SEC-674: Created new project modules for cas, captcha, acls and taglibs

taglibs/src/test/java/org/springframework/security/taglibs/authz/AclTagTests.java

@@ -0,0 +1,182 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.authz;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.util.InMemoryXmlApplicationContext;
+
+import org.springframework.security.acl.AclEntry;
+import org.springframework.security.acl.AclManager;
+import org.springframework.security.acl.basic.SimpleAclEntry;
+import org.springframework.security.acl.basic.AclObjectIdentity;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.support.StaticApplicationContext;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.PageContext;
+import javax.servlet.jsp.tagext.Tag;
+
+
+/**
+ * Tests {@link AclTag}.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class AclTagTests extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final MyAclTag aclTag = new MyAclTag();
+
+    //~ Methods ========================================================================================================
+
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testInclusionDeniedWhenAclManagerUnawareOfObject() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission(new Long(SimpleAclEntry.ADMINISTRATION).toString());
+        aclTag.setDomainObject(new Integer(54));
+        assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
+    }
+
+    public void testInclusionDeniedWhenNoListOfPermissionsGiven() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission(null);
+        aclTag.setDomainObject("object1");
+        assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
+    }
+
+    public void testInclusionDeniedWhenPrincipalDoesNotHoldAnyPermissions() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("john", "crow", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission(new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ));
+        assertEquals(new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ),
+            aclTag.getHasPermission());
+        aclTag.setDomainObject("object1");
+        assertEquals("object1", aclTag.getDomainObject());
+        assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
+    }
+
+    public void testInclusionDeniedWhenPrincipalDoesNotHoldRequiredPermissions() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission(new Integer(SimpleAclEntry.DELETE).toString());
+        aclTag.setDomainObject("object1");
+        assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
+    }
+
+    public void testInclusionDeniedWhenSecurityContextEmpty() throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        aclTag.setHasPermission(new Long(SimpleAclEntry.ADMINISTRATION).toString());
+        aclTag.setDomainObject("object1");
+        assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
+    }
+
+    public void testInclusionPermittedWhenDomainObjectIsNull() throws JspException {
+        aclTag.setHasPermission(new Integer(SimpleAclEntry.READ).toString());
+        aclTag.setDomainObject(null);
+        assertEquals(Tag.EVAL_BODY_INCLUDE, aclTag.doStartTag());
+    }
+
+    public void testJspExceptionThrownIfHasPermissionNotValidFormat() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("john", "crow", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission("0,5, 6"); // shouldn't be any space
+
+        try {
+            aclTag.doStartTag();
+            fail("Should have thrown JspException");
+        } catch (JspException expected) {
+            assertTrue(true);
+        }
+    }
+
+    public void testOperationWhenPrincipalHoldsPermissionOfMultipleList() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission(new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ));
+        aclTag.setDomainObject("object1");
+        assertEquals(Tag.EVAL_BODY_INCLUDE, aclTag.doStartTag());
+    }
+
+    public void testOperationWhenPrincipalHoldsPermissionOfSingleList() throws JspException {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        aclTag.setHasPermission(new Integer(SimpleAclEntry.READ).toString());
+        aclTag.setDomainObject("object1");
+        assertEquals(Tag.EVAL_BODY_INCLUDE, aclTag.doStartTag());
+    }
+
+    //~ Inner Classes ==================================================================================================
+
+    private class MockAclEntry implements AclEntry {
+        // just so AclTag iterates some different types of AclEntrys
+    }
+
+    private class MyAclTag extends AclTag {
+        protected ApplicationContext getContext(PageContext pageContext) {
+            StaticApplicationContext context = new StaticApplicationContext();
+
+            final AclEntry[] acls = new AclEntry[] {
+                        new MockAclEntry(),
+                        new SimpleAclEntry("rod", new MockAclObjectIdentity(), null, SimpleAclEntry.ADMINISTRATION),
+                        new SimpleAclEntry("rod", new MockAclObjectIdentity(), null, SimpleAclEntry.READ)
+            };
+
+
+            // Create an AclManager
+            AclManager aclManager = new AclManager() {
