Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add AfterMethodAuthorizationManager

Browse Source 
- Removes the need to keep MethodAuthorizationContext#returnObject
in sync with other method parameters
- Restores MethodAuthorizationContext's immutability

Closes gh-9591
This commit is contained in:
Josh Cummings
2021-04-08 11:36:03 -06:00
parent 2b494ebc5f
commit 6828987b4b
12 changed files with 176 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/src/test/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdviceTests.java
View File

@@ -23,7 +23,6 @@ import org.junit.Test;
import org.springframework.aop.Pointcut;
import org.springframework.security.authentication.TestAuthentication;
import org.springframework.security.authorization.AuthorizationManager;
import org.springframework.security.core.Authentication;
import static org.assertj.core.api.Assertions.assertThat;
@@ -40,8 +39,10 @@ public class AuthorizationManagerMethodAfterAdviceTests {
@Test
public void instantiateWhenMethodMatcherNullThenException() {
AfterMethodAuthorizationManager<MethodInvocation> mockAuthorizationManager = mock(
AfterMethodAuthorizationManager.class);
assertThatIllegalArgumentException()
.isThrownBy(() -> new AuthorizationManagerMethodAfterAdvice<>(null, mock(AuthorizationManager.class)))
.isThrownBy(() -> new AuthorizationManagerMethodAfterAdvice<>(null, mockAuthorizationManager))
.withMessage("pointcut cannot be null");
}
@@ -57,12 +58,13 @@ public class AuthorizationManagerMethodAfterAdviceTests {
Supplier<Authentication> authentication = TestAuthentication::authenticatedUser;
MethodInvocation mockMethodInvocation = mock(MethodInvocation.class);
Object returnedObject = new Object();
AuthorizationManager<MethodInvocation> mockAuthorizationManager = mock(AuthorizationManager.class);
AfterMethodAuthorizationManager<MethodInvocation> mockAuthorizationManager = mock(
AfterMethodAuthorizationManager.class);
AuthorizationManagerMethodAfterAdvice<MethodInvocation> advice = new AuthorizationManagerMethodAfterAdvice<>(
mock(Pointcut.class), mockAuthorizationManager);
Object result = advice.after(authentication, mockMethodInvocation, returnedObject);
assertThat(result).isEqualTo(returnedObject);
verify(mockAuthorizationManager).verify(authentication, mockMethodInvocation);
verify(mockAuthorizationManager).verify(authentication, mockMethodInvocation, returnedObject);
}
}

12
core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java
View File

@@ -62,7 +62,7 @@ public class PostAuthorizeAuthorizationManagerTests {
TestClass.class);
PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser,
methodAuthorizationContext);
methodAuthorizationContext, null);
assertThat(decision).isNull();
}
@@ -74,7 +74,7 @@ public class PostAuthorizeAuthorizationManagerTests {
TestClass.class);
PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser,
methodAuthorizationContext);
methodAuthorizationContext, null);
assertThat(decision).isNotNull();
assertThat(decision.isGranted()).isTrue();
}
@@ -87,7 +87,7 @@ public class PostAuthorizeAuthorizationManagerTests {
TestClass.class);
PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser,
methodAuthorizationContext);
methodAuthorizationContext, null);
assertThat(decision).isNotNull();
assertThat(decision.isGranted()).isFalse();
}
@@ -99,10 +99,9 @@ public class PostAuthorizeAuthorizationManagerTests {
"doSomethingList", new Class[] { List.class }, new Object[] { list });
MethodAuthorizationContext methodAuthorizationContext = new MethodAuthorizationContext(mockMethodInvocation,
TestClass.class);
methodAuthorizationContext.setReturnObject(list);
PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser,
methodAuthorizationContext);
methodAuthorizationContext, list);
assertThat(decision).isNotNull();
assertThat(decision.isGranted()).isTrue();
}
@@ -114,10 +113,9 @@ public class PostAuthorizeAuthorizationManagerTests {
"doSomethingList", new Class[] { List.class }, new Object[] { list });
MethodAuthorizationContext methodAuthorizationContext = new MethodAuthorizationContext(mockMethodInvocation,
TestClass.class);
methodAuthorizationContext.setReturnObject(list);
PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser,
methodAuthorizationContext);
methodAuthorizationContext, list);
assertThat(decision).isNotNull();
assertThat(decision.isGranted()).isFalse();
}