SEC-2329: Allow injecting of AuthenticationTrustResolver

web/src/test/java/org/springframework/security/web/access/expression/DefaultWebSecurityExpressionHandlerTests.java

@@ -1,22 +1,67 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.springframework.security.web.access.expression;
 
+import static org.fest.assertions.Assertions.assertThat;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 
+import org.junit.After;
+import org.junit.Before;
 import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.context.support.StaticApplicationContext;
 import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.security.access.SecurityConfig;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.FilterInvocation;
 
+@RunWith(MockitoJUnitRunner.class)
 public class DefaultWebSecurityExpressionHandlerTests {
+    @Mock
+    private AuthenticationTrustResolver trustResolver;
+
+    @Mock
+    private Authentication authentication;
+
+    @Mock
+    private FilterInvocation invocation;
+
+    private DefaultWebSecurityExpressionHandler handler;
+
+    @Before
+    public void setup() {
+        handler = new DefaultWebSecurityExpressionHandler();
+    }
+
+    @After
+    public void cleanup() {
+        SecurityContextHolder.clearContext();
+    }
 
     @Test
     public void expressionPropertiesAreResolvedAgainsAppContextBeans() throws Exception {
-        DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
         StaticApplicationContext appContext = new StaticApplicationContext();
         RootBeanDefinition bean = new RootBeanDefinition(SecurityConfig.class);
         bean.getConstructorArgumentValues().addGenericArgumentValue("ROLE_A");
@@ -29,4 +74,20 @@ public class DefaultWebSecurityExpressionHandlerTests {
         assertTrue(parser.parseExpression("@role.attribute == 'ROLE_A'").getValue(ctx, Boolean.class));
     }
 
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setTrustResolverNull() {
+        handler.setTrustResolver(null);
+    }
+
+    @Test
+    public void createEvaluationContextCustomTrustResolver() {
+        handler.setTrustResolver(trustResolver);
+
+        Expression expression = handler.getExpressionParser().parseExpression("anonymous");
+        EvaluationContext context = handler.createEvaluationContext(authentication, invocation);
+        assertThat(expression.getValue(context, Boolean.class)).isFalse();
+
+        verify(trustResolver).isAnonymous(authentication);
+    }
 }

web/src/test/java/org/springframework/security/web/context/HttpSessionSecurityContextRepositoryTests.java

@@ -13,13 +13,19 @@
 package org.springframework.security.web.context;
 
 import static org.fest.assertions.Assertions.assertThat;
-import static org.junit.Assert.*;
-import static org.springframework.security.web.context.HttpSessionSecurityContextRepository.*;
-import static org.mockito.Mockito.verify;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Matchers.anyBoolean;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.reset;
-import static org.mockito.Matchers.*;
-import static org.powermock.api.mockito.PowerMockito.*;
+import static org.mockito.Mockito.verify;
+import static org.powermock.api.mockito.PowerMockito.mock;
+import static org.powermock.api.mockito.PowerMockito.spy;
+import static org.powermock.api.mockito.PowerMockito.when;
+import static org.springframework.security.web.context.HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY;
 
 import javax.servlet.ServletOutputStream;
 import javax.servlet.ServletRequest;
@@ -35,6 +41,7 @@ import org.powermock.modules.junit4.PowerMockRunner;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContext;
@@ -466,4 +473,26 @@ public class HttpSessionSecurityContextRepositoryTests {
         assertEquals(url, holder.getResponse().encodeUrl(url));
         assertEquals(url, holder.getResponse().encodeURL(url));
     }
+
+    @Test
+    public void saveContextCustomTrustResolver() {
+        SecurityContext contextToSave = SecurityContextHolder.createEmptyContext();
+        contextToSave.setAuthentication(testToken);
+        HttpSessionSecurityContextRepository repo = new HttpSessionSecurityContextRepository();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, new MockHttpServletResponse());
+        repo.loadContext(holder);
+        AuthenticationTrustResolver trustResolver = mock(AuthenticationTrustResolver.class);
+        repo.setTrustResolver(trustResolver);
+
+        repo.saveContext(contextToSave, holder.getRequest(), holder.getResponse());
+
+        verify(trustResolver).isAnonymous(contextToSave.getAuthentication());
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setTrustResolverNull() {
+        HttpSessionSecurityContextRepository repo = new HttpSessionSecurityContextRepository();
+        repo.setTrustResolver(null);
+    }
 }

web/src/test/java/org/springframework/security/web/session/SessionManagementFilterTests.java

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.springframework.security.web.session;
 
 import static org.junit.Assert.*;
@@ -13,10 +28,10 @@ import org.junit.Test;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.DefaultRedirectStrategy;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.session.SessionAuthenticationException;
 import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
@@ -24,6 +39,7 @@ import org.springframework.security.web.context.SecurityContextRepository;
 
 /**
  * @author Luke Taylor
+ * @author Rob Winch
  */
 public class SessionManagementFilterTests {
 
@@ -143,6 +159,27 @@ public class SessionManagementFilterTests {
         assertEquals("/timedOut", response.getRedirectedUrl());
     }
 
+    @Test
+    public void customAuthenticationTrustResolver() throws Exception {
+        AuthenticationTrustResolver trustResolver= mock(AuthenticationTrustResolver.class);
+        SecurityContextRepository repo = mock(SecurityContextRepository.class);
+        SessionManagementFilter filter = new SessionManagementFilter(repo);
+        filter.setTrustResolver(trustResolver);
+        HttpServletRequest request = new MockHttpServletRequest();
+        authenticateUser();
+
+        filter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
+
+        verify(trustResolver).isAnonymous(any(Authentication.class));
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setTrustResolverNull() {
+        SecurityContextRepository repo = mock(SecurityContextRepository.class);
+        SessionManagementFilter filter = new SessionManagementFilter(repo);
+        filter.setTrustResolver(null);
+    }
+
     private void authenticateUser() {
         SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "pass"));
     }