+                String object = "object1";
+                String principal = "rod";
+
+                public AclEntry[] getAcls(Object domainInstance) {
+                    return domainInstance.equals(object) ? acls : null;
+                }
+
+                public AclEntry[] getAcls(Object domainInstance, Authentication authentication) {
+                    return domainInstance.equals(object) && authentication.getPrincipal().equals(principal) ? acls : null;
+                }
+            };
+
+            // Register the AclManager into our ApplicationContext
+            context.getBeanFactory().registerSingleton("aclManager", aclManager);
+
+            return context;
+        }
+    }
+
+    private static class MockAclObjectIdentity implements AclObjectIdentity {
+    }    
+}

taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthenticationTagTests.java

@@ -0,0 +1,126 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.authz;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.TestingAuthenticationToken;
+import org.springframework.security.userdetails.User;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.Tag;
+
+
+/**
+ * Tests {@link AuthenticationTag}.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class AuthenticationTagTests extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final MyAuthenticationTag authenticationTag = new MyAuthenticationTag();
+    private final Authentication auth = new TestingAuthenticationToken(new User("rodUserDetails", "koala", true, true, true,
+                    true, new GrantedAuthority[] {}), "koala", new GrantedAuthority[] {});
+
+    //~ Methods ========================================================================================================
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testOperationWhenPrincipalIsAUserDetailsInstance()throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authenticationTag.setProperty("name");
+        assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
+        assertEquals(Tag.EVAL_PAGE, authenticationTag.doEndTag());
+        assertEquals("rodUserDetails", authenticationTag.getLastMessage());
+    }
+
+    public void testOperationWhenPrincipalIsAString() throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(
+                new TestingAuthenticationToken("rodAsString", "koala", new GrantedAuthority[] {}));
+
+        authenticationTag.setProperty("principal");
+        assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
+        assertEquals(Tag.EVAL_PAGE, authenticationTag.doEndTag());
+        assertEquals("rodAsString", authenticationTag.getLastMessage());
+    }
+
+    public void testNestedPropertyIsReadCorrectly() throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authenticationTag.setProperty("principal.username");
+        assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
+        assertEquals(Tag.EVAL_PAGE, authenticationTag.doEndTag());
+        assertEquals("rodUserDetails", authenticationTag.getLastMessage());
+    }
+
+    public void testOperationWhenPrincipalIsNull() throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(
+                new TestingAuthenticationToken(null, "koala", new GrantedAuthority[] {}));
+
+        authenticationTag.setProperty("principal");
+        assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
+        assertEquals(Tag.EVAL_PAGE, authenticationTag.doEndTag());
+    }
+
+    public void testOperationWhenSecurityContextIsNull() throws Exception {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        authenticationTag.setProperty("principal");
+        assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
+        assertEquals(Tag.EVAL_PAGE, authenticationTag.doEndTag());
+        assertEquals(null, authenticationTag.getLastMessage());
+    }
+
+    public void testSkipsBodyIfNullOrEmptyOperation() throws Exception {
+        authenticationTag.setProperty("");
+        assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
+        assertEquals(Tag.EVAL_PAGE, authenticationTag.doEndTag());
+    }
+
+    public void testThrowsExceptionForUnrecognisedProperty() {
+        SecurityContextHolder.getContext().setAuthentication(auth);
+        authenticationTag.setProperty("qsq");
+
+        try {
+            authenticationTag.doStartTag();
+            authenticationTag.doEndTag();
+            fail("Should have throwns JspException");
+        } catch (JspException expected) {
+        }
+    }
+
+    //~ Inner Classes ==================================================================================================
+
+    private class MyAuthenticationTag extends AuthenticationTag {
+        String lastMessage = null;
+
+        public String getLastMessage() {
+            return lastMessage;
+        }
+
+        protected void writeMessage(String msg) throws JspException {
+            lastMessage = msg;
+        }
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagAttributeTests.java

@@ -0,0 +1,98 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.authz;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.Tag;
+
+
+/**
+ * DOCUMENT ME!
