feat: add required authorities for alias only message

CaritasDeutschland · Jun 8, 2021 · 2f7be59 · 2f7be59
1 parent 810330a
commit 2f7be59
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 3 deletions.
diff --git a/src/main/java/de/caritas/cob/messageservice/config/SecurityConfig.java b/src/main/java/de/caritas/cob/messageservice/config/SecurityConfig.java
@@ -72,12 +72,10 @@ protected void configure(HttpSecurity http) throws Exception {
         .hasAuthority(TECHNICAL_DEFAULT)
         .antMatchers("/messages", "/messages/draft", "/messages/videohint/new")
         .hasAnyAuthority(USER_DEFAULT, CONSULTANT_DEFAULT, ANONYMOUS_DEFAULT)
-        .antMatchers("/messages/new")
+        .antMatchers("/messages/new", "/messages/aliasonly/new")
         .hasAnyAuthority(USER_DEFAULT, CONSULTANT_DEFAULT, TECHNICAL_DEFAULT, ANONYMOUS_DEFAULT)
         .antMatchers("/messages/forward", "/messages/feedback/new")
         .hasAuthority(USE_FEEDBACK)
-        .antMatchers("/messages/aliasonly/new")
-        .hasAnyAuthority(USER_DEFAULT, TECHNICAL_DEFAULT)
         .anyRequest()
         .denyAll();
   }

diff --git a/...va/de/caritas/cob/messageservice/api/controller/MessageControllerAuthorizationTestIT.java b/...va/de/caritas/cob/messageservice/api/controller/MessageControllerAuthorizationTestIT.java
@@ -493,4 +493,44 @@ public void saveAliasOnlyMessage_Should_ReturnCreatedAndCallPostGroupMessageFaca
     verify(postGroupMessageFacade, times(1)).postAliasOnlyMessage(any(), any());
   }
 
+  @Test
+  @WithMockUser(authorities = {AuthorityValue.CONSULTANT_DEFAULT})
+  public void saveAliasOnlyMessage_Should_ReturnCreatedAndCallPostGroupMessageFacade_When_ConsultantDefaultAuthority()
+      throws Exception {
+    AliasOnlyMessageDTO aliasOnlyMessageDTO =
+        new EasyRandom().nextObject(AliasOnlyMessageDTO.class);
+
+    mvc.perform(
+        post(PATH_POST_CREATE_ALIAS_ONLY_MESSAGE)
+            .cookie(csrfCookie)
+            .header(CSRF_HEADER, CSRF_VALUE)
+            .header("rcGroupId", RC_GROUP_ID)
+            .contentType(MediaType.APPLICATION_JSON)
+            .content(new ObjectMapper().writeValueAsString(aliasOnlyMessageDTO))
+            .accept(MediaType.APPLICATION_JSON))
+        .andExpect(status().isCreated());
+
+    verify(postGroupMessageFacade, times(1)).postAliasOnlyMessage(any(), any());
+  }
+
+  @Test
+  @WithMockUser(authorities = {AuthorityValue.ANONYMOUS_DEFAULT})
+  public void saveAliasOnlyMessage_Should_ReturnCreatedAndCallPostGroupMessageFacade_When_AnonymousDefaultAuthority()
+      throws Exception {
+    AliasOnlyMessageDTO aliasOnlyMessageDTO =
+        new EasyRandom().nextObject(AliasOnlyMessageDTO.class);
+
+    mvc.perform(
+        post(PATH_POST_CREATE_ALIAS_ONLY_MESSAGE)
+            .cookie(csrfCookie)
+            .header(CSRF_HEADER, CSRF_VALUE)
+            .header("rcGroupId", RC_GROUP_ID)
+            .contentType(MediaType.APPLICATION_JSON)
+            .content(new ObjectMapper().writeValueAsString(aliasOnlyMessageDTO))
+            .accept(MediaType.APPLICATION_JSON))
+        .andExpect(status().isCreated());
+
+    verify(postGroupMessageFacade, times(1)).postAliasOnlyMessage(any(), any());
+  }
+
 }