|  | @@ -1,5 +1,5 @@
 | 
	
		
			
				|  |  |  /*
 | 
	
		
			
				|  |  | - * Copyright 2002-2013 the original author or authors.
 | 
	
		
			
				|  |  | + * Copyright 2002-2018 the original author or authors.
 | 
	
		
			
				|  |  |   *
 | 
	
		
			
				|  |  |   * Licensed under the Apache License, Version 2.0 (the "License");
 | 
	
		
			
				|  |  |   * you may not use this file except in compliance with the License.
 | 
	
	
		
			
				|  | @@ -13,24 +13,27 @@
 | 
	
		
			
				|  |  |   * See the License for the specific language governing permissions and
 | 
	
		
			
				|  |  |   * limitations under the License.
 | 
	
		
			
				|  |  |   */
 | 
	
		
			
				|  |  | -package org.springframework.security.config.annotation.method.configuration
 | 
	
		
			
				|  |  | +package org.springframework.security.config.annotation.method.configuration;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | +import org.junit.Before;
 | 
	
		
			
				|  |  | +import org.junit.Rule;
 | 
	
		
			
				|  |  | +import org.junit.Test;
 | 
	
		
			
				|  |  |  import org.springframework.beans.factory.annotation.Autowired;
 | 
	
		
			
				|  |  | -import org.springframework.context.annotation.Bean
 | 
	
		
			
				|  |  | -import org.springframework.context.annotation.Configuration
 | 
	
		
			
				|  |  | -import org.springframework.security.access.AccessDeniedException
 | 
	
		
			
				|  |  | +import org.springframework.context.annotation.Bean;
 | 
	
		
			
				|  |  | +import org.springframework.security.access.AccessDeniedException;
 | 
	
		
			
				|  |  |  import org.springframework.security.access.PermissionEvaluator;
 | 
	
		
			
				|  |  |  import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 | 
	
		
			
				|  |  | -import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler
 | 
	
		
			
				|  |  | -import org.springframework.security.authentication.AuthenticationManager
 | 
	
		
			
				|  |  | -import org.springframework.security.authentication.TestingAuthenticationToken
 | 
	
		
			
				|  |  | -import org.springframework.security.config.annotation.BaseSpringSpec
 | 
	
		
			
				|  |  | -import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder
 | 
	
		
			
				|  |  | +import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 | 
	
		
			
				|  |  | +import org.springframework.security.authentication.TestingAuthenticationToken;
 | 
	
		
			
				|  |  |  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 | 
	
		
			
				|  |  | -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 | 
	
		
			
				|  |  | -import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
 | 
	
		
			
				|  |  | +import org.springframework.security.config.test.SpringTestRule;
 | 
	
		
			
				|  |  |  import org.springframework.security.core.Authentication;
 | 
	
		
			
				|  |  | -import org.springframework.security.core.context.SecurityContextHolder
 | 
	
		
			
				|  |  | +import org.springframework.security.core.context.SecurityContextHolder;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +import java.io.Serializable;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +import static org.assertj.core.api.Assertions.assertThat;
 | 
	
		
			
				|  |  | +import static org.assertj.core.api.Assertions.assertThatThrownBy;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  /**
 | 
	
		
			
				|  |  |   * Demonstrate the samples
 | 
	
	
		
			
				|  | @@ -38,31 +41,35 @@ import org.springframework.security.core.context.SecurityContextHolder
 | 
	
		
			
				|  |  |   * @author Rob Winch
 | 
	
		
			
				|  |  |   *
 | 
	
		
			
				|  |  |   */
 | 
	
		
			
				|  |  | -public class SampleEnableGlobalMethodSecurityTests extends BaseSpringSpec {
 | 
	
		
			
				|  |  | -	def setup() {
 | 
	
		
			
				|  |  | +public class SampleEnableGlobalMethodSecurityTests {
 | 
	
		
			
				|  |  | +	@Rule
 | 
	
		
			
				|  |  | +	public final SpringTestRule spring = new SpringTestRule();
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +	@Autowired
 | 
	
		
			
				|  |  | +	private MethodSecurityService methodSecurityService;
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +	@Before
 | 
	
		
			
				|  |  | +	public void setup() {
 | 
	
		
			
				|  |  |  		SecurityContextHolder.getContext().setAuthentication(
 | 
	
		
			
				|  |  | -						new TestingAuthenticationToken("user", "password","ROLE_USER"))
 | 
	