+ *
+ * @author Francois Beausoleil
+ * @version $Id$
+ */
+public class AuthorizeTagAttributeTests extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final AuthorizeTag authorizeTag = new AuthorizeTag();
+    private TestingAuthenticationToken currentUser;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        currentUser = new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {
+                    new GrantedAuthorityImpl("ROLE_SUPERVISOR"), new GrantedAuthorityImpl("ROLE_RESTRICTED"),
+                });
+
+        SecurityContextHolder.getContext().setAuthentication(currentUser);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAssertsIfAllGrantedSecond() throws JspException {
+        authorizeTag.setIfAllGranted("ROLE_SUPERVISOR,ROLE_SUPERTELLER");
+        authorizeTag.setIfAnyGranted("ROLE_RESTRICTED");
+        assertEquals("prevents request - principal is missing ROLE_SUPERTELLER", Tag.SKIP_BODY,
+            authorizeTag.doStartTag());
+    }
+
+    public void testAssertsIfAnyGrantedLast() throws JspException {
+        authorizeTag.setIfAnyGranted("ROLE_BANKER");
+        assertEquals("prevents request - principal is missing ROLE_BANKER", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testAssertsIfNotGrantedFirst() throws JspException {
+        authorizeTag.setIfNotGranted("ROLE_RESTRICTED");
+        authorizeTag.setIfAllGranted("ROLE_SUPERVISOR,ROLE_RESTRICTED");
+        authorizeTag.setIfAnyGranted("ROLE_SUPERVISOR");
+        assertEquals("prevents request - principal has ROLE_RESTRICTED", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testAssertsIfNotGrantedIgnoresWhitespaceInAttribute()
+        throws JspException {
+        authorizeTag.setIfAnyGranted("\tROLE_SUPERVISOR  \t, \r\n\t ROLE_TELLER ");
+        assertEquals("allows request - principal has ROLE_SUPERVISOR", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
+    }
+
+    public void testIfAllGrantedIgnoresWhitespaceInAttribute()
+        throws JspException {
+        authorizeTag.setIfAllGranted("\nROLE_SUPERVISOR\t,ROLE_RESTRICTED\t\n\r ");
+        assertEquals("allows request - principal has ROLE_RESTRICTED " + "and ROLE_SUPERVISOR", Tag.EVAL_BODY_INCLUDE,
+            authorizeTag.doStartTag());
+    }
+
+    public void testIfNotGrantedIgnoresWhitespaceInAttribute()
+        throws JspException {
+        authorizeTag.setIfNotGranted(" \t  ROLE_TELLER \r");
+        assertEquals("allows request - principal does not have ROLE_TELLER", Tag.EVAL_BODY_INCLUDE,
+            authorizeTag.doStartTag());
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagCustomGrantedAuthorityTests.java

@@ -0,0 +1,91 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.authz;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.GrantedAuthority;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.Tag;
+
+
+/**
+ * DOCUMENT ME!
+ *
+ * @author Francois Beausoleil
+ * @version $Id$
+ */
+public class AuthorizeTagCustomGrantedAuthorityTests extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final AuthorizeTag authorizeTag = new AuthorizeTag();
+    private TestingAuthenticationToken currentUser;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        currentUser = new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {new CustomGrantedAuthority("ROLE_TELLER")});
+
+        SecurityContextHolder.getContext().setAuthentication(currentUser);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAllowsRequestWhenCustomAuthorityPresentsCorrectRole()
+        throws JspException {
+        authorizeTag.setIfAnyGranted("ROLE_TELLER");
+        assertEquals("authorized - ROLE_TELLER in both sets", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
+    }
+
+    public void testRejectsRequestWhenCustomAuthorityReturnsNull()
+        throws JspException {
+        authorizeTag.setIfAnyGranted("ROLE_TELLER");
+        SecurityContextHolder.getContext()
+                             .setAuthentication(new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {new CustomGrantedAuthority(null)}));
+
+        try {
+            authorizeTag.doStartTag();
+            fail("Failed to reject GrantedAuthority with NULL getAuthority()");
+        } catch (IllegalArgumentException expected) {
+            assertTrue("expected", true);
+        }
+    }
+
+    //~ Inner Classes ==================================================================================================
+
+    private static class CustomGrantedAuthority implements GrantedAuthority {
+        private final String authority;
+
+        public CustomGrantedAuthority(String authority) {
+            this.authority = authority;
+        }
+
+        public String getAuthority() {
+            return authority;
+        }
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagExpressionLanguageTests.java

@@ -0,0 +1,83 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.authz;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import org.springframework.mock.web.MockPageContext;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.Tag;
+
+
+/**
+ * Test case to implement commons-el expression language expansion.
