Examples with User com.aidanwhiteley.books.domain.User used on opensource projects

Example 46 with User

use of com.aidanwhiteley.books.domain.User in project books by aidanwhiteley.

the class BookSecureControllerTest method tryToCreateBookWithInsufficientPermissions.

@Test
void tryToCreateBookWithInsufficientPermissions() {
    Book testBook = BookRepositoryTest.createTestBook();
    // Set up user with just the ROLE_USER role
    User user = BookControllerTestUtils.getTestUser();
    user.removeRole(Role.ROLE_ADMIN);
    user.removeRole(Role.ROLE_EDITOR);
    String token = jwtUtils.createTokenForUser(user);
    HttpEntity<Book> putData = BookControllerTestUtils.getBookHttpEntity(testBook, token);
    ResponseEntity<Book> postResponse = testRestTemplate.exchange("/secure/api/books", HttpMethod.POST, putData, Book.class);
    assertEquals(HttpStatus.FORBIDDEN, postResponse.getStatusCode());
}

Example 47 with User

use of com.aidanwhiteley.books.domain.User in project books by aidanwhiteley.

the class BookSecureControllerTest method testDebugHeaders.

@Test
void testDebugHeaders() {
    User user = BookControllerTestUtils.getTestUser();
    String token = jwtUtils.createTokenForUser(user);
    // Re-using "book related" code to get required headers easily set up
    Book testBook = BookRepositoryTest.createTestBook();
    HttpEntity<Book> request = BookControllerTestUtils.getBookHttpEntity(testBook, token, null);
    ResponseEntity<String> response = testRestTemplate.exchange("/secure/api/debugheaders", HttpMethod.GET, request, String.class);
    assertEquals(HttpStatus.OK, response.getStatusCode());
    assertTrue(response.getBody().contains(JwtAuthenticationService.JWT_COOKIE_NAME));
}

Example 48 with User

use of com.aidanwhiteley.books.domain.User in project books by aidanwhiteley.

the class BookSecureControllerTest method createAndDeleteBook.

@Test
void createAndDeleteBook() {
    // Create book
    ResponseEntity<Book> response = BookControllerTestUtils.postBookToServer(jwtUtils, testRestTemplate);
    assertEquals(HttpStatus.CREATED, response.getStatusCode());
    // Get location of created book
    String location = response.getHeaders().getLocation().toString();
    assertTrue(location.length() > 0, "Location of newly created book should have been provided");
    String id = location.substring(location.lastIndexOf("/") + 1);
    // Get an admin user and required tokens and then delete the book
    User user = BookControllerTestUtils.getTestUser();
    String token = jwtUtils.createTokenForUser(user);
    String xsrfToken = BookControllerTestUtils.getXsrfToken(testRestTemplate);
    HttpEntity<Book> request = BookControllerTestUtils.getBookHttpEntity(null, token, xsrfToken);
    response = testRestTemplate.exchange("/secure/api/books/" + id, HttpMethod.DELETE, request, Book.class);
    assertEquals(HttpStatus.NO_CONTENT, response.getStatusCode());
    // Now check that the book can no longer be found
    Book deletedBook = testRestTemplate.getForObject(location, Book.class);
    assertNull(deletedBook.getId());
}

Example 49 with User

use of com.aidanwhiteley.books.domain.User in project books by aidanwhiteley.

the class BookSecureControllerTest method tryUpdateActionWhenNoCsrfTokenInRequestHeaders.

@Test
void tryUpdateActionWhenNoCsrfTokenInRequestHeaders() {
    User user = BookControllerTestUtils.getTestUser();
    String token = jwtUtils.createTokenForUser(user);
    String xsrfToken = BookControllerTestUtils.getXsrfToken(testRestTemplate);
    // Check all works OK when xsrf token is supplied
    Book testBook = BookRepositoryTest.createTestBook();
    HttpEntity<Book> request = BookControllerTestUtils.getBookHttpEntity(testBook, token, xsrfToken);
    ResponseEntity<Book> response = testRestTemplate.exchange("/secure/api/books", HttpMethod.POST, request, Book.class);
    assertEquals(HttpStatus.CREATED, response.getStatusCode());
    // And now check the action is forbidden when no xsrf token is supplied
    request = BookControllerTestUtils.getBookHttpEntity(testBook, token, null);
    response = testRestTemplate.exchange("/secure/api/books", HttpMethod.POST, request, Book.class);
    assertEquals(HttpStatus.FORBIDDEN, response.getStatusCode());
}

Example 50 with User

use of com.aidanwhiteley.books.domain.User in project books by aidanwhiteley.

the class JwtUtilsTest method testExpiredToken.

@Test
void testExpiredToken() {
    JwtUtils jwt = new JwtUtils();
    jwt.setIssuer("A test issuer");
    jwt.setExpiryInMilliSeconds(-1);
    jwt.setSecretKey("A test secret key");
    User testUser = BookControllerTestUtils.getTestUser();
    String token = jwt.createTokenForUser(testUser);
    Assertions.assertThrows(ExpiredJwtException.class, () -> jwt.getUserFromToken(token));
}