Testing Security

How can a test call POST /events as venue staff, when the booking API accepts only signed tokens and the test has no token server?

The way a test answers that question determines what it really proves. Spring Security's test support can place a ready-made user into a request, skipping sign-in completely. It can also build a token that looks decoded. Both are fast and convenient, and both skip some of the code that production runs. This lesson tests rule 4 and the ownership rule of GET /bookings/{id} three ways, and it shows exactly which code each way leaves untested.