unit-test-security-authorization

Q: How do I install unit-test-security-authorization?

Run npx skills add https://github.com/giuseppe-trisciuoglio/developer-kit --skill unit-test-security-authorization in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/unit-test-security-authorization/ (personal) or .claude/skills/unit-test-security-authorization/ (project).

by giuseppe-trisciuoglioTesting & QA

Provides patterns for unit testing Spring Security with @PreAuthorize, @Secured, @RolesAllowed. Validates role-based access control and authorization policies. Use when testing security configurations and access control logic.

Installs: 3.8K
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/giuseppe-trisciuoglio/developer-kit --skill unit-test-security-authorization

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads unit-test-security-authorization automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Unit Testing Security and Authorization

Overview

This skill provides patterns for unit testing Spring Security authorization logic using @PreAuthorize, @Secured, @RolesAllowed, and custom permission evaluators. It covers testing role-based access control (RBAC), expression-based authorization, custom permission evaluators, and verifying access denied scenarios without full Spring Security context.

When to Use

Use this skill when:

Testing @PreAuthorize and @Secured method-level security
Testing role-based access control (RBAC)
Testing custom permission evaluators
Verifying access denied scenarios
Testing authorization with authenticated principals
Want fast authorization tests without full Spring Security context

Instructions

Follow these steps to test Spring Security authorization:

1. Set Up Security Testing Dependencies

Add spring-security-test to your test dependencies:

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-test</artifactId>
  <scope>test</scope>
</dependency>

2. Enable Method Security in Test Configuration

@Configuration
@EnableMethodSecurity
class TestSecurityConfig { }

3. Test with `@WithMockUser`

@Test
@WithMockUser(roles = "ADMIN")
void shouldAllowAdminAccess() {
  assertThatCode(() -> service.deleteUser(1L))
    .doesNotThrowAnyException();
}

@Test
@WithMockUser(roles = "USER")
void shouldDenyUserAccess() {
  assertThatThrownBy(() -> service.deleteUser(1L))
    .isInstanceOf(AccessDeniedException.class);
}

4. Test Custom Permission Evaluators

@Test
void shouldGrantPermissionToOwner() {
  Authentication auth = new UsernamePasswordAuthenticationToken(
    "alice", null, List.of(new SimpleGrantedAuthority("ROLE_USER"))
  );
  Document doc = new Document(1L, "Test", new User("alice"));

  boolean result = evaluator.hasPermission(auth, doc, "WRITE");
  assertThat(result).isTrue();
}

5. Validate Security is Active

If tests pass unexpectedly, add this assertion to verify security is enforced:

@Test
void shouldRejectUnauthorizedWhenSecurityEnabled() {
  assertThatThrownBy(() -> service.deleteUser(1L))
    .isInstanceOf(AccessDeniedException.class);
}

Quick Reference

Annotation	Description	Example
`@PreAuthorize`	Pre-invocation authorization	`@PreAuthorize("hasRole('ADMIN')")`
`@PostAuthorize`	Post-invocation authorization	`@PostAuthorize("returnObject.owner == authentication.name")`
`@Secured`	Simple role-based security	`@Secured("ROLE_ADMIN")`
`@RolesAllowed`	JSR-250 standard	`@RolesAllowed({"ADMIN", "MANAGER"})`
`@WithMockUser`	Test annotation	`@WithMockUser(roles = "ADMIN")`

Examples

Basic `@PreAuthorize` Test

@Service
public class UserService {
  @PreAuthorize("hasRole('ADMIN')")
  public void deleteUser(Long userId) {
    // delete logic
  }
}

// Test
@Test
@WithMockUser(roles = "ADMIN")
void shouldAllowAdminToDeleteUser() {
  assertThatCode(() -> service.deleteUser(1L))
    .doesNotThrowAnyException();
}

@Test
@WithMockUser(roles = "USER")
void shouldDenyUserFromDeletingUser() {
  assertThatThrownBy(() -> service.deleteUser(1L))
    .isInstanceOf(AccessDeniedException.class);
}

Expression-Based Security Test

@PreAuthorize("#userId == authentication.principal.id")
public UserProfile getUserProfile(Long userId) {
  // get profile
}

// For custom principal properties, use @WithUserDetails with a custom UserDetailsService
@Test
@WithUserDetails("alice")
void shouldAllowUserToAccessOwnProfile() {
  assertThatCode(() -> service.getUserProfile(1L))
    .doesNotThrowAnyException();
}

Validation tip: If a security test passes unexpectedly, verify that @EnableMethodSecurity is active on the test configuration — a missing annotation causes all @PreAuthorize checks to be bypassed silently.

See references/basic-testing.md for more basic patterns and references/advanced-authorization.md for complex expressions and custom evaluators.

Best Practices

Use @WithMockUser for setting authenticated user context
Test both allow and deny cases for each security rule
Test with different roles to verify role-based decisions
Test expression-based security comprehensively
Mock external dependencies (permission evaluators, etc.)
Test anonymous access separately from authenticated access
Use @EnableGlobalMethodSecurity in configuration for method-level security

Common Pitfalls

Forgetting to enable method security in test configuration
Not testing both allow and deny scenarios
Testing framework code instead of authorization logic
Not handling null authentication in tests
Mixing authentication and authorization tests unnecessarily

Constraints and Warnings

Method security requires proxy: @PreAuthorize works via proxies; direct method calls bypass security
@EnableGlobalMethodSecurity: Must be enabled for @PreAuthorize, @Secured to work
Role prefix: Spring adds "ROLE_" prefix automatically; use hasRole('ADMIN') not hasRole('ROLE_ADMIN')
Authentication context: Security context is thread-local; be careful with async tests
@WithMockUser limitations: Creates a simple Authentication; complex auth scenarios need custom setup
SpEL expressions: Complex SpEL in @PreAuthorize can be difficult to debug; test thoroughly
Performance impact: Method security adds overhead; consider security at layer boundaries

References

Setup and Configuration

references/setup.md - Maven/Gradle dependencies and security configuration

Testing Patterns

references/basic-testing.md - Basic patterns for @PreAuthorize, @Secured, MockMvc testing, and parameterized tests

Advanced Topics

references/advanced-authorization.md - Expression-based authorization, custom permission evaluators, SpEL expressions

Complete Examples

references/complete-examples.md - Before/after examples showing transition from manual to declarative security

FAQ

What does the unit-test-security-authorization skill do?

How do I install unit-test-security-authorization?

Run npx skills add https://github.com/giuseppe-trisciuoglio/developer-kit --skill unit-test-security-authorization in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/unit-test-security-authorization/ (personal) or .claude/skills/unit-test-security-authorization/ (project).

Which AI agents can use unit-test-security-authorization?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is unit-test-security-authorization safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains unit-test-security-authorization?

It is published by giuseppe-trisciuoglio in giuseppe-trisciuoglio/developer-kit. It has 3,754 recorded installs.