+ */
+public class AuthorizeTagExpressionLanguageTests extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final AuthorizeTag authorizeTag = new AuthorizeTag();
+    private MockPageContext pageContext;
+    private TestingAuthenticationToken currentUser;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        pageContext = new MockPageContext();
+        authorizeTag.setPageContext(pageContext);
+
+        currentUser = new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_TELLER"),});
+
+        SecurityContextHolder.getContext().setAuthentication(currentUser);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAllGrantedUsesExpressionLanguageWhenExpressionIsEL() throws JspException {
+        pageContext.setAttribute("authority", "ROLE_TELLER");
+        authorizeTag.setIfAllGranted("${authority}");
+
+        assertEquals("allows body - authority var contains ROLE_TELLER", Tag.EVAL_BODY_INCLUDE,
+            authorizeTag.doStartTag());
+    }
+
+    public void testAnyGrantedUsesExpressionLanguageWhenExpressionIsEL() throws JspException {
+        pageContext.setAttribute("authority", "ROLE_TELLER");
+        authorizeTag.setIfAnyGranted("${authority}");
+
+        assertEquals("allows body - authority var contains ROLE_TELLER", Tag.EVAL_BODY_INCLUDE,
+            authorizeTag.doStartTag());
+    }
+
+    public void testNotGrantedUsesExpressionLanguageWhenExpressionIsEL() throws JspException {
+        pageContext.setAttribute("authority", "ROLE_TELLER");
+        authorizeTag.setIfNotGranted("${authority}");
+
+        assertEquals("allows body - authority var contains ROLE_TELLER", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagTests.java

@@ -0,0 +1,113 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.authz;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.Tag;
+
+
+/**
+ * DOCUMENT ME!
+ *
+ * @author Francois Beausoleil
+ * @version $Id$
+ */
+public class AuthorizeTagTests extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final AuthorizeTag authorizeTag = new AuthorizeTag();
+    private TestingAuthenticationToken currentUser;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        currentUser = new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {
+                    new GrantedAuthorityImpl("ROLE SUPERVISOR"), new GrantedAuthorityImpl("ROLE_TELLER"),
+                });
+
+        SecurityContextHolder.getContext().setAuthentication(currentUser);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAlwaysReturnsUnauthorizedIfNoUserFound() throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        authorizeTag.setIfAllGranted("ROLE_TELLER");
+        assertEquals("prevents request - no principal in Context", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testDefaultsToNotOutputtingBodyWhenNoRequiredAuthorities() throws JspException {
+        assertEquals("", authorizeTag.getIfAllGranted());
+        assertEquals("", authorizeTag.getIfAnyGranted());
+        assertEquals("", authorizeTag.getIfNotGranted());
+
+        assertEquals("prevents body output - no authorities granted", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testOutputsBodyIfOneRolePresent() throws JspException {
+        authorizeTag.setIfAnyGranted("ROLE_TELLER");
+        assertEquals("authorized - ROLE_TELLER in both sets", Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
+    }
+
+    public void testOutputsBodyWhenAllGranted() throws JspException {
+        authorizeTag.setIfAllGranted("ROLE SUPERVISOR,ROLE_TELLER");
+        assertEquals("allows request - all required roles granted on principal", Tag.EVAL_BODY_INCLUDE,
+            authorizeTag.doStartTag());
+    }
+
+    public void testOutputsBodyWhenNotGrantedSatisfied() throws JspException {
+        authorizeTag.setIfNotGranted("ROLE_BANKER");
+        assertEquals("allows request - principal doesn't have ROLE_BANKER", Tag.EVAL_BODY_INCLUDE,
+            authorizeTag.doStartTag());
+    }
+
+    public void testPreventsBodyOutputIfNoSecurityContext() throws JspException {
+        SecurityContextHolder.getContext().setAuthentication(null);
+        authorizeTag.setIfAnyGranted("ROLE_BANKER");
+
+        assertEquals("prevents output - no context defined", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testSkipsBodyIfNoAnyRolePresent() throws JspException {
+        authorizeTag.setIfAnyGranted("ROLE_BANKER");
+        assertEquals("unauthorized - ROLE_BANKER not in granted authorities", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testSkipsBodyWhenMissingAnAllGranted() throws JspException {
+        authorizeTag.setIfAllGranted("ROLE SUPERVISOR,ROLE_TELLER,ROLE_BANKER");
+        assertEquals("prevents request - missing ROLE_BANKER on principal", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
+    public void testSkipsBodyWhenNotGrantedUnsatisfied() throws JspException {
+        authorizeTag.setIfNotGranted("ROLE_TELLER");
+        assertEquals("prevents request - principal has ROLE_TELLER", Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplAttributeTest.java

@@ -0,0 +1,95 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.velocity;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import javax.servlet.jsp.JspException;
+
+
+/**
+ * DOCUMENT ME!
