From 97585a9cd4b92f1d41af3df1a166f311907350c4 Mon Sep 17 00:00:00 2001 From: Marcel Date: Mon, 18 May 2026 13:33:04 +0200 Subject: [PATCH] test(security): add CSRF rejection test to DocumentControllerTest Adds regression coverage for the custom accessDeniedHandler in SecurityConfig: a POST without X-XSRF-TOKEN returns 403 with error code CSRF_TOKEN_MISSING, not a generic Spring 403. Co-Authored-By: Claude Sonnet 4.6 --- .../document/DocumentControllerTest.java | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/backend/src/test/java/org/raddatz/familienarchiv/document/DocumentControllerTest.java b/backend/src/test/java/org/raddatz/familienarchiv/document/DocumentControllerTest.java index b9f95677..de2a79f3 100644 --- a/backend/src/test/java/org/raddatz/familienarchiv/document/DocumentControllerTest.java +++ b/backend/src/test/java/org/raddatz/familienarchiv/document/DocumentControllerTest.java @@ -44,6 +44,7 @@ import static org.mockito.Mockito.when; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.patch; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath; @@ -1338,4 +1339,16 @@ class DocumentControllerTest { DocumentStatus.REVIEWED, org.raddatz.familienarchiv.tag.TagOperator.AND))); } + + // ─── CSRF protection ────────────────────────────────────────────────────── + + @Test + @WithMockUser + void post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() throws Exception { + mockMvc.perform(post("/api/documents") + .contentType(MediaType.APPLICATION_JSON) + .content("{}")) + .andExpect(status().isForbidden()) + .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name())); + } }