| 
					
				 | 
			
			
				@@ -1,5 +1,5 @@ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 /* 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- * Copyright 2002-2013 the original author or authors. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ * Copyright 2002-2018 the original author or authors. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * Licensed under the Apache License, Version 2.0 (the "License"); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * you may not use this file except in compliance with the License. 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -13,24 +13,27 @@ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * See the License for the specific language governing permissions and 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * limitations under the License. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-package org.springframework.security.config.annotation.method.configuration 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+package org.springframework.security.config.annotation.method.configuration; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.junit.Before; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.junit.Rule; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.junit.Test; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 import org.springframework.beans.factory.annotation.Autowired; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.context.annotation.Bean 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.context.annotation.Configuration 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.access.AccessDeniedException 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.springframework.context.annotation.Bean; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.springframework.security.access.AccessDeniedException; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 import org.springframework.security.access.PermissionEvaluator; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.authentication.AuthenticationManager 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.authentication.TestingAuthenticationToken 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.config.annotation.BaseSpringSpec 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.springframework.security.authentication.TestingAuthenticationToken; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.springframework.security.config.test.SpringTestRule; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 import org.springframework.security.core.Authentication; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-import org.springframework.security.core.context.SecurityContextHolder 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import org.springframework.security.core.context.SecurityContextHolder; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import java.io.Serializable; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import static org.assertj.core.api.Assertions.assertThat; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+import static org.assertj.core.api.Assertions.assertThatThrownBy; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 /** 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * Demonstrate the samples 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -38,31 +41,35 @@ import org.springframework.security.core.context.SecurityContextHolder 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * @author Rob Winch 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  * 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-public class SampleEnableGlobalMethodSecurityTests extends BaseSpringSpec { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-	def setup() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+public class SampleEnableGlobalMethodSecurityTests { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	@Rule 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	public final SpringTestRule spring = new SpringTestRule(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	@Autowired 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	private MethodSecurityService methodSecurityService; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	@Before 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	public void setup() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		SecurityContextHolder.getContext().setAuthentication( 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-						new TestingAuthenticationToken("user", "password","ROLE_USER")) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+									new TestingAuthenticationToken("user", "password", "ROLE_USER")); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-	def preAuthorize() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		when: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		loadConfig(SampleWebSecurityConfig) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		MethodSecurityService service = context.getBean(MethodSecurityService) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		then: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		service.secured() == null 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		service.jsr250() == null 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		when: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		service.preAuthorize() 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		then: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		thrown(AccessDeniedException) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	@Test 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	public void preAuthorize() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		this.spring.register(SampleWebSecurityConfig.class).autowire(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		assertThat(this.methodSecurityService.secured()).isNull(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		assertThat(this.methodSecurityService.jsr250()).isNull(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		assertThatThrownBy(() -> this.methodSecurityService.preAuthorize()) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+			.isInstanceOf(AccessDeniedException.class); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	@EnableGlobalMethodSecurity(prePostEnabled=true) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-	public static class SampleWebSecurityConfig { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	static class SampleWebSecurityConfig { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		@Bean 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		public MethodSecurityService methodSecurityService() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-			return new MethodSecurityServiceImpl() 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+			return new MethodSecurityServiceImpl(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		@Autowired 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -74,24 +81,23 @@ public class SampleEnableGlobalMethodSecurityTests extends BaseSpringSpec { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-	def 'custom permission handler'() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		when: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		loadConfig(CustomPermissionEvaluatorWebSecurityConfig) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		MethodSecurityService service = context.getBean(MethodSecurityService) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		then: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		service.hasPermission("allowed") == null 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		when: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		service.hasPermission("denied") == null 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		then: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-		thrown(AccessDeniedException) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	@Test 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+	public void customPermissionHandler() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		this.spring.register(CustomPermissionEvaluatorWebSecurityConfig.class).autowire(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		assertThat(this.methodSecurityService.hasPermission("allowed")).isNull(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+		assertThatThrownBy(() -> this.methodSecurityService.hasPermission("denied")) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+			.isInstanceOf(AccessDeniedException.class); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	@EnableGlobalMethodSecurity(prePostEnabled=true) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 	public static class CustomPermissionEvaluatorWebSecurityConfig extends GlobalMethodSecurityConfiguration { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		@Bean 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		public MethodSecurityService methodSecurityService() { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-			return new MethodSecurityServiceImpl() 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+			return new MethodSecurityServiceImpl(); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 		@Override 
			 |