Polishing contribution
Closes gh-367
This commit is contained in:
@@ -15,7 +15,7 @@ public class SalaryService {
|
||||
return new BigDecimal("42");
|
||||
}
|
||||
|
||||
@Secured({ "ROLE_HR" })
|
||||
@Secured("ROLE_HR")
|
||||
public void updateSalary(String employeeId, BigDecimal newSalary) {
|
||||
|
||||
}
|
||||
|
||||
@@ -1,3 +1,18 @@
|
||||
/*
|
||||
* Copyright 2002-2022 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package io.spring.sample.graphql;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
@@ -23,9 +38,7 @@ public class SecurityConfig {
|
||||
.csrf(c -> c.disable())
|
||||
// Demonstrate that method security works
|
||||
// Best practice to use both for defense in depth
|
||||
.authorizeRequests(requests -> requests
|
||||
.anyRequest().permitAll()
|
||||
)
|
||||
.authorizeRequests(requests -> requests.anyRequest().permitAll())
|
||||
.httpBasic(withDefaults())
|
||||
.build();
|
||||
}
|
||||
|
||||
@@ -75,11 +75,10 @@ class WebMvcHttpSecuritySampleTests {
|
||||
}
|
||||
|
||||
@Test
|
||||
void canNotMutationUpdateSalary() {
|
||||
WebGraphQlTester tester = this.graphQlTester.mutate().build();
|
||||
void canNotMutateUpdateSalary() {
|
||||
SalaryInput salaryInput = new SalaryInput("1", BigDecimal.valueOf(44));
|
||||
|
||||
tester.documentName("updateSalary")
|
||||
this.graphQlTester.documentName("updateSalary")
|
||||
.variable("salaryInput", salaryInput)
|
||||
.execute()
|
||||
.errors()
|
||||
|
||||
Reference in New Issue
Block a user