Add further unit test coverage (kroxylicious#2936)

Signed-off-by: Robert Young <[email protected]>
Co-authored-by: Sam Barker <[email protected]>

Author: robobario

…sources/scenarios/FETCH/12/baseline.yaml …es/scenarios/FETCH/12/allowed-topic.yamlkroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/FETCH/12/baseline.yaml renamed to kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/FETCH/12/allowed-topic.yaml kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/FETCH/12/baseline.yaml renamed to kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/FETCH/12/allowed-topic.yaml

@@ -8,7 +8,7 @@
 metadata:
   apiKeys: "FETCH"
   apiVersion: 12
-  scenario: "baseline"
+  scenario: "all topics in request are allowed"
 given:
   mockedUpstreamResponses:
     - expectedRequestKey: "FETCH"

kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/FETCH/12/denied-and-allowed-topic.yaml

@@ -0,0 +1,139 @@
+#
+# Copyright Kroxylicious Authors.
+#
+# Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
+#
+
+---
+metadata:
+  apiKeys: "FETCH"
+  apiVersion: 12
+  scenario: |
+    request contains some allowed topics and some denied
+    allowed topics are forwarded upstream
+    denied topics are not forwarded upstream
+    denied topic errors are augmented into response to client
+given:
+  mockedUpstreamResponses:
+    - expectedRequestKey: "FETCH"
+      expectedRequestVersion: 12
+      expectedRequestHeader:
+        requestApiKey: 1
+        requestApiVersion: 12
+        correlationId: 1
+        clientId: "clientId"
+      expectedRequest:
+        replicaId: 66
+        maxWaitMs: 631
+        minBytes: 576
+        maxBytes: 658
+        isolationLevel: 5
+        sessionId: 267
+        sessionEpoch: 603
+        topics:
+          - topic: "my-topic"
+            partitions:
+              - partition: 549
+                currentLeaderEpoch: 609
+                fetchOffset: 402
+                lastFetchedEpoch: 645
+                logStartOffset: 742
+                partitionMaxBytes: 944
+        forgottenTopicsData:
+          - topic: "my-topic"
+            partitions:
+              - 563
+        rackId: "random-string-474"
+      upstreamResponseHeader:
+        correlationId: 1
+      upstreamResponse:
+        throttleTimeMs: 15
+        errorCode: 856
+        sessionId: 885
+        responses:
+          - topic: "my-topic"
+            partitions:
+              - partitionIndex: 647
+                errorCode: 575
+                highWatermark: 339
+                lastStableOffset: 551
+                logStartOffset: 596
+                abortedTransactions:
+                  - producerId: 287
+                    firstOffset: 914
+                preferredReadReplica: 22
+                records: !!binary ""
+  authorizerRules:
+    allowed:
+      - subject: "alice"
+        resourceName: "my-topic"
+        resourceClass: "TOPIC"
+        resourceType: "READ"
+  topicNames: null
+when:
+  subject: "alice"
+  requestHeader:
+    requestApiKey: 1
+    requestApiVersion: 12
+    correlationId: 1
+    clientId: "clientId"
+  request:
+    replicaId: 66
+    maxWaitMs: 631
+    minBytes: 576
+    maxBytes: 658
+    isolationLevel: 5
+    sessionId: 267
+    sessionEpoch: 603
+    topics:
+      - topic: "my-topic"
+        partitions:
+          - partition: 549
+            currentLeaderEpoch: 609
+            fetchOffset: 402
+            lastFetchedEpoch: 645
+            logStartOffset: 742
+            partitionMaxBytes: 944
+      - topic: "unauthorized"
+        partitions:
+          - partition: 549
+            currentLeaderEpoch: 609
+            fetchOffset: 402
+            lastFetchedEpoch: 645
+            logStartOffset: 742
+            partitionMaxBytes: 944
+    forgottenTopicsData:
+      - topic: "my-topic"
+        partitions:
+          - 563
+    rackId: "random-string-474"
+then:
+  expectedResponseHeader:
+    correlationId: 1
+  expectedResponse:
+    throttleTimeMs: 15
+    errorCode: 856
+    sessionId: 885
+    responses:
+      - topic: "my-topic"
+        partitions:
+          - partitionIndex: 647
+            errorCode: 575
+            highWatermark: 339
+            lastStableOffset: 551
+            logStartOffset: 596
+            abortedTransactions:
+              - producerId: 287
+                firstOffset: 914
+            preferredReadReplica: 22
+            records: !!binary ""
+      - topic: "unauthorized"
+        partitions:
+          - partitionIndex: 549
+            errorCode: 29
+            highWatermark: -1
+            lastStableOffset: -1
+            logStartOffset: -1
+            abortedTransactions: [ ]
+            preferredReadReplica: -1
+            records: !!binary ""

kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/FETCH/12/denied-topic.yaml

