tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can be created and user storage configured
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can dispense new users
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can invalidate invalid user credentials
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can retrieve a valid user by id
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can retrieve a valid user by username
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can retrieve an invalid user by id
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can retrieve an invalid user by username
tests.specs.integration.BasicAuthUserService ‑ CBSecurity Basic Auth User Service can validate valid user credentials
tests.specs.integration.CBSecuritySpec ‑ CBSecurity Integrations can retrieve user,auth and mixin services
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can auto refresh tokens by using the autoRefreshValidator setting and the JWT Validator Given Auto refresh is on and an expired access token is sent but no refresh token is sent Then the validation should fail
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can auto refresh tokens by using the autoRefreshValidator setting and the JWT Validator Given Auto refresh is on and an expired access token is sent with a good refresh token Then the validation should pass and we should return our two new tokens as headers
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can auto refresh tokens by using the autoRefreshValidator setting and the JWT Validator Given Auto refresh is on and an expired access token is sent with an expired refresh token Then the validation should fail
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can auto refresh tokens by using the autoRefreshValidator setting and the JWT Validator Given Auto refresh is on and no access or refresh token is sent Then the validation should fail
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can auto refresh tokens by using the autoRefreshValidator setting and the JWT Validator Given Auto refresh is on and no access token is sent but a refresh token is sent Then the validation should pass and we should return our two new tokens as headers
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can refresh tokens via the /refreshtoken endpoint Given An activated endpoint and a valid refresh token Then it should 200 a response with new refresh tokens
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can refresh tokens via the /refreshtoken endpoint Given An activated endpoint and an invalid refresh token Then it should kick me out
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can refresh tokens via the /refreshtoken endpoint Given An activated endpoint but no refresh tokens passed Then it should 400 a response
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I can refresh tokens via the /refreshtoken endpoint Given The endpoint is disabled Then it should 404 a response
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given a getJwtCustomClaims method on user Then it should pass the current payload in to the function
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given a valid refresh token Then it should create new access and refresh tokens and invalidate the old refresh token
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given an expired refresh token Then an exception should be thrown
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given an invalid refresh token Then an exception should be thrown
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given any custom claims Then it should pass them on to the new tokens
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given any custom claims with a function or closure Then it should evaluate them right before encoding the token
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens Story: I want to refresh tokens manually via the refreshToken() method Given custom refresh claims on the attempt method Then the claims should be passed on to the refresh method
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens can discover refresh tokens and produce an empty result when none passed
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens can discover refresh tokens via the rc
tests.specs.integration.JWTSpec ‑ JWT Security Services Feature: CBSecurity refresh tokens can generate both access and refresh tokens with a valid user
tests.specs.integration.JWTSpec ‑ JWT Security Services Given a valid jwt token but it is not in the storage Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Given a valid jwt token in all senses Then it should allow the call
tests.specs.integration.JWTSpec ‑ JWT Security Services Given a valid jwt token put in to storage Then it should use the exp on the token for the storage timeout
tests.specs.integration.JWTSpec ‑ JWT Security Services Given a valid jwt token that's expired Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Given a valid jwt token with no required claims and accessing a secure api call Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Given an empty jwt token and accessing a secure api call Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Given an invalid jwt token and accessing a secure api call Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Given an valid jwt token but with an invalid user Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Given no jwt token and accessing a secure api call Then it should block with no authorization
tests.specs.integration.JWTSpec ‑ JWT Security Services Story: I want to invalidate all tokens in the storage Given a valid jwt token and a invalidate all is issued Then the storage should be empty
tests.specs.integration.SecuritySpec ‑ Security module Annotation based Security Given A secured annotated handler and a non-annotated action Then it should block and redirect
tests.specs.integration.SecuritySpec ‑ Security module Annotation based Security Given A secured annotated handler and an annotated action Then it should block and redirect as well
tests.specs.integration.SecuritySpec ‑ Security module Annotation based Security Given A secured annotated handler and an annotated action and a valid access Then it should allow access
tests.specs.integration.SecuritySpec ‑ Security module Annotation based Security Given A secured annotated handler and an annotated action with invalid auth Then it should allow access to handler but not to action
tests.specs.integration.SecuritySpec ‑ Security module Annotation based Security Given a public handler and action Then it should execute it
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given a direct action of redirect with no explicit rule actions Then it should do a global redirect using the global setting for invalid authentication
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given a direct override action with no explicit rule actions Then it should override using the global setting for invalid authentication
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given a secure event of public with a put,post http method constraint When when logged in and using a GET Then it should NOT allow it to be executed
