Class SecurityMockMvcRequestPostProcessors

java.lang.Object

com.codename1.backend.test.SecurityMockMvcRequestPostProcessors

public final class SecurityMockMvcRequestPostProcessors
extends Object

What a test says about one request's security, for static import:

mvc.perform(post("/notes").with(user("ada").roles("EDITOR")).with(csrf())
        .content("{}"));
mvc.perform(get("/api/orders").with(httpBasic("svc", "secret")));

user(String) and authentication(Authentication) say who the request is from, without asking a user store; csrf() gives a state-changing request the token its chain demands; httpBasic(String, String) sends real credentials for the chain to check. jwt() and apiKey(String) say the request came with a bearer token or an API key that was accepted -- with these claims, these scopes -- without a key to sign one with or a store to look one up in:

mvc.perform(get("/api/orders").with(jwt().subject("svc").scopes("orders:read")));
mvc.perform(get("/api/orders").with(apiKey("billing").scopes("orders:read")));

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	SecurityMockMvcRequestPostProcessors.ApiKeyRequestPostProcessor	apiKey(String), to refine.
static final class	SecurityMockMvcRequestPostProcessors.CsrfRequestPostProcessor	csrf(), to refine.
static final class	SecurityMockMvcRequestPostProcessors.JwtRequestPostProcessor	jwt(), to refine.
static final class	SecurityMockMvcRequestPostProcessors.UserRequestPostProcessor	user(String), to refine.

Method Summary

Modifier and Type	Method	Description
static RequestPostProcessor	anonymous()	The request is from nobody, whoever the test runs as.
static SecurityMockMvcRequestPostProcessors.ApiKeyRequestPostProcessor	apiKey(String owner)	The request carries an API key of this owner that was accepted, with no scopes until told otherwise.
static RequestPostProcessor	authentication(Authentication authentication)	The request is from this authentication.
static SecurityMockMvcRequestPostProcessors.CsrfRequestPostProcessor	csrf()	The request carries a valid CSRF token, in the _csrf parameter.
static RequestPostProcessor	httpBasic(String username, String password)	The request carries these credentials in an Authorization: Basic header.
static SecurityMockMvcRequestPostProcessors.JwtRequestPostProcessor	jwt()	The request carries a bearer token that was accepted: a JWT whose subject is user and whose scope is read, until told otherwise.
static RequestPostProcessor	user(UserDetails user)	The request is from this user.
static SecurityMockMvcRequestPostProcessors.UserRequestPostProcessor	user(String username)	The request is from a user of this name, with the role USER unless told otherwise.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

user

public static SecurityMockMvcRequestPostProcessors.UserRequestPostProcessor user(String username)

The request is from a user of this name, with the role USER unless told otherwise.

user

public static RequestPostProcessor user(UserDetails user)

The request is from this user.

authentication

public static RequestPostProcessor authentication(Authentication authentication)

The request is from this authentication.

anonymous

public static RequestPostProcessor anonymous()

The request is from nobody, whoever the test runs as.

csrf

public static SecurityMockMvcRequestPostProcessors.CsrfRequestPostProcessor csrf()

The request carries a valid CSRF token, in the _csrf parameter.

httpBasic

public static RequestPostProcessor httpBasic(String username,
 String password)

The request carries these credentials in an Authorization: Basic header.

jwt

public static SecurityMockMvcRequestPostProcessors.JwtRequestPostProcessor jwt()

The request carries a bearer token that was accepted: a JWT whose subject is user and whose scope is read, until told otherwise. What the chain's rules and the handler see is the JwtAuthenticationToken a resource server would have made; no token is sent and none is verified.

apiKey

public static SecurityMockMvcRequestPostProcessors.ApiKeyRequestPostProcessor apiKey(String owner)

The request carries an API key of this owner that was accepted, with no scopes until told otherwise. What the chain's rules and the handler see is the ApiKeyAuthenticationToken the key would have made; no key is sent and no repository is asked.