SEC-126: Initial commit of WebInvocationPrivilegeEvaluator feature.

core/src/test/java/org/acegisecurity/intercept/web/WebInvocationPrivilegeEvaluatorTests.java

@@ -0,0 +1,104 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.acegisecurity.intercept.web;
+
+import junit.framework.TestCase;
+
+import org.acegisecurity.GrantedAuthority;
+import org.acegisecurity.GrantedAuthorityImpl;
+
+import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
+
+import org.acegisecurity.util.FilterInvocationUtils;
+
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.support.ClassPathXmlApplicationContext;
+
+
+/**
+ * Tests {@link
+ * org.acegisecurity.intercept.web.WebInvocationPrivilegeEvaluator}.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class WebInvocationPrivilegeEvaluatorTests extends TestCase {
+    //~ Constructors ===========================================================
+
+    public WebInvocationPrivilegeEvaluatorTests() {
+        super();
+    }
+
+    public WebInvocationPrivilegeEvaluatorTests(String arg0) {
+        super(arg0);
+    }
+
+    //~ Methods ================================================================
+
+    public static void main(String[] args) {
+        junit.textui.TestRunner.run(WebInvocationPrivilegeEvaluatorTests.class);
+    }
+
+    private FilterSecurityInterceptor makeFilterSecurityInterceptor() {
+        ApplicationContext context = new ClassPathXmlApplicationContext(
+                "org/acegisecurity/intercept/web/applicationContext.xml");
+
+        return (FilterSecurityInterceptor) context.getBean(
+            "securityInterceptor");
+    }
+
+    public void testAllowsAccess1() throws Exception {
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
+                "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_INDEX")});
+        FilterInvocation fi = FilterInvocationUtils.create("/foo/index.jsp");
+        FilterSecurityInterceptor interceptor = makeFilterSecurityInterceptor();
+
+        WebInvocationPrivilegeEvaluator wipe = new WebInvocationPrivilegeEvaluator();
+        wipe.setSecurityInterceptor(interceptor);
+        wipe.afterPropertiesSet();
+
+        assertTrue(wipe.isAllowed(fi, token));
+    }
+
+    public void testAllowsAccess2() throws Exception {
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
+                "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_USER")});
+        FilterInvocation fi = FilterInvocationUtils.create("/anything.jsp");
+        FilterSecurityInterceptor interceptor = makeFilterSecurityInterceptor();
+
+        WebInvocationPrivilegeEvaluator wipe = new WebInvocationPrivilegeEvaluator();
+        wipe.setSecurityInterceptor(interceptor);
+        wipe.afterPropertiesSet();
+
+        assertTrue(wipe.isAllowed(fi, token));
+    }
+
+    public void testDeniesAccess1() throws Exception {
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
+                "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_NOTHING_USEFUL")});
+        FilterInvocation fi = FilterInvocationUtils.create("/anything.jsp");
+        FilterSecurityInterceptor interceptor = makeFilterSecurityInterceptor();
+
+        WebInvocationPrivilegeEvaluator wipe = new WebInvocationPrivilegeEvaluator();
+        wipe.setSecurityInterceptor(interceptor);
+        wipe.afterPropertiesSet();
+
+        assertFalse(wipe.isAllowed(fi, token));
+    }
+}

core/src/test/resources/org/acegisecurity/intercept/web/applicationContext.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
+<!--
+ * Copyright 2004, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * $Id$
+-->
+
+<beans>
+	<bean id="authentication" class="org.acegisecurity.MockAuthenticationManager"/>
+	<bean id="accessDecision" class="org.acegisecurity.MockAccessDecisionManager"/>
+	<bean id="runAs" class="org.acegisecurity.MockRunAsManager"/>
+
+	<bean id="securityInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
+		<property name="authenticationManager"><ref local="authentication"/></property>
+		<property name="accessDecisionManager"><ref local="accessDecision"/></property>
+		<property name="runAsManager"><ref local="runAs"/></property>
+		<property name="objectDefinitionSource">
+        	<value>
+			    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
+			    PATTERN_TYPE_APACHE_ANT
+			    /foo/index.jsp=MOCK_INDEX
+			    /hello.htm=MOCK_HELLO
+				/**=MOCK_USER
+        	</value>
+		</property>
+	</bean>
+
+</beans>