Use stream-filter instead of positional index for event assertions

Replace .get(0)/.get(1) index-based assertions in
DefaultSessionAuthenticationStrategyTests with the order-independent
stream-filter pattern already used in
ChangeSessionIdAuthenticationStrategyTests.

Signed-off-by: klouds27 <adalwolf@gmail.com>

Author: klouds27

web/src/test/java/org/springframework/security/web/session/DefaultSessionAuthenticationStrategyTests.java

@@ -16,6 +16,8 @@
 
 package org.springframework.security.web.session;
 
+import java.util.List;
+
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpSession;
 import org.junit.jupiter.api.Test;
@@ -75,14 +77,22 @@ public void newSessionIsCreatedIfSessionAlreadyExistsWithEventPublisher() {
 		assertThat(oldSessionId.equals(request.getSession().getId())).isFalse();
 		assertThat(request.getSession().getAttribute("blah")).isNotNull();
 		assertThat(request.getSession().getAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY")).isNotNull();
-		assertThat(eventArgumentCaptor.getAllValues().get(0)).isInstanceOf(SessionFixationProtectionEvent.class);
-		SessionFixationProtectionEvent fixationEvent = (SessionFixationProtectionEvent) eventArgumentCaptor.getAllValues()
-			.get(0);
+		List<ApplicationEvent> events = eventArgumentCaptor.getAllValues();
+		assertThat(events).hasAtLeastOneElementOfType(SessionFixationProtectionEvent.class);
+		SessionFixationProtectionEvent fixationEvent = events.stream()
+			.filter(SessionFixationProtectionEvent.class::isInstance)
+			.map(SessionFixationProtectionEvent.class::cast)
+			.findFirst()
+			.orElseThrow();
 		assertThat(fixationEvent.getOldSessionId()).isEqualTo(oldSessionId);
 		assertThat(fixationEvent.getNewSessionId()).isEqualTo(request.getSession().getId());
 		assertThat(fixationEvent.getAuthentication()).isSameAs(mockAuthentication);
-		assertThat(eventArgumentCaptor.getAllValues().get(1)).isInstanceOf(SessionIdChangedEvent.class);
-		SessionIdChangedEvent idChangedEvent = (SessionIdChangedEvent) eventArgumentCaptor.getAllValues().get(1);
+		assertThat(events).hasAtLeastOneElementOfType(SessionIdChangedEvent.class);
+		SessionIdChangedEvent idChangedEvent = events.stream()
+			.filter(SessionIdChangedEvent.class::isInstance)
+			.map(SessionIdChangedEvent.class::cast)
+			.findFirst()
+			.orElseThrow();
 		assertThat(idChangedEvent.getOldSessionId()).isEqualTo(oldSessionId);
 		assertThat(idChangedEvent.getNewSessionId()).isEqualTo(request.getSession().getId());
 	}
@@ -119,14 +129,22 @@ public void onlySavedRequestAttributeIsMigratedIfMigrateAttributesIsFalseWithEve
 		verify(eventPublisher, times(2)).publishEvent(eventArgumentCaptor.capture());
 		assertThat(request.getSession().getAttribute("blah")).isNull();
 		assertThat(request.getSession().getAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY")).isNotNull();
-		assertThat(eventArgumentCaptor.getAllValues().get(0)).isInstanceOf(SessionFixationProtectionEvent.class);
-		SessionFixationProtectionEvent fixationEvent = (SessionFixationProtectionEvent) eventArgumentCaptor.getAllValues()
-			.get(0);
+		List<ApplicationEvent> events = eventArgumentCaptor.getAllValues();
+		assertThat(events).hasAtLeastOneElementOfType(SessionFixationProtectionEvent.class);
+		SessionFixationProtectionEvent fixationEvent = events.stream()
+			.filter(SessionFixationProtectionEvent.class::isInstance)
+			.map(SessionFixationProtectionEvent.class::cast)
+			.findFirst()
+			.orElseThrow();
 		assertThat(fixationEvent.getOldSessionId()).isEqualTo(oldSessionId);
 		assertThat(fixationEvent.getNewSessionId()).isEqualTo(request.getSession().getId());
 		assertThat(fixationEvent.getAuthentication()).isSameAs(mockAuthentication);
-		assertThat(eventArgumentCaptor.getAllValues().get(1)).isInstanceOf(SessionIdChangedEvent.class);
-		SessionIdChangedEvent idChangedEvent = (SessionIdChangedEvent) eventArgumentCaptor.getAllValues().get(1);
+		assertThat(events).hasAtLeastOneElementOfType(SessionIdChangedEvent.class);
+		SessionIdChangedEvent idChangedEvent = events.stream()
+			.filter(SessionIdChangedEvent.class::isInstance)
+			.map(SessionIdChangedEvent.class::cast)
+			.findFirst()
+			.orElseThrow();
 		assertThat(idChangedEvent.getOldSessionId()).isEqualTo(oldSessionId);
 		assertThat(idChangedEvent.getNewSessionId()).isEqualTo(request.getSession().getId());
 	}