1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.intercept.method;
17  
18  import junit.framework.TestCase;
19  
20  import org.acegisecurity.GrantedAuthority;
21  import org.acegisecurity.GrantedAuthorityImpl;
22  import org.acegisecurity.ITargetObject;
23  
24  import org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor;
25  
26  import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
27  
28  import org.acegisecurity.util.MethodInvocationUtils;
29  
30  import org.aopalliance.intercept.MethodInvocation;
31  
32  import org.springframework.context.ApplicationContext;
33  import org.springframework.context.support.ClassPathXmlApplicationContext;
34  
35  
36  /***
37   * Tests {@link
38   * org.acegisecurity.intercept.method.MethodInvocationPrivilegeEvaluator}.
39   *
40   * @author Ben Alex
41   * @version $Id: MethodInvocationPrivilegeEvaluatorTests.java,v 1.1 2005/11/25 04:18:33 benalex Exp $
42   */
43  public class MethodInvocationPrivilegeEvaluatorTests extends TestCase {
44      //~ Constructors ===========================================================
45  
46      public MethodInvocationPrivilegeEvaluatorTests() {
47          super();
48      }
49  
50      public MethodInvocationPrivilegeEvaluatorTests(String arg0) {
51          super(arg0);
52      }
53  
54      //~ Methods ================================================================
55  
56      public static void main(String[] args) {
57          junit.textui.TestRunner.run(MethodInvocationPrivilegeEvaluatorTests.class);
58      }
59  
60      public void testAllowsAccess() throws Exception {
61          UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
62                  "Password",
63                  new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_LOWER")});
64          MethodInvocation mi = MethodInvocationUtils.createFromClass(ITargetObject.class,
65                  "makeLowerCase", new Class[] {String.class});
66          MethodSecurityInterceptor interceptor = makeSecurityInterceptor();
67  
68          MethodInvocationPrivilegeEvaluator mipe = new MethodInvocationPrivilegeEvaluator();
69          mipe.setSecurityInterceptor(interceptor);
70          mipe.afterPropertiesSet();
71  
72          assertTrue(mipe.isAllowed(mi, token));
73      }
74  
75      public void testDeclinesAccess() throws Exception {
76          UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
77                  "Password",
78                  new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_NOT_HELD")});
79          MethodInvocation mi = MethodInvocationUtils.createFromClass(ITargetObject.class,
80                  "makeLowerCase", new Class[] {String.class});
81          MethodSecurityInterceptor interceptor = makeSecurityInterceptor();
82  
83          MethodInvocationPrivilegeEvaluator mipe = new MethodInvocationPrivilegeEvaluator();
84          mipe.setSecurityInterceptor(interceptor);
85          mipe.afterPropertiesSet();
86  
87          assertFalse(mipe.isAllowed(mi, token));
88      }
89  
90      private MethodSecurityInterceptor makeSecurityInterceptor() {
91          ApplicationContext context = new ClassPathXmlApplicationContext(
92                  "org/acegisecurity/intercept/method/aopalliance/applicationContext.xml");
93  
94          return (MethodSecurityInterceptor) context.getBean(
95              "securityInterceptor");
96      }
97  }