Search code examples
unit-testingshiro

Apache shiro unit test with checkPermission passes regardless of stubbed permission

Running spring boot 1.5.12 with Shiro starter 1.4.0

Trying to write up some unit tests to test a static class which checks permissions using the checkPermission of the Subject interface.

I'm mocking the shiro subject and stubbing the isPermitted method to return false for specific permission string... but for some reason, it passes when Subject.checkPermission is executed.

Subject subjectUnderTest = mock(Subject.class);
when(subjectUnderTest.isAuthenticated()).thenReturn(true);
when(subjectUnderTest.isPermitted(eq("review:edit:regional"))).thenReturn(false);
setSubject(subjectUnderTest);
subjectUnderTest.checkPermission("review:edit:regional");

I'm fairly new to Mockito but in this case was expecting AuthorizationException to be thrown by checkPermission given the isPermitted stub returning false.

If i change the implementation to use isPermitted, then test runs as expected..but current implementation is using checkPermission...

Solution

  • The method checkPermission() of the Subject interface will not call isPermitted() on itself but on the abstract AuthorizingRealm. The callchain for checkPermission() is like the following: 

    Subject.checkPermissions()->
    DelegatingSubject.checkPermissions()->
        Authoriser.checkPermission()->
            AuthorizingRealm.checkPermission()->
            AuthorizingRealm.isPermitted()

    Therefore, mocking isPermitted() on the Subject will have no effect since checkPermission() will never call it on this object. To achieve the expected behavior, you have to mock the method on the AuthorizingRealm or alternatively on the AuthorizingSecurityManager incase calls to your SecurityManager are available under test.