VaadinConnectAccessChecker { public AnnotatedElement getSecurityTarget(Method method) { if (!Modifier.isPublic(method.getModifiers())) { throw new IllegalArgumentException(String.format( "The method '%s' is not public hence cannot have a security target", method)); } return hasSecurityAnnotation(method) ? method : method.getDeclaringClass(); }  String check(Method method, HttpServletRequest request); AnnotatedElement getSecurityTarget(Method method); void enableCsrf(boolean xsrfProtectionEnabled);  }
@Test public void should_Throw_When_PrivateMethodIsPassed() throws Exception { class Test { private void test() { } } Method method = Test.class.getDeclaredMethod("test"); exception.expect(IllegalArgumentException.class); exception.expectMessage(method.toString()); checker.getSecurityTarget(method); }
@Test public void should_ReturnEnclosingClassAsSecurityTarget_When_NoSecurityAnnotationsPresent() throws Exception { class Test { public void test() { } } assertEquals(Test.class, checker.getSecurityTarget(Test.class.getMethod("test"))); }
@Test public void should_ReturnEnclosingClassAsSecurityTarget_When_OnlyClassHasSecurityAnnotations() throws Exception { @AnonymousAllowed class Test { public void test() { } } assertEquals(Test.class, checker.getSecurityTarget(Test.class.getMethod("test"))); }
@Test public void should_ReturnMethodAsSecurityTarget_When_OnlyMethodHasSecurityAnnotations() throws Exception { class Test { @AnonymousAllowed public void test() { } } Method securityMethod = Test.class.getMethod("test"); assertEquals(securityMethod, checker.getSecurityTarget(securityMethod)); }
@Test public void should_ReturnMethodAsSecurityTarget_When_BothClassAndMethodHaveSecurityAnnotations() throws Exception { @AnonymousAllowed class Test { @AnonymousAllowed public void test() { } } Method securityMethod = Test.class.getMethod("test"); assertEquals(securityMethod, checker.getSecurityTarget(securityMethod)); }