertThat(businessObjects, hasSize(2)); + assertThat(businessObjects, contains(object1, object2)); + } + + @Test + public void findBusinessObjectsForCurrentUserByIdShouldReturnAllObjectsForAdmin() { + + UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(admin, "x", + singleton(new SimpleGrantedAuthority("ROLE_ADMIN"))); + SecurityContextHolder.getContext().setAuthentication(auth); + + List businessObjects = secureBusinessObjectRepository.findBusinessObjectsForCurrentUserById(); + + assertThat(businessObjects, hasSize(3)); + assertThat(businessObjects, contains(object1, object2, object3)); } }