Question

I have this:

@Secured(['ROLE_USER', 'ROLE_HELPDESK', 'ROLE_ADMIN'])
class MyController {
    def edit = {
    }

    @Secured(['ROLE_ADMIN'])
    def uploadForUser = {
        params.userId = params.id
        forward(controller: 'someController', action: 'someAction', params: params)
    }
}

and an integration test I think should fail:

public void test_uploadForUser_unauthenticated(){
    myController.params.id = "testUser"
    myController.uploadForUser()
}

And yet the tests pass. Is there any way to test controllers annotated with the spring security plugin?

Answer 1

These annotations are analyzed by SpringSecurityFilter, so they don’t work if you don’t have an actual HTTP request performed.

Thus, you need either to switch to checking the roles by conditionals inside the actions, like being done here, or test it with WebDriver/Geb or some simpler framework — very nice approach is presented in Grails Security Plugin itself.