如何使用Spring Security测试控制器

Question

我有下一个Rest控制器

@RestController
@AllArgsConstructor
@Slf4j
@RequestMapping("api/v1/user")
public class UserControllerImpl implements UserController {

    public final UserService userService;
    public final JwtProvider jwtProvider;
    public final JwtFilter jwtFilter;

    @PostMapping(value = "/registration")
    public void registration(@RequestBody UserDto user) {
        log.info("Registration user: Got a registration request for user {}", user.getEmail());
        userService.save(user);
        log.info("Registration user: successful, new user saved in DB");
    }

    @PreAuthorize("hasAnyRole('ADMIN', 'USER', 'SUPER')")
    @PutMapping(value = "/update")
    public void update(
            ServletRequest servletRequest,
            @RequestBody UserDto userDto
    ) {
        log.info("Update user: Got a update request for user {}", userDto);
        userService.update(servletRequest, userDto);
        log.info("Update user: successful update");
    }
}

我将Spring Security用于以下配置：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@AllArgsConstructor
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    public final JwtFilter jwtFilter;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .httpBasic().disable()
                .csrf().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authorizeRequests()
                .antMatchers("/api/v1/user/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

我想为我的控制器编写单元测试。我写了下一个测试，但是它们工作得不好：

@Import(JwtProvider.class)
@WebMvcTest(value = UserControllerImpl.class)
class UserControllerTest {

    @MockBean
    private UserServiceImpl userServiceImpl;

    @Autowired
    private MockMvc mockMvc;
@Test
    void registrationRequestExpectOkAndVerifySaveOnce() throws Exception {
        doNothing().when(userServiceImpl).save(any());
        mockMvc.perform(post("/api/v1/user/registration")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"firstName\": \"mockFirstName\",\"password\": \"mockPassword\"}"))
                .andExpect(status().isOk());
        verify(userServiceImpl, times(1)).save(any());
    }

    @Test
    void update() throws Exception {
        doNothing().when(userServiceImpl).update(any(), any());
        mockMvc.perform(put("/api/v1/user/update")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"firstName\": \"mockFirstName\",\"password\": \"mockPassword\"}"))
                .andExpect(status().isOk());
        verify(userServiceImpl, times(1)).update(any(), any());
    }
}

当我开始测试时，我得到了状态404。如果在安全配置中删除@EnableGlobalmetodSecurity（prePostEnable=true），测试正在工作，但不工作@PreAuthorize。我有一些问题：

• 如果prespenabled=true，为什么我得到404
• 我怎样才能解决这个问题
• 如果我要为具有允许角色和不允许角色的用户编写方法更新测试，我该怎么做

Answer 1

您只需要添加以下Spring Security Test依赖项；

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-test</artifactId>
</dependency>

并使用@RevMockUser注释来测试控制器方法。

@Test
@WithMockUser(roles = {"ADMIN"})
void update() throws Exception {
    doNothing().when(userServiceImpl).update(any(), any());
    mockMvc.perform(put("/api/v1/user/update")
                    .contentType(MediaType.APPLICATION_JSON)
                    .content("{\"firstName\": \"mockFirstName\",\"password\": \"mockPassword\"}"))
            .andExpect(status().isOk());
    verify(userServiceImpl, times(1)).update(any(), any());
}

但是您的SecurityConfig有一个问题。以下行禁用了Spring Security的更新和注册网址。您需要先纠正这个问题。

antMatchers("/api/v1/user/**").permitAll()