1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.taglibs.authz;
17  
18  import junit.framework.TestCase;
19  
20  import org.acegisecurity.GrantedAuthority;
21  import org.acegisecurity.GrantedAuthorityImpl;
22  import org.acegisecurity.context.SecurityContextHolder;
23  import org.acegisecurity.context.SecurityContextImpl;
24  import org.acegisecurity.providers.TestingAuthenticationToken;
25  
26  import javax.servlet.jsp.JspException;
27  import javax.servlet.jsp.tagext.Tag;
28  
29  
30  /***
31   * DOCUMENT ME!
32   *
33   * @author Francois Beausoleil
34   * @version $Id: AuthorizeTagTests.java,v 1.11 2005/11/17 00:55:51 benalex Exp $
35   */
36  public class AuthorizeTagTests extends TestCase {
37      //~ Instance fields ========================================================
38  
39      private final AuthorizeTag authorizeTag = new AuthorizeTag();
40      private TestingAuthenticationToken currentUser;
41  
42      //~ Methods ================================================================
43  
44      public void testAlwaysReturnsUnauthorizedIfNoUserFound()
45          throws JspException {
46          SecurityContextHolder.getContext().setAuthentication(null);
47  
48          authorizeTag.setIfAllGranted("ROLE_TELLER");
49          assertEquals("prevents request - no principal in Context",
50              Tag.SKIP_BODY, authorizeTag.doStartTag());
51      }
52  
53      public void testDefaultsToNotOutputtingBodyWhenNoRequiredAuthorities()
54          throws JspException {
55          assertEquals("", authorizeTag.getIfAllGranted());
56          assertEquals("", authorizeTag.getIfAnyGranted());
57          assertEquals("", authorizeTag.getIfNotGranted());
58  
59          assertEquals("prevents body output - no authorities granted",
60              Tag.SKIP_BODY, authorizeTag.doStartTag());
61      }
62  
63      public void testOutputsBodyIfOneRolePresent() throws JspException {
64          authorizeTag.setIfAnyGranted("ROLE_TELLER");
65          assertEquals("authorized - ROLE_TELLER in both sets",
66              Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
67      }
68  
69      public void testOutputsBodyWhenAllGranted() throws JspException {
70          authorizeTag.setIfAllGranted("ROLE_SUPERVISOR,ROLE_TELLER");
71          assertEquals("allows request - all required roles granted on principal",
72              Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
73      }
74  
75      public void testOutputsBodyWhenNotGrantedSatisfied()
76          throws JspException {
77          authorizeTag.setIfNotGranted("ROLE_BANKER");
78          assertEquals("allows request - principal doesn't have ROLE_BANKER",
79              Tag.EVAL_BODY_INCLUDE, authorizeTag.doStartTag());
80      }
81  
82      public void testPreventsBodyOutputIfNoSecurityContext()
83          throws JspException {
84          SecurityContextHolder.getContext().setAuthentication(null);
85          authorizeTag.setIfAnyGranted("ROLE_BANKER");
86  
87          assertEquals("prevents output - no context defined", Tag.SKIP_BODY,
88              authorizeTag.doStartTag());
89      }
90  
91      public void testSkipsBodyIfNoAnyRolePresent() throws JspException {
92          authorizeTag.setIfAnyGranted("ROLE_BANKER");
93          assertEquals("unauthorized - ROLE_BANKER not in granted authorities",
94              Tag.SKIP_BODY, authorizeTag.doStartTag());
95      }
96  
97      public void testSkipsBodyWhenMissingAnAllGranted()
98          throws JspException {
99          authorizeTag.setIfAllGranted("ROLE_SUPERVISOR,ROLE_TELLER,ROLE_BANKER");
100         assertEquals("prevents request - missing ROLE_BANKER on principal",
101             Tag.SKIP_BODY, authorizeTag.doStartTag());
102     }
103 
104     public void testSkipsBodyWhenNotGrantedUnsatisfied()
105         throws JspException {
106         authorizeTag.setIfNotGranted("ROLE_TELLER");
107         assertEquals("prevents request - principal has ROLE_TELLER",
108             Tag.SKIP_BODY, authorizeTag.doStartTag());
109     }
110 
111     protected void setUp() throws Exception {
112         super.setUp();
113 
114         currentUser = new TestingAuthenticationToken("abc", "123",
115                 new GrantedAuthority[] {new GrantedAuthorityImpl(
116                         "ROLE_SUPERVISOR"), new GrantedAuthorityImpl(
117                         "ROLE_TELLER"),});
118 
119         SecurityContextHolder.getContext().setAuthentication(currentUser);
120     }
121 
122     protected void tearDown() throws Exception {
123         SecurityContextHolder.setContext(new SecurityContextImpl());
124     }
125 }