+ */
+public class AuthzImplAttributeTest extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private final Authz authz = new AuthzImpl();
+    private TestingAuthenticationToken currentUser;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        currentUser = new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {
+                    new GrantedAuthorityImpl("ROLE_SUPERVISOR"), new GrantedAuthorityImpl("ROLE_RESTRICTED"),
+                });
+
+        SecurityContextHolder.getContext().setAuthentication(currentUser);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAssertsIfAllGrantedSecond() {
+        boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_SUPERTELLER");
+        boolean r2 = authz.anyGranted("ROLE_RESTRICTED");
+
+        //prevents request - principal is missing ROLE_SUPERTELLE
+        assertFalse(r1 && r2);
+    }
+
+    public void testAssertsIfAnyGrantedLast() {
+        boolean r2 = authz.anyGranted("ROLE_BANKER");
+
+        // prevents request - principal is missing ROLE_BANKER
+        assertFalse(r2);
+    }
+
+    public void testAssertsIfNotGrantedFirst() {
+        boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_RESTRICTED");
+        boolean r2 = authz.noneGranted("ROLE_RESTRICTED");
+        boolean r3 = authz.anyGranted("ROLE_SUPERVISOR");
+
+        //prevents request - principal has ROLE_RESTRICTED
+        assertFalse(r1 && r2 && r3);
+    }
+
+    public void testAssertsIfNotGrantedIgnoresWhitespaceInAttribute() {
+        //allows request - principal has ROLE_SUPERVISOR
+        assertTrue(authz.anyGranted("\tROLE_SUPERVISOR  \t, \r\n\t ROLE_TELLER "));
+    }
+
+    public void testIfAllGrantedIgnoresWhitespaceInAttribute() {
+        //allows request - principal has ROLE_RESTRICTED and ROLE_SUPERVISOR
+        assertTrue(authz.allGranted("\nROLE_SUPERVISOR\t,ROLE_RESTRICTED\t\n\r "));
+    }
+
+    public void testIfNotGrantedIgnoresWhitespaceInAttribute()
+        throws JspException {
+        //prevents request - principal does not have ROLE_TELLER
+        assertFalse(authz.allGranted(" \t  ROLE_TELLER \r"));
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplAuthorizeTagTest.java

@@ -0,0 +1,104 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.velocity;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+
+/**
+ * DOCUMENT ME!
