### Question:
SecurityFilter implements Filter { @Override public void doFilter( ServletRequest request, ServletResponse response, FilterChain chain ) throws IOException, ServletException { validateRequestType( request ); validateResponseType( response ); HttpServletRequest httpReq = (HttpServletRequest) request; String path = httpReq.getContextPath() + (httpReq.getPathInfo() == null ? "" : httpReq.getPathInfo()); boolean requestIsForbidden = false; for ( UriPathWildcardMatcher uriPathWildcardMatcher : rules.keySet() ) { if ( uriPathWildcardMatcher.matches( path ) ) { HashSet<ForbiddingSecurityRule> securityRules = rules.get( uriPathWildcardMatcher ); for ( ForbiddingSecurityRule securityRule : securityRules ) { if ( !securityRule.isAuthorized( httpReq ) ) { createUnauthorizedChallenge( response, securityRule ); return; } requestIsForbidden |= securityRule.isForbidden( httpReq ); } } } if ( requestIsForbidden ) { createForbiddenResponse( response ); return; } chain.doFilter( request, response ); } SecurityFilter( SecurityRule rule, SecurityRule... rules );  SecurityFilter( Iterable<SecurityRule> securityRules ); static String basicAuthenticationResponse( String realm ); @Override void init( FilterConfig filterConfig ); @Override void doFilter( ServletRequest request, ServletResponse response, FilterChain chain ); @Override synchronized void destroy();  }### Answer:
@Test public void shouldPassThroughRequestToAnUnsecuredPath() throws Exception { SecurityRule rule = mock( SecurityRule.class ); when( rule.forUriPath() ).thenReturn( "/some-path" ); FilterChain filterChain = mock( FilterChain.class ); SecurityFilter securityFilter = new SecurityFilter( rule ); HttpServletRequest request = mock( HttpServletRequest.class ); when( request.getContextPath() ).thenReturn( "/some-other-path" ); securityFilter.doFilter( request, mock( HttpServletResponse.class ), filterChain ); verify( filterChain ).doFilter( any( HttpServletRequest.class ), any( HttpServletResponse.class ) ); }
@Test public void shouldActivateRuleThatRejectsTheRequestForAMatchingPath() throws Exception { SecurityRule rule = mock( SecurityRule.class ); when( rule.forUriPath() ).thenReturn( "/some-path" ); when( rule.isAuthorized( any( HttpServletRequest.class ) ) ).thenReturn( false ); FilterChain filterChain = mock( FilterChain.class ); SecurityFilter securityFilter = new SecurityFilter( rule ); HttpServletRequest request = mock( HttpServletRequest.class ); when( request.getContextPath() ).thenReturn( "/some-path" ); securityFilter.doFilter( request, mock( HttpServletResponse.class ), filterChain ); verify( filterChain, never() ).doFilter( any( HttpServletRequest.class ), any( HttpServletResponse.class ) ); }
@Test public void shouldActivateRuleThatAcceptsTheRequestForAMatchingPath() throws Exception { SecurityRule rule = mock( SecurityRule.class ); when( rule.forUriPath() ).thenReturn( "/some-path" ); when( rule.isAuthorized( any( HttpServletRequest.class ) ) ).thenReturn( true ); FilterChain filterChain = mock( FilterChain.class ); SecurityFilter securityFilter = new SecurityFilter( rule ); HttpServletRequest request = mock( HttpServletRequest.class ); when( request.getContextPath() ).thenReturn( "/some-path" ); HttpServletResponse response = mock( HttpServletResponse.class ); securityFilter.doFilter( request, response, filterChain ); verify( filterChain ).doFilter( request, response ); }