mn create-app --features=security-session,views-velocity,reactor,graalvm example.micronaut.micronautguide --build=maven --lang=kotlin --test=spock

package example.micronaut

import io.micronaut.http.annotation.Controller
import io.micronaut.http.annotation.Get
import io.micronaut.security.annotation.Secured
import io.micronaut.security.rules.SecurityRule
import io.micronaut.views.View

@Secured(SecurityRule.IS_ANONYMOUS) (1)
@Controller("/login") (2)
class LoginAuthController {

    @Get("/auth") (3)
    @View("auth") (4)
    fun auth(): Map<String, Any> = mutableMapOf()

    @Get("/authFailed") (5)
    @View("auth") (4)
    fun authFailed(): Map<String, Any> = mutableMapOf("errors" to true)
}

<dependency>
    <groupId>org.gebish</groupId>
    <artifactId>geb-spock</artifactId>
    <version>@geb-spockVersion@</version>
    <scope>test</scope>
</dependency>
<dependency>
    <groupId>org.seleniumhq.selenium</groupId>
    <artifactId>htmlunit-driver</artifactId>
    <version>@htmlunit-driverVersion@</version>
    <scope>test</scope>
</dependency>

package example.micronaut

import geb.Page

class HomePage extends Page {

    static url = '/'

    static at = { title == 'Home' }

    static content = {
        loginLink { $('a', text: 'Login') }
        logoutButton { $('input', type: 'submit', value: 'Logout') }
        usernameElement(required: false) { $('h1 span', 0) }
    }

    String username() {
        usernameElement.empty ? null : usernameElement.text()
    }

    void login() {
        loginLink.click()
    }

    void logout() {
        logoutButton.click()
    }
}

package example.micronaut

import geb.Page

class LoginPage extends Page {

    static url = '/login/auth'

    static at = { title.contains 'Login' }

    static content = {
        usernameInput { $('#username') }
        passwordInput { $('#password') }
        submitInput { $('input', type: 'submit') }
        errorsLi(required: false) { $('li#errors') }
    }

    boolean hasErrors() {
        !errorsLi.empty
    }

    void login(String username, String password) {
        usernameInput = username
        passwordInput = password
        submitInput.click()
    }
}

package example.micronaut

import geb.Page

class LoginFailedPage extends Page {

    static at = { title == 'Login Failed' }

    static url = '/login/authFailed'
}

package example.micronaut

import geb.spock.GebSpec
import io.micronaut.runtime.server.EmbeddedServer
import io.micronaut.test.extensions.spock.annotation.MicronautTest
import jakarta.inject.Inject

@MicronautTest (1)
class SessionAuthenticationSpec extends GebSpec {

    @Inject
    EmbeddedServer embeddedServer (2)

    def "verify session based authentication works"() {
        given:
        browser.baseUrl = "http://localhost:${embeddedServer.port}"

        when:
        to HomePage

        then:
        at HomePage

        when:
        HomePage homePage = browser.page HomePage

        then: 'As we are not logged in, there is no username'
        homePage.username() == null

        when: 'click the login link'
        homePage.login()

        then:
        at LoginPage

        when: 'fill the login form, with invalid credentials'
        LoginPage loginPage = browser.page LoginPage
        loginPage.login('foo', 'foo')

        then: 'the user is still in the login form'
        at LoginPage

        and: 'and error is displayed'
        loginPage.hasErrors()

        when: 'fill the form with wrong credentials'
        loginPage.login('sherlock', 'foo')

        then: 'we get redirected to the home page'
        at LoginFailedPage

        when: 'fill the form with valid credentials'
        loginPage.login('sherlock', 'password')

        then: 'we get redirected to the home page'
        at HomePage

        when:
        homePage = browser.page HomePage

        then: 'the username is populated'
        homePage.username() == 'sherlock'

        when: 'click the logout button'
        homePage.logout()

        then: 'we are in the home page'
        at HomePage

        when:
        homePage = browser.page HomePage

        then: 'but we are no longer logged in'
        homePage.username() == null
    }
}

./mvnw test