src/test/java/com/packagemanagement/presentation/controller/SecurityRbacTest.java - master - Chebarik/PackageManagement

src/test/java/com/packagemanagement/presentation/controller/SecurityRbacTest.java
209 строк8 KB
Николай Мехоношин
Implemented tests for non functional requirements
14 апр 2026, 18:50
14 апр 2026, 18:509179c8b
package com.packagemanagement.presentation.controller;

import com.packagemanagement.application.dto.PackageDto;
import com.packagemanagement.application.service.PackageApplicationService;
import com.packagemanagement.infrastructure.ratelimit.RateLimitConfig;
import com.packagemanagement.infrastructure.ratelimit.RateLimitInterceptor;
import com.packagemanagement.infrastructure.security.JwtAuthenticationFilter;
import com.packagemanagement.infrastructure.security.JwtTokenProvider;
import com.packagemanagement.infrastructure.security.SecurityConfig;
import com.packagemanagement.presentation.exception.GlobalExceptionHandler;
import com.packagemanagement.application.port.RateLimitService;
import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Nested;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.mockito.junit.jupiter.MockitoExtension;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
import org.springframework.boot.test.mock.mockito.MockBean;
import org.springframework.context.annotation.Import;
import org.springframework.http.MediaType;
import org.springframework.security.test.context.support.WithMockUser;
import org.springframework.test.context.ActiveProfiles;
import org.springframework.test.web.servlet.MockMvc;

import java.util.List;

import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.ArgumentMatchers.*;
import static org.mockito.Mockito.when;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@WebMvcTest(controllers = PackageController.class)
@Import({SecurityConfig.class, JwtAuthenticationFilter.class, GlobalExceptionHandler.class})
@ActiveProfiles("test")
@DisplayName("Security RBAC")
class SecurityRbacTest {

    @Autowired
    private MockMvc mockMvc;

    @MockBean
    private PackageApplicationService packageService;

    @MockBean
    private JwtTokenProvider jwtTokenProvider;

    @MockBean
    private RateLimitService rateLimitService;

    @MockBean
    private RateLimitInterceptor rateLimitInterceptor;

    @MockBean
    private RateLimitConfig rateLimitConfig;

    private static final String PACKAGE_JSON = """
            {"name":"test-pkg","description":"test","format":"MAVEN"}""";

    @Nested
    @DisplayName("Unauthenticated requests")
    class Unauthenticated {

        @Test
        @DisplayName("GET /api/packages should require authentication")
        void getPackagesShouldRequireAuth() throws Exception {
            int code = mockMvc.perform(get("/api/packages"))
                    .andReturn().getResponse().getStatus();
            assertTrue(code == 401 || code == 403);
        }

        @Test
        @DisplayName("POST /api/packages should require authentication")
        void createPackageShouldRequireAuth() throws Exception {
            int code = mockMvc.perform(post("/api/packages")
                            .with(csrf())
                            .contentType(MediaType.APPLICATION_JSON)
                            .content(PACKAGE_JSON))
                    .andReturn().getResponse().getStatus();
            assertTrue(code == 401 || code == 403);
        }

        @Test
        @DisplayName("DELETE /api/packages/{id} should require authentication")
        void deletePackageShouldRequireAuth() throws Exception {
            int code = mockMvc.perform(delete("/api/packages/some-id").with(csrf()))
                    .andReturn().getResponse().getStatus();
            assertTrue(code == 401 || code == 403);
        }
    }

    @Nested
    @DisplayName("READER role")
    class ReaderRole {

        @Test
        @WithMockUser(roles = "READER")
        @DisplayName("should be allowed to GET /api/packages")
        void shouldAllowGetPackages() throws Exception {
            when(packageService.getAllPackages(anyInt(), anyInt())).thenReturn(List.of());
            when(packageService.getPackageCount()).thenReturn(0L);

            mockMvc.perform(get("/api/packages"))
                    .andExpect(status().isOk());
        }

