1   /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.taglibs.velocity;
17  
18  import junit.framework.TestCase;
19  
20  import org.acegisecurity.GrantedAuthority;
21  import org.acegisecurity.GrantedAuthorityImpl;
22  
23  import org.acegisecurity.context.SecurityContextHolder;
24  
25  import org.acegisecurity.providers.TestingAuthenticationToken;
26  
27  import javax.servlet.jsp.JspException;
28  
29  
30  /**
31   * DOCUMENT ME!
32   */
33  public class AuthzImplAttributeTest extends TestCase {
34      //~ Instance fields ================================================================================================
35  
36      private final Authz authz = new AuthzImpl();
37      private TestingAuthenticationToken currentUser;
38  
39      //~ Methods ========================================================================================================
40  
41      protected void setUp() throws Exception {
42          super.setUp();
43  
44          currentUser = new TestingAuthenticationToken("abc", "123",
45                  new GrantedAuthority[] {
46                      new GrantedAuthorityImpl("ROLE_SUPERVISOR"), new GrantedAuthorityImpl("ROLE_RESTRICTED"),
47                  });
48  
49          SecurityContextHolder.getContext().setAuthentication(currentUser);
50      }
51  
52      protected void tearDown() throws Exception {
53          SecurityContextHolder.clearContext();
54      }
55  
56      public void testAssertsIfAllGrantedSecond() {
57          boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_SUPERTELLER");
58          boolean r2 = authz.anyGranted("ROLE_RESTRICTED");
59  
60          //prevents request - principal is missing ROLE_SUPERTELLE
61          assertFalse(r1 && r2);
62      }
63  
64      public void testAssertsIfAnyGrantedLast() {
65          boolean r2 = authz.anyGranted("ROLE_BANKER");
66  
67          // prevents request - principal is missing ROLE_BANKER
68          assertFalse(r2);
69      }
70  
71      public void testAssertsIfNotGrantedFirst() {
72          boolean r1 = authz.allGranted("ROLE_SUPERVISOR,ROLE_RESTRICTED");
73          boolean r2 = authz.noneGranted("ROLE_RESTRICTED");
74          boolean r3 = authz.anyGranted("ROLE_SUPERVISOR");
75  
76          //prevents request - principal has ROLE_RESTRICTED
77          assertFalse(r1 && r2 && r3);
78      }
79  
80      public void testAssertsIfNotGrantedIgnoresWhitespaceInAttribute() {
81          //allows request - principal has ROLE_SUPERVISOR
82          assertTrue(authz.anyGranted("\tROLE_SUPERVISOR  \t, \r\n\t ROLE_TELLER "));
83      }
84  
85      public void testIfAllGrantedIgnoresWhitespaceInAttribute() {
86          //allows request - principal has ROLE_RESTRICTED and ROLE_SUPERVISOR
87          assertTrue(authz.allGranted("\nROLE_SUPERVISOR\t,ROLE_RESTRICTED\t\n\r "));
88      }
89  
90      public void testIfNotGrantedIgnoresWhitespaceInAttribute()
91          throws JspException {
92          //prevents request - principal does not have ROLE_TELLER
93          assertFalse(authz.allGranted(" \t  ROLE_TELLER \r"));
94      }
95  }