+ */
+public class AuthzImplAuthorizeTagTest extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private Authz authz = new AuthzImpl();
+    private TestingAuthenticationToken currentUser;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        currentUser = new TestingAuthenticationToken("abc", "123",
+                new GrantedAuthority[] {
+                    new GrantedAuthorityImpl("ROLE_SUPERVISOR"), new GrantedAuthorityImpl("ROLE_TELLER"),
+                });
+
+        SecurityContextHolder.getContext().setAuthentication(currentUser);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAlwaysReturnsUnauthorizedIfNoUserFound() {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        //prevents request - no principal in Context
+        assertFalse(authz.allGranted("ROLE_TELLER"));
+    }
+
+    public void testDefaultsToNotOutputtingBodyWhenNoRequiredAuthorities() {
+        //prevents body output - no authorities granted
+        assertFalse(authz.allGranted(""));
+        assertFalse(authz.anyGranted(""));
+        assertFalse(authz.noneGranted(""));
+    }
+
+    public void testOutputsBodyIfOneRolePresent() {
+        //authorized - ROLE_TELLER in both sets
+        assertTrue(authz.anyGranted("ROLE_TELLER"));
+    }
+
+    public void testOutputsBodyWhenAllGranted() {
+        // allows request - all required roles granted on principal
+        assertTrue(authz.allGranted("ROLE_SUPERVISOR,ROLE_TELLER"));
+    }
+
+    public void testOutputsBodyWhenNotGrantedSatisfied() {
+        // allows request - principal doesn't have ROLE_BANKER
+        assertTrue(authz.noneGranted("ROLE_BANKER"));
+    }
+
+    public void testPreventsBodyOutputIfNoSecureContext() {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        // prevents output - no context defined
+        assertFalse(authz.anyGranted("ROLE_BANKER"));
+    }
+
+    public void testSkipsBodyIfNoAnyRolePresent() {
+        // unauthorized - ROLE_BANKER not in granted authorities
+        assertFalse(authz.anyGranted("ROLE_BANKER"));
+    }
+
+    public void testSkipsBodyWhenMissingAnAllGranted() {
+        //  prevents request - missing ROLE_BANKER on principal
+        assertFalse(authz.allGranted("ROLE_SUPERVISOR,ROLE_TELLER,ROLE_BANKER"));
+    }
+
+    public void testSkipsBodyWhenNotGrantedUnsatisfied() {
+        //  prevents request - principal has ROLE_TELLER
+        assertFalse(authz.noneGranted("ROLE_TELLER"));
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/velocity/AuthzImplTest.java

@@ -0,0 +1,246 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.taglibs.velocity;
+
+import junit.framework.TestCase;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+
+import org.springframework.security.acl.AclEntry;
+import org.springframework.security.acl.AclManager;
+import org.springframework.security.acl.basic.SimpleAclEntry;
+import org.springframework.security.acl.basic.AclObjectIdentity;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.security.providers.TestingAuthenticationToken;
+
+import org.springframework.security.userdetails.User;
+
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.context.support.StaticApplicationContext;
+
+
+public class AuthzImplTest extends TestCase {
+    //~ Instance fields ================================================================================================
+
+    private Authz authz = new AuthzImpl();
+    private ConfigurableApplicationContext ctx;
+
+    //~ Methods ========================================================================================================
+
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        ctx = new StaticApplicationContext();
+
+        final AclEntry[] acls = new AclEntry[] {new MockAclEntry(),
+                    new SimpleAclEntry("rod", new MockAclObjectIdentity(), null, SimpleAclEntry.ADMINISTRATION),
+                    new SimpleAclEntry("rod", new MockAclObjectIdentity(), null, SimpleAclEntry.READ)
+        };
+
+
+        // Create an AclManager
+        AclManager aclManager = new AclManager() {
+            String object = "object1";
+            String principal = "rod";
+
+            public AclEntry[] getAcls(Object domainInstance) {
+                return domainInstance.equals(object) ? acls : null;
+            }
+
+            public AclEntry[] getAcls(Object domainInstance, Authentication authentication) {
+                return domainInstance.equals(object) && authentication.getPrincipal().equals(principal) ? acls : null;
+            }
+        };
+
+        // Register the AclManager into our ApplicationContext
+        ctx.getBeanFactory().registerSingleton("aclManager", aclManager);
+    }
+
+    protected void tearDown() throws Exception {
+        ctx.close();
+    }
+
+    public void testIllegalArgumentExceptionThrownIfHasPermissionNotValidFormat() {
+        Authentication auth = new TestingAuthenticationToken("john", "crow", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authz.setAppCtx(ctx);