        @Test
        @WithMockUser(roles = "READER")
        @DisplayName("should be forbidden from POST /api/packages")
        void shouldForbidCreatePackage() throws Exception {
            mockMvc.perform(post("/api/packages")
                            .with(csrf())
                            .contentType(MediaType.APPLICATION_JSON)
                            .content(PACKAGE_JSON))
                    .andExpect(status().isForbidden());
        }

        @Test
        @WithMockUser(roles = "READER")
        @DisplayName("should be forbidden from DELETE /api/packages/{id}")
        void shouldForbidDeletePackage() throws Exception {
            mockMvc.perform(delete("/api/packages/some-id").with(csrf()))
                    .andExpect(status().isForbidden());
        }
    }

    @Nested
    @DisplayName("PUBLISHER role")
    class PublisherRole {

        @Test
        @WithMockUser(roles = "PUBLISHER")
        @DisplayName("should be allowed to GET /api/packages")
        void shouldAllowGetPackages() throws Exception {
            when(packageService.getAllPackages(anyInt(), anyInt())).thenReturn(List.of());
            when(packageService.getPackageCount()).thenReturn(0L);

            mockMvc.perform(get("/api/packages"))
                    .andExpect(status().isOk());
        }

        @Test
        @WithMockUser(roles = "PUBLISHER")
        @DisplayName("should be allowed to POST /api/packages")
        void shouldAllowCreatePackage() throws Exception {
            PackageDto dto = new PackageDto("id", "test-pkg", "test", "MAVEN",
                    List.of(), null, "2024-01-01T00:00:00Z", "2024-01-01T00:00:00Z");
            when(packageService.createPackage(anyString(), anyString(), any())).thenReturn(dto);

            int code = mockMvc.perform(post("/api/packages")
                            .with(csrf())
                            .contentType(MediaType.APPLICATION_JSON)
                            .content(PACKAGE_JSON))
                    .andReturn().getResponse().getStatus();
            assertTrue(code == 200 || code == 201, "Expected 200 or 201, got " + code);
        }

        @Test
        @WithMockUser(roles = "PUBLISHER")
        @DisplayName("should be forbidden from DELETE /api/packages/{id}")
        void shouldForbidDeletePackage() throws Exception {
            mockMvc.perform(delete("/api/packages/some-id").with(csrf()))
                    .andExpect(status().isForbidden());
        }
    }

    @Nested
    @DisplayName("ADMIN role")
    class AdminRole {

        @Test
        @WithMockUser(roles = "ADMIN")
        @DisplayName("should be allowed to GET /api/packages")
        void shouldAllowGetPackages() throws Exception {
            when(packageService.getAllPackages(anyInt(), anyInt())).thenReturn(List.of());
            when(packageService.getPackageCount()).thenReturn(0L);

            mockMvc.perform(get("/api/packages"))
                    .andExpect(status().isOk());
        }

        @Test
        @WithMockUser(roles = "ADMIN")
        @DisplayName("should be allowed to POST /api/packages")
        void shouldAllowCreatePackage() throws Exception {
            PackageDto dto = new PackageDto("id", "test-pkg", "test", "MAVEN",
                    List.of(), null, "2024-01-01T00:00:00Z", "2024-01-01T00:00:00Z");
            when(packageService.createPackage(anyString(), anyString(), any())).thenReturn(dto);

            int code = mockMvc.perform(post("/api/packages")
                            .with(csrf())
                            .contentType(MediaType.APPLICATION_JSON)
                            .content(PACKAGE_JSON))
                    .andReturn().getResponse().getStatus();
            assertTrue(code == 200 || code == 201, "Expected 200 or 201, got " + code);
        }

        @Test
        @WithMockUser(roles = "ADMIN")
        @DisplayName("should be allowed to DELETE /api/packages/{id}")
        void shouldAllowDeletePackage() throws Exception {
            mockMvc.perform(delete("/api/packages/some-id").with(csrf()))
                    .andExpect(status().isOk());
        }
    }
}