unit-test-security-authorization

This skill provides patterns for unit testing Spring Security authorization logic, helping Java developers verify that role-based access control and expression-based authorization actually behave as intended. It solves a subtle and dangerous problem: security tests can silently pass when method security is misconfigured, giving false confidence that access controls are enforced. The skill focuses on testing @PreAuthorize, @PostAuthorize, @Secured, @RolesAllowed, and custom permission evaluators without needing a full Spring Security context.

The workflow covers adding the spring-security-test dependency, enabling method security in a test configuration with @EnableMethodSecurity, and writing tests with @WithMockUser and @WithUserDetails to simulate authenticated principals with specific roles. It demonstrates asserting both allowed paths (no exception thrown) and denied paths (AccessDeniedException), testing complex SpEL expressions that combine roles and principal properties, and unit-testing custom PermissionEvaluator implementations that check document ownership. A key defensive practice it teaches is adding an explicit assertion that unauthorized access is rejected, so a missing @EnableMethodSecurity annotation is caught rather than silently bypassing every check. Reference files provide basic testing patterns, advanced authorization scenarios, setup guidance, and complete examples with common SpEL expression recipes.

It targets Java and Spring developers and security-conscious teams who need fast, reliable authorization tests as part of their test suite. Typical use cases include validating RBAC on service methods, verifying access-denied scenarios, testing owner-based document permissions, and confirming that method-level security is genuinely active before shipping.