How to test same authorization logic in many rest controllers - spring

Question

So I have many rest controllers and I would like to write some reusable test approach for authorization
#RestController //1
public class PolicyController {
#PreAuthorize("#securityService.hasAccess(#policy)")
#GetMapping("policy/{policy}/group")
ResponseEntity subgrups(String policy) {
// impl
}
#PreAuthorize("#securityService.hasAccess(#policy)")
#GetMapping("policy/{policy}/participants")
ResponseEntity participants(String policy) {
// impl
}
}
#RestController//2
public class GroupController {
#PreAuthorize("#securityService.hasAccess(#policy)")
#GetMapping("policy/{policy}/group/{group}"
ResponseEntity subgroups(String policy, String group) {
// impl
}
}
#RestController //...n
When we follow good practice we should write test for every line of code, so probably I should write exactly so many duplicated tests as amount of controller * amount of methods so it would be a huge amount of such duplicated code
#WebMvcTest(controllers = PolicyController.class)
public class PolicyControllerTest {
//...mock all controller dependencies
#Autowired
private MockMvc mockMvc;
#MockBean
private PolicySecurity policyApi;
#Autowired
private SecurityService securityService;
#Test
public void whenSearchingForGroupAndHasAccessToPolicy() throws Exception {
when(policyApi.isActive(any())).thenReturn(false);
mockMvc.perform(get("/policies/{policy}/group", "123")
.contentType("application/json"))
.andExpect(status().isOk());
}
#Test
public void whenSearchingForGroupAndHasntAccessToPolicy() throws Exception {
when(policyApi.isActive(any())).thenReturn(true);
mockMvc.perform(get("/policies/{policy}/group", "123")
.contentType("application/json"))
.andExpect(status().isForbidden());
}
#Test
public void whenSearchingForParticipantsAndHasAccessToPolicy() throws Exception {
when(policyApi.isActive(any())).thenReturn(false);
mockMvc.perform(get("/policies/{policy}/participants", "123")
.contentType("application/json"))
.andExpect(status().isOk());
}
#Test
public void whenSearchingForParticipantsAndHasntAccessToPolicy() throws Exception {
when(policyApi.isActive(any())).thenReturn(true);
mockMvc.perform(get("/policies/{policy}/participants", "123")
.contentType("application/json"))
.andExpect(status().isForbidden());
}
}
this is only one controller with two methods, just imagine how many code there will be for 5 controllers and 30 endpoints, any idea how to write it in more maintainable way ?

Answer 1

Few pointers on what can be done. You can group your APIs based on the security configuration and then maintain a list of APIs for that group. This way you can just call one write one method for each authorization configuration where you will iterate through each API and run the mockMvc perform API method.
for(api in api_list) {
mockMvc.perform(get(api, "123")
.contentType("application/json"))
.andExpect(status().isForbidden());
}
If the security configuration changes for any one API in future, then the test case for the whole group will fail. Only problem with this approach is that maintaining the test cases will be difficult over time because you would need to keep updating the API lists everytime you change the authorization.
Note that it is always better to write isolated test cases for each API method to test only that unit.