Test Spring resource ownership with MockMvc

• Use @WebMvcTest and MockMvc with Spring Security enabled.
• Mock the repository boundary, not the ownership decision.
• Use authenticated test users with stable subject names.
• Assert response status and body only where the caller is authorized.
• Keep missing-resource and forbidden behavior consistent with the documented API policy.

1. Create a query service that loads the order and compares its owner with the authenticated principal.
2. Import the real security configuration into the MVC slice.
3. Stub repository data for an owned order and for absence.
4. Exercise anonymous, owner, other-user, and missing paths.
5. Verify unauthorized paths do not disclose the resource body.

@org.springframework.stereotype.Service
class OrderQuery {
    private final OrderRepository orders;
    OrderQuery(OrderRepository orders) { this.orders = orders; }

    OrderView get(long id, org.springframework.security.core.Authentication caller) {
        var order = orders.findById(id).orElseThrow(OrderNotFound::new);
        if (!order.ownerUsername().equals(caller.getName())) {
            throw new org.springframework.security.access.AccessDeniedException("forbidden");
        }
        return new OrderView(order.id(), order.total());
    }
}

@org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest(OrderController.class)
@org.springframework.context.annotation.Import({SecurityConfig.class, OrderQuery.class})
class OrderOwnershipTest {
    @org.springframework.beans.factory.annotation.Autowired
    org.springframework.test.web.servlet.MockMvc mvc;
    @org.springframework.test.context.bean.override.mockito.MockitoBean
    OrderRepository orders;

    @org.junit.jupiter.api.Test void anonymous_is_unauthorized() throws Exception {
        mvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get("/orders/10"))
           .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.status().isUnauthorized());
    }

    @org.junit.jupiter.api.Test
    @org.springframework.security.test.context.support.WithMockUser(username = "alice")
    void owner_can_read() throws Exception {
        org.mockito.Mockito.when(orders.findById(10L))
            .thenReturn(java.util.Optional.of(new OrderRow(10, "alice", "12.00")));
        mvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get("/orders/10"))
           .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.status().isOk())
           .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath("$.id").value(10));
    }

    @org.junit.jupiter.api.Test
    @org.springframework.security.test.context.support.WithMockUser(username = "bob")
    void other_user_is_forbidden() throws Exception {
        org.mockito.Mockito.when(orders.findById(10L))
            .thenReturn(java.util.Optional.of(new OrderRow(10, "alice", "12.00")));
        mvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get("/orders/10"))
           .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.status().isForbidden());
    }

    @org.junit.jupiter.api.Test
    @org.springframework.security.test.context.support.WithMockUser(username = "alice")
    void missing_order_is_not_found() throws Exception {
        org.mockito.Mockito.when(orders.findById(99L))
            .thenReturn(java.util.Optional.empty());
        mvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get("/orders/99"))
           .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.status().isNotFound());
    }
}

Each request performs one indexed resource lookup and a constant-time ownership comparison. The test suite is constant-sized but deliberately covers each security outcome.

• A disabled user may authenticate differently depending on the real authentication provider and needs a wider integration test.
• Some APIs intentionally return 404 to non-owners to hide existence; tests must encode that policy consistently.
• Method security needs its configuration imported if ownership is enforced with annotations.
• CSRF affects state-changing requests, not this GET; a POST ownership test must include it when enabled.

• Remove Spring Security from the slice and verify the anonymous test would expose the mistake.
• Assert the non-owner path returns no order fields.
• Add a missing-resource test and verify the repository is called once.
• Verify the owner name comes from Authentication, not a request parameter.

• Mocking the query service to throw 403 proves controller mapping but not ownership enforcement.
• Calling the controller directly bypasses the filter chain and cannot prove 401 behavior.
• Trusting an owner ID supplied by the request creates an authorization vulnerability.
• Testing only the happy path leaves the object-level access rule unverified.