unit-test-security-authorization

SKILL.md

Unit testing patterns for Spring Security authorization annotations and role-based access control.

Covers @PreAuthorize, @Secured, and @RolesAllowed method-level security with @WithMockUser test fixtures

Includes role-based access control (RBAC), expression-based authorization, and custom PermissionEvaluator testing

Provides MockMvc patterns for testing secured REST endpoints and parameterized role testing strategies

Demonstrates both allow and deny scenarios, owner-based access checks, and null authentication handling

Unit Testing Security and Authorization

Overview

This skill provides patterns for unit testing Spring Security authorization logic using @PreAuthorize, @Secured, @RolesAllowed, and custom permission evaluators. It covers testing role-based access control (RBAC), expression-based authorization, custom permission evaluators, and verifying access denied scenarios without full Spring Security context.

When to Use

Use this skill when:

Testing @PreAuthorize and @Secured method-level security

Testing role-based access control (RBAC)

Testing custom permission evaluators

Verifying access denied scenarios

Testing authorization with authenticated principals

Want fast authorization tests without full Spring Security context

Instructions

Follow these steps to test Spring Security authorization: