unit-test-security-authorization

# Unit Testing Security and Authorization ## Overview This skill provides patterns for unit testing Spring Security authorization logic using `@PreAuthorize`, `@Secured`, `@RolesAllowed`, and custom permission evaluators. It covers testing role-based access control (RBAC), expression-based authorization, custom permission evaluators, and verifying access denied scenarios without full Spring Security context. ## When to Use Use this skill when: - Testing `@PreAuthorize` and `@Secured` method-level security - Testing role-based access control (RBAC) - Testing custom permission evaluators - Verifying access denied scenarios - Testing authorization with authenticated principals - Want fast authorization tests without full Spring Security context ## Instructions Follow these steps to test Spring Security authorization: ### 1. Set Up Security Testing Dependencies Add spring-security-test to your test dependencies: ```xml <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-test</artifactId> <scope>test</scope> </dependency> ``` ### 2. Enable Method Security in Test Configuration ```java @Configuration @EnableMethodSecurity class TestSecurityConfig { } ``` ### 3. Test with `@WithMockUser` ```java @Test @WithMockUser(roles = "ADMIN") void shouldAllowAdminAccess() { assertThatCode(() -> service.deleteUser(1L)) .doesNotThrowAnyException(); } @Test @WithMockUser(roles = "USER") void shouldDenyUserAccess() { assertThatThrownBy(...