We need to ensure that MockMvcAutoConfiguration has defined its
DispatcherServletPath bean before the condition that checks for it in
ServletWebSecurityAutoConfiguration is evaluated.
Ideally, ServletWebSecurityAutoConfiguration in spring-boot-security
would not know about test-specific code but there's no easy way to
establish the required ordering without this link. One alternative
option is an auto-configuration class in spring-boot-security-test
that's purely for ordering purposes. This was rejected as it would
introduce new public API (as we enforce that all auto-configurations
are public).
Fixes gh-49854
Prior to this commit, `EndpointRequest` exposed factory methods for
creating security matchers in the context of Actuator endpoints. This is
using the popular pattern matching approach for security matchers.
Such matchers are not as focused as method-level security and will match
the endpoint path itself (`"actuator/endpoint"`) as well as everything
beneath it (`"actuator/endpoint/**"`).
This commit improves the Javadoc and reference documentation to make
this behavior more explicit.
Closes gh-49520
Create `spring-boot-resttestclient` and `spring-boot-webtestclient`
modules to hold test client auto-configuration and `TestRestTemplate`
code.
Previous these classes were contained in `spring-boot-resetclient-test`
and `spring-boot-webclient-test` which was incorrect since the `-test`
modules should hold code need to test the given modules, not supporting
test classes.
See gh-46356
Co-authored-by: Phillip Webb <phil.webb@broadcom.com>
This commit updates StaticResourceLocation to include a new entry for
the common locations of fonts. As a result,
StaticResourceRequest#atCommonLocations now includes /fonts/** as well.
See gh-46208
Signed-off-by: Shahab Kondri <shahab.kondri@gmail.com>
Remove the `spring-boot-web-server-test` module, adding
`SpringBootTestRandomPortContextCustomizerFactory` to
`spring-boot-web-server` as a replacement for
`SpringBootTestRandomPortApplicationListener`.
See gh-46356
See gh-47322
Relocate `RestTestClientBuilderCustomizer` to `spring-boot-test`
and break the direct link to web-server by making use of
`spring.factories` and the new `BaseUrlProviders` class.
See gh-46356
Make `spring-boot-test-autoconfigure` optionally depend on
`spring-boot-autoconfigure` so that it can be an `api` dependency
for `*-test` modules. Also relocate it to core.
See gh-47322
This commit modularizes spring-boot-test-autoconfigure. It now
contains only the code that's central to test auto-configuration.
Feature-specific functionality has moved out into -test modules,
some existing and some newly created. For example, `@DataJpaTest` can
now be found in spring-boot-data-jpa-test.
Closes gh-47322
Spring Boot 4 requires Jakarta EE 11. Jersey 4 will support EE 11 but
its release schedule is uncertain. Furthermore, Jersey does not yet
support Jackson 3 and there's no clear timeline for when Jackson 3
will be supported.
In light of the above, this commit removes support for Jersey.
Reinstating support can be considered once there's a Jersey GA that
supports Jakarta EE 11 or its clear that one will be available in
time for Boot's GA in November. Ideally, support for Jackson 3 would
also be available before reinstating Jersey support.
Closes gh-47017
Prior to this commit, if the user defined a custom
PathPatternRequestMatcher.Builder, security auto-configuration would
still set its base path to matcher the dispatcher servlet path.
We need to give the user more control in this situation.
If the user has defined a custom builder bean it should have a name
other than pathPatternRequestMatcherBuilder. This different name is
required to prevent a clash with the @Fallback bean that's defined
by Security's AuthorizationConfiguration. This commit changes the
bean post-processor so that it will only apply to a bean named
pathPatternRequestMatcherBuilder. By using a different name (which
is necessary unless overriding is enabled) to use can take complete
control of the path pattern request matcher builder.
See gh-45492
Stéphane Nicoll
Andy Wilkinson
Brian Clozel
Phillip Webb
Moritz Halbritter
Shahab Kondri