UserIpLimitsAccessVoter implements AccessDecisionVoter { public int vote(Authentication auth, Object resource, Collection config) { String label = "UserIpLimitsAccessVoter"; if (resource != null && !supports(resource.getClass())) { log.debug(debugText(label, auth, config, resource, ACCESS_ABSTAIN)); return ACCESS_ABSTAIN; } FilterInvocation invocation = (FilterInvocation) resource; HttpServletRequest httpRequest = invocation.getHttpRequest(); if (null == httpRequest) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } String userIpLimits = getUserIpLimits(auth); if (null != userIpLimits && !userIpLimits.equals("")) { String requestIp = httpRequest.getRemoteAddr(); String[] ipLimits = userIpLimits.split(";"); for (String ipLimit : ipLimits) { if (ipInRange(requestIp, ipLimit)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } } log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } else { log.debug(debugText(label, auth, config, resource, ACCESS_ABSTAIN)); return ACCESS_ABSTAIN; } }  @Override boolean supports(ConfigAttribute configAttribute); @Override boolean supports(Class aClass); int vote(Authentication auth,
                    Object resource,
                    Collection config);  }
@Test public void testVoteResourceType() { UserIpLimitsAccessVoter voter = new UserIpLimitsAccessVoter(); Authentication auth = EasyMock.createMock(Authentication.class); EasyMock.expect(auth.getName()).andReturn("auth-name"); Collection<ConfigAttribute> config = Collections.emptyList(); EasyMock.replay(auth); int voteResult = voter.vote(auth, "invalid-resource", config); assertEquals(ACCESS_ABSTAIN, voteResult); EasyMock.verify(auth); }
@Test public void testAnonymousUser() { UserIpLimitsAccessVoter voter = new UserIpLimitsAccessVoter(); Authentication auth = EasyMock.createMock(Authentication.class); FilterInvocation resource = EasyMock.createMock(FilterInvocation.class); HttpServletRequest httpRequest = EasyMock.createMock(HttpServletRequest.class); EasyMock.expect(auth.getName()).andReturn("auth-name"); EasyMock.expect(auth.getPrincipal()).andReturn("anonymous-auth"); EasyMock.expect(resource.getHttpRequest()).andReturn(httpRequest); Collection<ConfigAttribute> config = Collections.emptyList(); EasyMock.replay(auth, resource, httpRequest); int voteResult = voter.vote(auth, resource, config); assertEquals(ACCESS_ABSTAIN, voteResult); EasyMock.verify(auth, resource, httpRequest); }