+
+        String permissions = "0,5, 6"; // shouldn't be any space
+
+        try {
+            authz.hasPermission(null, permissions);
+        } catch (IllegalArgumentException iae) {
+            assertTrue(true);
+        }
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testInclusionDeniedWhenAclManagerUnawareOfObject() {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authz.setAppCtx(ctx);
+
+        boolean result = authz.hasPermission(new Integer(54), new Long(SimpleAclEntry.ADMINISTRATION).toString());
+
+        assertFalse(result);
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testInclusionDeniedWhenNoListOfPermissionsGiven() {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+        authz.setAppCtx(ctx);
+
+        boolean result = authz.hasPermission("object1", null);
+
+        assertFalse(result);
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testInclusionDeniedWhenPrincipalDoesNotHoldAnyPermissions() {
+        Authentication auth = new TestingAuthenticationToken("john", "crow", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authz.setAppCtx(ctx);
+
+        String permissions = new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ);
+
+        boolean result = authz.hasPermission("object1", permissions);
+
+        assertFalse(result);
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testInclusionDeniedWhenPrincipalDoesNotHoldRequiredPermissions() {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+        authz.setAppCtx(ctx);
+
+        String permissions = new Integer(SimpleAclEntry.DELETE).toString();
+
+        boolean result = authz.hasPermission("object1", permissions);
+
+        assertFalse(result);
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testInclusionDeniedWhenSecurityContextEmpty() {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        authz.setAppCtx(ctx);
+
+        String permissions = new Long(SimpleAclEntry.ADMINISTRATION).toString();
+
+        boolean result = authz.hasPermission("object1", permissions);
+
+        assertFalse(result);
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testInclusionPermittedWhenDomainObjectIsNull() {
+        authz.setAppCtx(ctx);
+
+        String permissions = new Integer(SimpleAclEntry.READ).toString();
+
+        boolean result = authz.hasPermission(null, permissions);
+
+        assertTrue(result);
+    }
+
+    public void testOperationWhenPrincipalHoldsPermissionOfMultipleList() {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authz.setAppCtx(ctx);
+
+        String permissions = new Integer(SimpleAclEntry.ADMINISTRATION) + "," + new Integer(SimpleAclEntry.READ);
+
+        boolean result = authz.hasPermission("object1", permissions);
+
+        assertTrue(result);
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    public void testOperationWhenPrincipalHoldsPermissionOfSingleList() {
+        Authentication auth = new TestingAuthenticationToken("rod", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        authz.setAppCtx(ctx);
+
+        String permissions = new Integer(SimpleAclEntry.READ).toString();
+
+        boolean result = authz.hasPermission("object1", permissions);
+
+        assertTrue(result);
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    /*
+     * Test method for 'com.alibaba.exodus2.web.common.security.pulltool.AuthzImpl.getPrincipal()'
+     */
+    public void testOperationWhenPrincipalIsAString() {
+        Authentication auth = new TestingAuthenticationToken("rodAsString", "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        assertEquals("rodAsString", authz.getPrincipal());
+    }
+
+    public void testOperationWhenPrincipalIsAUserDetailsInstance() {
+        Authentication auth = new TestingAuthenticationToken(new User("rodUserDetails", "koala", true, true, true,
+                    true, new GrantedAuthority[] {}), "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        assertEquals("rodUserDetails", authz.getPrincipal());
+    }
+
+    public void testOperationWhenPrincipalIsNull() {
+        Authentication auth = new TestingAuthenticationToken(null, "koala", new GrantedAuthority[] {});
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        assertNull(authz.getPrincipal());
+    }
+
+    public void testOperationWhenSecurityContextIsNull() {
+        SecurityContextHolder.getContext().setAuthentication(null);
+
+        assertEquals(null, authz.getPrincipal());
+
+        SecurityContextHolder.getContext().setAuthentication(null);
+    }
+
+    //~ Inner Classes ==================================================================================================
+
+    private class MockAclEntry implements AclEntry {
+        private static final long serialVersionUID = 1L;
+
+        // just so AclTag iterates some different types of AclEntrys
+    }
+
+    private static class MockAclObjectIdentity implements AclObjectIdentity {
+    }
+}