From 388a04358c7327699a88a5062dbea1698739080b Mon Sep 17 00:00:00 2001 From: Oliver Drotbohm Date: Thu, 7 Oct 2021 13:19:54 +0200 Subject: [PATCH] =?UTF-8?q?Integration=20test=20to=20verify=20securing=20f?= =?UTF-8?q?indById(=E2=80=A6)=20generally=20works.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue: #2070. --- .../security/PreAuthorizedOrderRepository.java | 5 +++++ .../tests/security/SecurityIntegrationTests.java | 14 ++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/PreAuthorizedOrderRepository.java b/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/PreAuthorizedOrderRepository.java index 7a33f92a6..60ea35ffa 100644 --- a/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/PreAuthorizedOrderRepository.java +++ b/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/PreAuthorizedOrderRepository.java @@ -15,6 +15,7 @@ */ package org.springframework.data.rest.tests.security; +import java.util.Optional; import java.util.UUID; import org.springframework.data.repository.CrudRepository; @@ -28,6 +29,10 @@ import org.springframework.security.access.prepost.PreAuthorize; @PreAuthorize("hasRole('ROLE_USER')") // <1> public interface PreAuthorizedOrderRepository extends CrudRepository { + @PreAuthorize("hasRole('ROLE_ADMIN')") + @Override + Optional findById(UUID id); + @PreAuthorize("hasRole('ROLE_ADMIN')") // <2> @Override void deleteById(UUID aLong); diff --git a/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/SecurityIntegrationTests.java b/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/SecurityIntegrationTests.java index e8de19ecc..b4d9b5c9e 100755 --- a/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/SecurityIntegrationTests.java +++ b/spring-data-rest-tests/spring-data-rest-tests-security/src/test/java/org/springframework/data/rest/tests/security/SecurityIntegrationTests.java @@ -37,6 +37,7 @@ import org.springframework.security.core.authority.AuthorityUtils; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.test.context.ContextConfiguration; import org.springframework.test.context.junit4.SpringRunner; +import org.springframework.test.web.servlet.result.MockMvcResultHandlers; import org.springframework.test.web.servlet.setup.MockMvcBuilders; import org.springframework.web.context.WebApplicationContext; @@ -229,4 +230,17 @@ public class SecurityIntegrationTests extends AbstractWebIntegrationTests { with(user("user").roles("USER", "ADMIN"))).// andExpect(status().isOk()); } + + @Test // #2070 + public void rejectsAccessToItemResourceIfNotAuthorized() throws Exception { + + MockHttpServletResponse response = mvc.perform(get(client.discoverUnique("orders").expand().getHref()).// + with(user("user").roles("USER"))).// + andReturn().getResponse(); + String href = assertHasJsonPathValue("$._embedded.orders[0]._links.self.href", response); + + mvc.perform(get(href).with(user("user").roles("USER"))) + .andDo(MockMvcResultHandlers.print()) + .andExpect(status().isForbidden()); + } }