环境:junit-5、Spring5.0.x、Spring Boot 2.0.x
以下是用来权限测试的接口:
- @ApiOperation("[可接入]分页查询管理员")
- @ApiResponses({@ApiResponse(code = 200, message = "访问成功", response = APIResponse.class),
- @ApiResponse(code = 201, message = "data", response = BackPageManagerDTO.class)})
- @ApiImplicitParams({@ApiImplicitParam(name = "page", value = "页码", required = true, defaultValue = "1"),
- @ApiImplicitParam(name = "size", value = "数目", required = true, defaultValue = "15")})
- @GetMapping("/page")
- @RequiresPermissions(PermissionConst.MANAGER)
- APIResponse page(@RequestParam(defaultValue = "1") Integer page, @RequestParam(defaultValue = "15") Integer size);
百度shiro的单元测试,发现没有一个是可以在测试时以指定Subject运行的,最接近的是ThreadContext.bind(securityManager),但这只是绑定了所有SecurityManger,而SecurityManager下还有很多Subject,将ThreadContext.bind(securityManager)改为ThreadContext.bind(subject)即可以指定subject身份去测试接口。个人案例如下:
- @SpringBootTest(classes = BackendApplication.class)
- @AutoConfigureMockMvc
- @SpringJUnitConfig
- @PropertySource(value = "classpath:jdbc.properties", encoding = "UTF-8")
- @ImportResource(locations = {"classpath:*-config.xml"})
- @WebAppConfiguration
- class ManagerTest {
- @Resource
- private BackManagerController managerController;
- @Resource
- private SecurityManager securityManager;
- @Resource
- private WebApplicationContext webApplicationContext;
- @Resource
- private SessionDAO sessionDAO;
- private Subject subject;
- private MockMvc mockMvc;
- private MockHttpServletRequest mockHttpServletRequest;
- private MockHttpServletResponse mockHttpServletResponse;
-
-
- private void login(String username, String password) {
- subject = new WebSubject.Builder(mockHttpServletRequest, mockHttpServletResponse)
- .buildWebSubject();
- UsernamePasswordToken token = new UsernamePasswordToken(username, password, true);
- subject.login(token);
- ThreadContext.bind(subject);
- }
-
- @BeforeEach
- void before() {
- mockHttpServletRequest = new MockHttpServletRequest(webApplicationContext.getServletContext());
- mockHttpServletResponse = new MockHttpServletResponse();
- MockHttpSession mockHttpSession = new MockHttpSession(webApplicationContext.getServletContext());
- mockHttpServletRequest.setSession(mockHttpSession);
- SecurityUtils.setSecurityManager(securityManager);
- mockMvc = MockMvcBuilders
- .webAppContextSetup(webApplicationContext)
- .build();
- login("test112", "111111");
- }
-
- @Test
- void page() throws Exception {
- System.out.println("-------------shiro基本权限测试-------------");
- System.out.println("init page result:" +
- mockMvc.perform(MockMvcRequestBuilders.get("/back/manager/page?page=1&size=15"))
- .andExpect(MockMvcResultMatchers.status().isOk())
- .andReturn()
- .getResponse()
- .getContentAsString());
- System.err.println("all session id:" +
- sessionDAO.getActiveSessions().stream()
- .map(Session::getId)
- .reduce((x, y) -> x + "," + y)
- .orElse(""));
- System.out.println("-------------测试同一用户异地登录将另一session踢出,该过程在CredentialsMatcher进行处理-------------");
- login("test112", "111111");
- System.out.println("user login again page result:" +
- mockMvc.perform(MockMvcRequestBuilders.get("/back/manager/page?page=1&size=15"))
- .andExpect(MockMvcResultMatchers.status().isOk())
- .andReturn()
- .getResponse()
- .getContentAsString());
- System.err.println("all session id:" +
- sessionDAO.getActiveSessions().stream()
- .map(Session::getId)
- .reduce((x, y) -> x + "," + y)
- .orElse(""));
- System.out.println("-------------测试登出后权限-------------");
- subject.logout();
- System.out.println("logout page result:" + mockMvc.perform(MockMvcRequestBuilders.get("/back/manager/page?page=1&size=15"))
- .andExpect(MockMvcResultMatchers.status().isOk())
- .andReturn()
- .getResponse()
- .getContentAsString());
- }
- }
测试结果图(以下测试结果分别是测shiro登录后权限处理、同号只能单处登录、登出后权限处理功能的结果):
原文地址:https://blog.csdn.net/z28126308/article/details/81034769