java - Spring Security 单元测试@PreFilter 和@PostFilter 的正确方法

Question

什么是单元测试 Spring Security 注释@PostFilter和@PreFilter. 我在我的 DAO 类中使用这些注释，如下所示：

TodoDao.java

@Component
@Transactional
public class TodoDao implements ITodoDao {

    @Autowired
    private SessionFactory sessionFactory;

    @Autowired
    private AuthenticationFacade authenticationFacade;

    @Override
    @PostFilter("filterObject.userByUserId == @authenticationFacade.getAuthenticatedFacade()")
    public List<Todo> getTodosByUserId(int userId) {
        return sessionFactory.getCurrentSession().createQuery("from Todo where userId = ?").setParameter(0, userId).list();
    }
}

这是我的 AuthenticationFacade 类：

AuthenticationFacade.java

@Component
public class AuthenticationFacade implements IAuthenticationFacade {

    @Autowired
    private IUserDao IUserDao;

    public Authentication getAuthentication() {
        return SecurityContextHolder.getContext().getAuthentication();
    }

    public User getAuthenticatedFacade() {
        Authentication authentication = getAuthentication();
        User user = IUserDao.findByUsername(authentication.getName());
        return user;
    }
}

这是我的 DAO 单元测试类，我使用 H2 内存数据库：

TodoDaoTest.java

@RunWith(SpringJUnit4ClassRunner.class)
@ContextConfiguration (value = "classpath:/conf/applicationContext-test.xml")
@Transactional
public class TodoDaoTest {

    @Autowired
    SessionFactory testSessionFactory;

    @InjectMocks
    TodoDao todoDao;

    private boolean mockInitialized = false;

    @Before
    public void setUp(){
        if(!mockInitialized) {
            MockitoAnnotations.initMocks(this);
            mockInitialized = true;
        }
        todoDao.setSessionFactory(testSessionFactory);
    }

    @Test
    @WithMockUser (username = "user", roles = "ROLE_USER")
    //I want to test here if @WithMokUser is different from userId 
    //Than the list sould return empty always.
    public void getTodosByUserIdShouldReturnEmptyListIfCurrentUserIsDifferentFromSearchedUser(){
        int userId = 3;
        assertTrue(todoDao.getTodosByUserId(userId).isEmpty());
    }
}

标签： javaspringjunitspring-security