01
package cn.usehook.spring.config;
02

03
import org.springframework.context.annotation.Bean;
04
import org.springframework.context.annotation.Configuration;
05
import org.springframework.http.HttpMethod;
06
import org.springframework.security.config.Customizer;
07
import org.springframework.security.config.http.SessionCreationPolicy;
08
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
09
import org.springframework.security.web.SecurityFilterChain;
10

11
@Configuration(proxyBeanMethods = false)
12
public class SecurityConfiguration {
13

14
    @Bean
15
    SecurityFilterChain apiSecurity(HttpSecurity http) throws Exception {
16
        http
17
            .authorizeHttpRequests(authorize -> authorize
18
                .requestMatchers(HttpMethod.GET, "/api/v1/health").permitAll()
19
                .requestMatchers("/actuator/health/**").permitAll()
20
                .requestMatchers("/actuator/**").hasRole("MONITOR")
21
                .requestMatchers("/api/v1/health/**").hasRole("MONITOR")
22
                .anyRequest().denyAll()
23
            )
24
            .httpBasic(Customizer.withDefaults())
25
            .sessionManagement(session -> session
26
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
27
            )
28
            .csrf(csrf -> csrf.disable())
29
            .cors(Customizer.withDefaults());
30

31
        return http.build();
32
    }
33
}

01
@Bean
02
CorsConfigurationSource corsConfigurationSource(
03
    @Value("${app.cors.allowed-origin}") String allowedOrigin
04
) {
05
    CorsConfiguration configuration = new CorsConfiguration();
06
    configuration.setAllowedOrigins(List.of(allowedOrigin));
07
    configuration.setAllowedMethods(List.of("GET", "POST"));
08
    configuration.setAllowedHeaders(List.of("Authorization", "Content-Type"));
09

10
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
11
    source.registerCorsConfiguration("/api/**", configuration);
12
    return source;
13
}

1
@Configuration(proxyBeanMethods = false)
2
@EnableMethodSecurity
3
public class SecurityConfiguration {
4
    // SecurityFilterChain 与 CORS Bean
5
}

1
@PreAuthorize("hasRole('MONITOR')")
2
public HealthStatus getRequired(String service) {
3
    String normalizedService = normalizeService(service);
4
    return repository.findByService(normalizedService)
5
        .orElseThrow(() -> new HealthStatusNotFoundException(normalizedService));
6
}

01
package cn.usehook.spring.controller;
02

03
import cn.usehook.spring.config.SecurityConfiguration;
04
import cn.usehook.spring.health.HealthService;
05
import cn.usehook.spring.health.HealthStatus;
06
import org.junit.jupiter.api.Test;
07
import org.springframework.beans.factory.annotation.Autowired;
08
import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
09
import org.springframework.context.annotation.Import;
10
import org.springframework.http.HttpStatus;
11
import org.springframework.http.MediaType;
12
import org.springframework.security.test.context.support.WithMockUser;
13
import org.springframework.test.context.bean.override.mockito.MockitoBean;
14
import org.springframework.test.web.servlet.assertj.MockMvcTester;
15

16
import static org.assertj.core.api.Assertions.assertThat;
17
import static org.mockito.BDDMockito.given;
18
import static org.mockito.BDDMockito.then;
19

20
@WebMvcTest(HealthController.class)
21
@Import(SecurityConfiguration.class)
22
class HealthControllerWebTests {
23

24
    private final MockMvcTester mvc;
25

26
    @MockitoBean
27
    private HealthService healthService;
28

29
    @Autowired
30
    HealthControllerWebTests(MockMvcTester mvc) {
31
        this.mvc = mvc;
32
    }
33

34
    @Test
35
    void allowsAnonymousPublicHealthRequest() {
36
        given(healthService.check())
37
            .willReturn(new HealthStatus("UP", "spring"));
38

39
        assertThat(mvc.get().uri("/api/v1/health"))
40
            .hasStatusOk();
41
    }
42

43
    @Test
44
    void rejectsAnonymousProtectedRequest() {
45
        assertThat(mvc.get().uri("/api/v1/health/status/redis"))
46
            .hasStatus(HttpStatus.UNAUTHORIZED);
47
    }
48

49
    @Test
50
    @WithMockUser(roles = "MONITOR")
51
    void allowsMonitorToReadStoredStatus() {
52
        given(healthService.getRequired("redis"))
53
            .willReturn(new HealthStatus("UP", "redis"));
54

55
        assertThat(mvc.get().uri("/api/v1/health/status/redis"))
56
            .hasStatusOk()
57
            .bodyJson()
58
            .extractingPath("$.data.service")
59
            .asString()
60
            .isEqualTo("redis");
61
    }
62

63
    @Test
64
    @WithMockUser(roles = "MONITOR")
65
    void acceptsAuthenticatedHealthCheck() {
66
        given(healthService.check("PostgreSQL"))
67
            .willReturn(new HealthStatus("UP", "postgresql"));
68

69
        assertThat(mvc.post().uri("/api/v1/health/check")
70
            .contentType(MediaType.APPLICATION_JSON)
71
            .content("""
72
                {"service":"PostgreSQL"}
73
                """))
74
            .hasStatusOk()
75
            .bodyJson()
76
            .extractingPath("$.data.service")
77
            .asString()
78
            .isEqualTo("postgresql");
79
    }
80

81
    @Test
82
    @WithMockUser(roles = "MONITOR")
83
    void validatesAuthenticatedHealthCheck() {
84
        assertThat(mvc.post().uri("/api/v1/health/check")
85
            .contentType(MediaType.APPLICATION_JSON)
86
            .content("""
87
                {"service":"   "}
88
                """))
89
            .hasStatus(HttpStatus.BAD_REQUEST)
90
            .bodyJson()
91
            .extractingPath("$.errorCode")
92
            .asString()
93
            .isEqualTo("request_validation_failed");
94

95
        then(healthService).shouldHaveNoInteractions();
96
    }
97
}