1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.taglibs.velocity;
17  
18  import junit.framework.TestCase;
19  
20  import org.acegisecurity.GrantedAuthority;
21  import org.acegisecurity.GrantedAuthorityImpl;
22  
23  import org.acegisecurity.context.SecurityContextHolder;
24  import org.acegisecurity.context.SecurityContextImpl;
25  
26  import org.acegisecurity.providers.TestingAuthenticationToken;
27  
28  import javax.servlet.jsp.JspException;
29  
30  
31  /***
32   * DOCUMENT ME!
33   */
34  public class AuthzImplAttributeTest extends TestCase {
35      //~ Instance fields ========================================================
36  
37      private final Authz authz = new AuthzImpl();
38      private TestingAuthenticationToken currentUser;
39  
40      //~ Methods ================================================================
41  
42      protected void setUp() throws Exception {
43          super.setUp();
44  
45          currentUser = new TestingAuthenticationToken("abc", "123",
46                  new GrantedAuthority[] {new GrantedAuthorityImpl(
47                          "ROLE_SUPERVISOR"), new GrantedAuthorityImpl(
48                          "ROLE_RESTRICTED"),});
49  
50          SecurityContextHolder.getContext().setAuthentication(currentUser);
51      }
52  
53      protected void tearDown() throws Exception {
54          SecurityContextHolder.setContext(new SecurityContextImpl());
55      }
56  
57      public void testAssertsIfAllGrantedSecond() {
58          boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_SUPERTELLER");
59          boolean r2 = authz.anyGranted("ROLE_RESTRICTED");
60  
61          //prevents request - principal is missing ROLE_SUPERTELLE
62          assertFalse(r1 && r2);
63      }
64  
65      public void testAssertsIfAnyGrantedLast() {
66          boolean r2 = authz.anyGranted("ROLE_BANKER");
67  
68          // prevents request - principal is missing ROLE_BANKER
69          assertFalse(r2);
70      }
71  
72      public void testAssertsIfNotGrantedFirst() {
73          boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_RESTRICTED");
74          boolean r2 = authz.noneGranted("ROLE_RESTRICTED");
75          boolean r3 = authz.anyGranted("ROLE_SUPERVISOR");
76  
77          //prevents request - principal has ROLE_RESTRICTED
78          assertFalse(r1 && r2 && r3);
79      }
80  
81      public void testAssertsIfNotGrantedIgnoresWhitespaceInAttribute() {
82          //allows request - principal has ROLE_SUPERVISOR
83          assertTrue(authz.anyGranted(
84                  "\tROLE_SUPERVISOR  \t, \r\n\t ROLE_TELLER "));
85      }
86  
87      public void testIfAllGrantedIgnoresWhitespaceInAttribute() {
88          //allows request - principal has ROLE_RESTRICTED and ROLE_SUPERVISOR
89          assertTrue(authz.allGranted(
90                  "\nROLE_SUPERVISOR\t,ROLE_RESTRICTED\t\n\r "));
91      }
92  
93      public void testIfNotGrantedIgnoresWhitespaceInAttribute()
94          throws JspException {
95          //prevents request - principal does not have ROLE_TELLER
96          assertFalse(authz.allGranted(" \t  ROLE_TELLER \r"));
97      }
98  }