feat(admin): 콘텐츠 관리자 읽기 권한을 확장한다

src/test/kotlin/kr/co/vividnext/sodalive/menu/MenuControllerSecurityTest.kt

@@ -0,0 +1,116 @@
+package kr.co.vividnext.sodalive.menu
+
+import kr.co.vividnext.sodalive.common.CountryContext
+import kr.co.vividnext.sodalive.i18n.LangContext
+import kr.co.vividnext.sodalive.i18n.SodaMessageSource
+import kr.co.vividnext.sodalive.member.Member
+import kr.co.vividnext.sodalive.member.MemberAdapter
+import kr.co.vividnext.sodalive.member.MemberRole
+import org.junit.jupiter.api.DisplayName
+import org.junit.jupiter.api.Test
+import org.mockito.Mockito
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest
+import org.springframework.boot.test.context.TestConfiguration
+import org.springframework.boot.test.mock.mockito.MockBean
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Import
+import org.springframework.http.HttpStatus
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.anonymous
+import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user
+import org.springframework.security.web.SecurityFilterChain
+import org.springframework.security.web.authentication.HttpStatusEntryPoint
+import org.springframework.test.web.servlet.MockMvc
+import org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get
+import org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath
+import org.springframework.test.web.servlet.result.MockMvcResultMatchers.status
+import javax.servlet.http.HttpServletResponse
+
+@WebMvcTest(MenuController::class)
+@Import(MenuControllerSecurityTest.TestSecurityConfig::class)
+class MenuControllerSecurityTest @Autowired constructor(
+    private val mockMvc: MockMvc
+) {
+    @MockBean
+    private lateinit var service: MenuService
+
+    @MockBean
+    private lateinit var countryContext: CountryContext
+
+    @MockBean
+    private lateinit var langContext: LangContext
+
+    @MockBean
+    private lateinit var sodaMessageSource: SodaMessageSource
+
+    @TestConfiguration
+    @EnableGlobalMethodSecurity(prePostEnabled = true)
+    class TestSecurityConfig {
+        @Bean
+        fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
+            return http
+                .csrf().disable()
+                .authorizeRequests()
+                .anyRequest().authenticated()
+                .and()
+                .exceptionHandling()
+                .authenticationEntryPoint(HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
+                .accessDeniedHandler { _, response, _ -> response.sendError(HttpServletResponse.SC_FORBIDDEN) }
+                .and()
+                .build()
+        }
+    }
+
+    @Test
+    @DisplayName("콘텐츠 관리자 권한이면 메뉴 조회에 성공한다")
+    fun shouldAllowContentManagerRole() {
+        val member = createMember(role = MemberRole.CONTENT_MANAGER)
+        Mockito.`when`(service.getMenus(member)).thenReturn(
+            listOf(GetMenuResponse(title = "콘텐츠 리스트", route = "/content/list"))
+        )
+
+        mockMvc.perform(
+            get("/menu")
+                .with(user(MemberAdapter(member)))
+        )
+            .andExpect(status().isOk)
+            .andExpect(jsonPath("$.success").value(true))
+            .andExpect(jsonPath("$.data[0].route").value("/content/list"))
+    }
+
+    @Test
+    @DisplayName("일반 사용자 권한이면 메뉴 조회에 접근할 수 없다")
+    fun shouldRejectUserRole() {
+        val member = createMember(role = MemberRole.USER)
+
+        mockMvc.perform(
+            get("/menu")
+                .with(user(MemberAdapter(member)))
+        )
+            .andExpect(status().isOk)
+            .andExpect(jsonPath("$.success").value(false))
+    }
+
+    @Test
+    @DisplayName("익명 사용자는 메뉴 조회에 접근할 수 없다")
+    fun shouldRejectAnonymousUser() {
+        mockMvc.perform(
+            get("/menu")
+                .with(anonymous())
+        )
+            .andExpect(status().isUnauthorized)
+    }
+
+    private fun createMember(role: MemberRole): Member {
+        return Member(
+            email = "${role.name.lowercase()}@test.com",
+            password = "password",
+            nickname = role.name.lowercase(),
+            role = role
+        ).apply {
+            id = role.ordinal.toLong() + 1
+        }
+    }
+}