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given a secure event of public with a put,post http method constraint When when logged in and using a put or post Then it should do allow it to be executed
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given no direct action and no explicit rule actions Then it should default to a redirect action to the global setting for invalid authentication
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given no direct action but using a redirect rule action Then it should redirect using the redirect element
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Given no direct action but using an overrideEvent rule action Then it should override using the overrideEvent element
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Module cbsecurity integrations Given a module secured event Then it should redirect to the modules invalidAuthenticationEvent redirect setting
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Module cbsecurity integrations Given a module secured event with an override action Then it should override to the modules invalidAuthenticationEvent
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security Module cbsecurity integrations Given a module unload call Then it should unload module rules if the module is unloaded
tests.specs.integration.SecuritySpec ‑ Security module Rule based Security should load the rules from inline declaration
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods when() methods can call the fail closure when the permissions fail
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods when() methods can call the sucess closure when the permissions pass
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods when() methods can ignore the success when the permissions fail and no fail has been provided
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods whenAll() methods can call the fail closure when the permissions fail
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods whenAll() methods can call the sucess closure when the permissions pass
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods whenAll() methods can ignore the success when the permissions fail and no fail has been provided
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods whenNone() methods can call the fail closure when the permissions are found
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods whenNone() methods can call the sucess closure when the permissions are none
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model action context methods whenNone() methods can ignore the success when the permissions are found and no fail has been provided
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secure() method can allow a secure() function if permissions pass
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secure() method can block a secure() call with a custom message
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secure() method can block a secure() call with invalid permissions
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureAll() method can allow a secureAll() function if all permissions pass
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureAll() method can block a secureAll() call with a custom message
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureAll() method can block a secureAll() call with invalid permissions
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureNone() method can allow a secureNone() function if all permissions are not found
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureNone() method can block a secureNone() call with a custom message
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureNone() method can block a secureNone() call with found permissions
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureSameUser() method can allow if the logged in user is the user passed
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureSameUser() method can secure if the logged in user is not the user passed
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureWhen() method can allow if a boolean false is passed
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureWhen() method can allow if a closure executes as false
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureWhen() method can secure if a boolean true is passed
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model blocking methods secureWhen() method can secure if a closure executes as true
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model can be created
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model can create random passwords
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via all() can verify false if the user has no permissions
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via all() can verify false if the user has one of many permission only
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via all() can verify true if the user has one permission
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via has() can verify false if the user has no permissions
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via has() can verify true if the user has one of many permission
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via has() can verify true if the user has one permission
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via none() can verify false if the user has a permission
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via none() can verify false if the user has one of many permission only
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via none() can verify true if the user doesn't have one permission
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via sameUser() can invalidate when passing a different user
tests.specs.unit.CBSecurityTest ‑ CBSecurity Model verification via sameUser() can validate when passing the same user
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests It can load many types of rules can load JSON Rules
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests It can load many types of rules can load XML Rules
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests It can load many types of rules can load model Rules
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests can configure with default settings
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests can configure with invalid settings and throw exceptions
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests can detect an invalid validator
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests can load a valid validator
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests does not enable invalid event handler processing on Coldbox versions 6+
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests enables invalid event handler processing on Coldbox versions prior to 6
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests module settings rule loading can load JSON Rules based on module settings
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests module settings rule loading can load XML Rules based on module settings
tests.specs.unit.SecurityTest ‑ Security Interceptor Unit Tests module settings rule loading can load model Rules based on module settings