		
			
				|  |  | +									new TestingAuthenticationToken("user", "password", "ROLE_USER"));
 | 
	
		
			
				|  |  |  	}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	def preAuthorize() {
 | 
	
		
			
				|  |  | -		when:
 | 
	
		
			
				|  |  | -		loadConfig(SampleWebSecurityConfig)
 | 
	
		
			
				|  |  | -		MethodSecurityService service = context.getBean(MethodSecurityService)
 | 
	
		
			
				|  |  | -		then:
 | 
	
		
			
				|  |  | -		service.secured() == null
 | 
	
		
			
				|  |  | -		service.jsr250() == null
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -		when:
 | 
	
		
			
				|  |  | -		service.preAuthorize()
 | 
	
		
			
				|  |  | -		then:
 | 
	
		
			
				|  |  | -		thrown(AccessDeniedException)
 | 
	
		
			
				|  |  | +	@Test
 | 
	
		
			
				|  |  | +	public void preAuthorize() {
 | 
	
		
			
				|  |  | +		this.spring.register(SampleWebSecurityConfig.class).autowire();
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +		assertThat(this.methodSecurityService.secured()).isNull();
 | 
	
		
			
				|  |  | +		assertThat(this.methodSecurityService.jsr250()).isNull();
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +		assertThatThrownBy(() -> this.methodSecurityService.preAuthorize())
 | 
	
		
			
				|  |  | +			.isInstanceOf(AccessDeniedException.class);
 | 
	
		
			
				|  |  |  	}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  	@EnableGlobalMethodSecurity(prePostEnabled=true)
 | 
	
		
			
				|  |  | -	public static class SampleWebSecurityConfig {
 | 
	
		
			
				|  |  | +	static class SampleWebSecurityConfig {
 | 
	
		
			
				|  |  |  		@Bean
 | 
	
		
			
				|  |  |  		public MethodSecurityService methodSecurityService() {
 | 
	
		
			
				|  |  | -			return new MethodSecurityServiceImpl()
 | 
	
		
			
				|  |  | +			return new MethodSecurityServiceImpl();
 | 
	
		
			
				|  |  |  		}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  		@Autowired
 | 
	
	
		
			
				|  | @@ -74,24 +81,23 @@ public class SampleEnableGlobalMethodSecurityTests extends BaseSpringSpec {
 | 
	
		
			
				|  |  |  		}
 | 
	
		
			
				|  |  |  	}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -	def 'custom permission handler'() {
 | 
	
		
			
				|  |  | -		when:
 | 
	
		
			
				|  |  | -		loadConfig(CustomPermissionEvaluatorWebSecurityConfig)
 | 
	
		
			
				|  |  | -		MethodSecurityService service = context.getBean(MethodSecurityService)
 | 
	
		
			
				|  |  | -		then:
 | 
	
		
			
				|  |  | -		service.hasPermission("allowed") == null
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -		when:
 | 
	
		
			
				|  |  | -		service.hasPermission("denied") == null
 | 
	
		
			
				|  |  | -		then:
 | 
	
		
			
				|  |  | -		thrown(AccessDeniedException)
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +	@Test
 | 
	
		
			
				|  |  | +	public void customPermissionHandler() {
 | 
	
		
			
				|  |  | +		this.spring.register(CustomPermissionEvaluatorWebSecurityConfig.class).autowire();
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +		assertThat(this.methodSecurityService.hasPermission("allowed")).isNull();
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +		assertThatThrownBy(() -> this.methodSecurityService.hasPermission("denied"))
 | 
	
		
			
				|  |  | +			.isInstanceOf(AccessDeniedException.class);
 | 
	
		
			
				|  |  |  	}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |  	@EnableGlobalMethodSecurity(prePostEnabled=true)
 | 
	
		
			
				|  |  |  	public static class CustomPermissionEvaluatorWebSecurityConfig extends GlobalMethodSecurityConfiguration {
 | 
	
		
			
				|  |  |  		@Bean
 | 
	
		
			
				|  |  |  		public MethodSecurityService methodSecurityService() {
 | 
	
		
			
				|  |  | -			return new MethodSecurityServiceImpl()
 | 
	
		
			
				|  |  | +			return new MethodSecurityServiceImpl();
 | 
	
		
			
				|  |  |  		}
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  		@Override
 |