/*
* Copyright (c) 2002-2012 Alibaba Group Holding Limited.
* All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.citrus.turbine.auth;
import static com.alibaba.citrus.turbine.auth.impl.PageAuthorizationServiceImpl.PageAuthorizationResult.*;
import static com.alibaba.citrus.util.StringUtil.*;
import static org.junit.Assert.*;
import com.alibaba.citrus.turbine.auth.impl.AuthGrant;
import com.alibaba.citrus.turbine.auth.impl.AuthMatch;
import com.alibaba.citrus.turbine.auth.impl.PageAuthorizationServiceImpl;
import com.alibaba.citrus.turbine.auth.impl.PageAuthorizationServiceImpl.PageAuthorizationResult;
import org.junit.Before;
import org.junit.Test;
public class PageAuthorizationServiceTests {
protected static final String[] ADMIN_ROLE = new String[] { "admin" };
protected PageAuthorizationServiceImpl auth;
@Before
public void init() throws Exception {
auth = new PageAuthorizationServiceImpl();
auth.setMatches(new AuthMatch[] {
// matches
match("/user", grant(null, "*", null, "*")), //
match("/user", grant("baobao", null, "read,write", null)), //
match("/admin", grant("baobao", null, "read,write", null)), //
match("/user/profile", grant(null, "admin", "*", null)), //
match("/user/public", //
// grants
grant(null, "*", "action", null), //
grant("*", null, "read", null), //
grant("anonymous", null, null, "write"), // 这句将被下面一行覆盖
grant("anonymous", null, "write", null)), //
match("/**/*.vm", grant(null, "*", "*", null)) //
});
}
private AuthMatch match(String target, AuthGrant... grants) {
return new AuthMatch(target, grants);
}
private AuthGrant grant(String user, String role, String allow, String deny) {
AuthGrant grant = new AuthGrant();
grant.setUsers(new String[] { user });
grant.setRoles(new String[] { role });
grant.setAllow(split(allow, ", "));
grant.setDeny(split(deny, ", "));
return grant;
}
@Test
public void noTarget() {
assertAuth(TARGET_NOT_MATCH, null, null, ADMIN_ROLE, (String[]) null);
}
@Test
public void noAction() {
// allow=*, actions=null
assertAuth(ALLOWED, "/test.vm", null, ADMIN_ROLE, (String[]) null);
// deny=*, actions=null
assertAuth(DENIED, "/user", null, ADMIN_ROLE, (String[]) null);
}
@Test
public void multiActions() {
// allow=read,write, actions=read,write
assertAuth(ALLOWED, "/user", "baobao", null, "read", "write");
// allow=read,write, action=read,write,other
assertAuth(GRANT_NOT_MATCH, "/user", "baobao", null, "read", "write", "other");
}
/** target不匹配。 */
@Test
public void targetNotMatch() {
assertAuth(TARGET_NOT_MATCH, "/", "baobao", null, (String[]) null);
assertAuth(TARGET_NOT_MATCH, "/notMatch", "baobao", null, (String[]) null);
}
/** 最长的匹配优先授权，相同的匹配以后面的为准。 */
@Test
public void priority() {
// allow=read,write, actions=read
assertAuth(ALLOWED, "/user", "baobao", null, "read");
// allow=read,write, actions=write
assertAuth(ALLOWED, "/user", "baobao", null, "write");
// deny=*, actions=write
assertAuth(DENIED, "/user", null, ADMIN_ROLE, "write");
}
/** target匹配，但用户未匹配。 */
@Test
public void userNotMatch() {
assertAuth(GRANT_NOT_MATCH, "/user", "other", null, "read");
assertAuth(GRANT_NOT_MATCH, "/user", "other", null, "write");
}
/** target匹配、用户匹配，但action不匹配。 */
@Test
public void actionNotMatch() {
// allow=read,write, action=otherAction
assertAuth(GRANT_NOT_MATCH, "/user", "baobao", null, "otherAction");
}
/** 匹配role。 */
@Test
public void role() {
// allow=*, action=read
assertAuth(ALLOWED, "/user/profile", "other", ADMIN_ROLE, "read");
// allow=*, action=write
assertAuth(ALLOWED, "/user/profile/abc", "other", ADMIN_ROLE, "write");
// role=admin不匹配null
assertAuth(GRANT_NOT_MATCH, "/user/profile/abc", "other", null, "write");
}
/** 相对路径。 */
@Test
public void relativeTarget() {
// allow=*
assertAuth(ALLOWED, "/user/hello.vm", "other", ADMIN_ROLE, "read");
// role=admin不匹配null
assertAuth(GRANT_NOT_MATCH, "/user/world.vm", "other", null, "write");
}
/** 匿名访问。 */
@Test
public void anonymous() {
// role=*不包括空role
assertAuth(GRANT_NOT_MATCH, "/user/public/hello", null, null, "action");
// user=* 不包括anonymous
assertAuth(GRANT_NOT_MATCH, "/user/public/hello", null, null, "read");
// user=anonymous
assertAuth(ALLOWED, "/user/public/hello", null, null, "write");
}
private void assertAuth(PageAuthorizationResult result, String target, String userName, String[] roleNames,
String... actions) {
assertSame(result, auth.authorize(target, userName, roleNames, actions));
if (result == ALLOWED) {
assertTrue(auth.isAllow(target, userName, roleNames, actions));
} else {
assertFalse(auth.isAllow(target, userName, roleNames, actions));
}
}
}