Examples with AuthorizationDecision org.springframework.security.authorization.AuthorizationDecision used on opensource projects

Example 1 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class RequestMatcherDelegatingAuthorizationManagerTests method checkWhenMultipleMappingsConfiguredWithConsumerThenDelegatesMatchingManager.

@Test
public void checkWhenMultipleMappingsConfiguredWithConsumerThenDelegatesMatchingManager() {
    RequestMatcherDelegatingAuthorizationManager manager = RequestMatcherDelegatingAuthorizationManager.builder().mappings((m) -> {
        m.put(new MvcRequestMatcher(null, "/grant"), (a, o) -> new AuthorizationDecision(true));
        m.put(AnyRequestMatcher.INSTANCE, AuthorityAuthorizationManager.hasRole("ADMIN"));
        m.put(new MvcRequestMatcher(null, "/deny"), (a, o) -> new AuthorizationDecision(false));
        m.put(new MvcRequestMatcher(null, "/afterAny"), (a, o) -> new AuthorizationDecision(true));
    }).build();
    Supplier<Authentication> authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_USER");
    AuthorizationDecision grant = manager.check(authentication, new MockHttpServletRequest(null, "/grant"));
    assertThat(grant).isNotNull();
    assertThat(grant.isGranted()).isTrue();
    AuthorizationDecision deny = manager.check(authentication, new MockHttpServletRequest(null, "/deny"));
    assertThat(deny).isNotNull();
    assertThat(deny.isGranted()).isFalse();
    AuthorizationDecision afterAny = manager.check(authentication, new MockHttpServletRequest(null, "/afterAny"));
    assertThat(afterAny).isNotNull();
    assertThat(afterAny.isGranted()).isFalse();
    AuthorizationDecision unmapped = manager.check(authentication, new MockHttpServletRequest(null, "/unmapped"));
    assertThat(unmapped).isNotNull();
    assertThat(unmapped.isGranted()).isFalse();
}

Example 2 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class AuthorizationManagerWebInvocationPrivilegeEvaluatorTests method isAllowedWhenAuthorizationManagerAllowsThenAllowedTrue.

@Test
void isAllowedWhenAuthorizationManagerAllowsThenAllowedTrue() {
    given(this.authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(true));
    boolean allowed = this.privilegeEvaluator.isAllowed("/test", TestAuthentication.authenticatedUser());
    assertThat(allowed).isTrue();
    verify(this.authorizationManager).check(any(), any());
}

Example 3 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class Jsr250AuthorizationManagerTests method checkDoSomethingWhenNoJsr250AnnotationsThenNullDecision.

@Test
public void checkDoSomethingWhenNoJsr250AnnotationsThenNullDecision() throws Exception {
    MockMethodInvocation methodInvocation = new MockMethodInvocation(new TestClass(), TestClass.class, "doSomething");
    Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager();
    AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation);
    assertThat(decision).isNull();
}

Example 4 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class Jsr250AuthorizationManagerTests method checkRolesAllowedUserOrAdminWhenRoleAdminThenGrantedDecision.

@Test
public void checkRolesAllowedUserOrAdminWhenRoleAdminThenGrantedDecision() throws Exception {
    MockMethodInvocation methodInvocation = new MockMethodInvocation(new TestClass(), TestClass.class, "rolesAllowedUserOrAdmin");
    Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager();
    AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedAdmin, methodInvocation);
    assertThat(decision).isNotNull();
    assertThat(decision.isGranted()).isTrue();
}

Example 5 with AuthorizationDecision

use of org.springframework.security.authorization.AuthorizationDecision in project spring-security by spring-projects.

the class Jsr250AuthorizationManagerTests method checkRequiresUserWhenClassAnnotationsThenApplies.

@Test
public void checkRequiresUserWhenClassAnnotationsThenApplies() throws Exception {
    Supplier<Authentication> authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_USER");
    MockMethodInvocation methodInvocation = new MockMethodInvocation(new ClassLevelAnnotations(), ClassLevelAnnotations.class, "rolesAllowedUser");
    Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager();
    AuthorizationDecision decision = manager.check(authentication, methodInvocation);
    assertThat(decision.isGranted()).isTrue();
    authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_ADMIN");
    decision = manager.check(authentication, methodInvocation);
    assertThat(decision.isGranted()).isFalse();
}