@@ -0,0 +1,67 @@
+#
+# Copyright Kroxylicious Authors.
+#
+# Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
+#
+
+---
+metadata:
+  apiKeys: "FETCH"
+  apiVersion: 12
+  scenario: "all topics in request are denied. filter short circuit responds with error"
+given:
+  mockedUpstreamResponses: []
+  authorizerRules:
+    allowed:
+      - subject: "alice"
+        resourceName: "my-topic"
+        resourceClass: "TOPIC"
+        resourceType: "READ"
+  topicNames: null
+when:
+  subject: "alice"
+  requestHeader:
+    requestApiKey: 1
+    requestApiVersion: 12
+    correlationId: 1
+    clientId: "clientId"
+  request:
+    replicaId: 66
+    maxWaitMs: 631
+    minBytes: 576
+    maxBytes: 658
+    isolationLevel: 5
+    sessionId: 267
+    sessionEpoch: 603
+    topics:
+      - topic: "unauthorized"
+        partitions:
+          - partition: 549
+            currentLeaderEpoch: 609
+            fetchOffset: 402
+            lastFetchedEpoch: 645
+            logStartOffset: 742
+            partitionMaxBytes: 944
+    forgottenTopicsData:
+      - topic: "my-topic"
+        partitions:
+          - 563
+    rackId: "random-string-474"
+then:
+  expectedResponseHeader:
+    correlationId: 1
+  expectedResponse:
+    throttleTimeMs: 0
+    errorCode: 0
+    sessionId: 0
+    responses:
+      - topic: "unauthorized"
+        partitions:
+          - partitionIndex: 549
+            errorCode: 29
+            highWatermark: -1
+            lastStableOffset: -1
+            logStartOffset: -1
+            abortedTransactions: [ ]
+            preferredReadReplica: -1
+            records: !!binary ""

kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/LIST_OFFSETS/10/denied-and-allowed-topic.yaml

@@ -0,0 +1,95 @@
+#
+# Copyright Kroxylicious Authors.
+#
+# Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
+#
+
+---
+metadata:
+  apiKeys: "LIST_OFFSETS"
+  apiVersion: 10
+  scenario: |
+    request contains denied and allowed topics
+    allowed topics are forwarded
+    denied topics are not forwarded
+    denied topic errors are augmented into response
+given:
+  mockedUpstreamResponses:
+    - expectedRequestKey: "LIST_OFFSETS"
+      expectedRequestVersion: 10
+      expectedRequestHeader:
+        requestApiKey: 2
+        requestApiVersion: 10
+        correlationId: 1
+        clientId: "clientId"
+      expectedRequest:
+        replicaId: 674
+        isolationLevel: 119
+        topics:
+          - name: "my-topic"
+            partitions:
+              - partitionIndex: 342
+                currentLeaderEpoch: 635
+                timestamp: 903
+        timeoutMs: 563
+      upstreamResponseHeader:
+        correlationId: 1
+      upstreamResponse:
+        throttleTimeMs: 803
+        topics:
+          - name: "my-topic"
+            partitions:
+              - partitionIndex: 955
+                errorCode: 272
+                timestamp: 535
+                offset: 322
+                leaderEpoch: 274
+  authorizerRules:
+    allowed:
+      - subject: "alice"
+        resourceName: "my-topic"
+        resourceClass: "TOPIC"
+        resourceType: "DESCRIBE"
+  topicNames: null
+when:
+  subject: "alice"
+  requestHeader:
+    requestApiKey: 2
+    requestApiVersion: 10
+    correlationId: 1
+    clientId: "clientId"
+  request:
+    replicaId: 674
+    isolationLevel: 119
+    topics:
+      - name: "my-topic"
+        partitions:
+          - partitionIndex: 342
+            currentLeaderEpoch: 635
+            timestamp: 903
+      - name: "unauthorized"
+        partitions:
+          - partitionIndex: 342
+            currentLeaderEpoch: 635
+            timestamp: 903
+    timeoutMs: 563
+then:
+  expectedResponseHeader:
+    correlationId: 1
+  expectedResponse:
+    throttleTimeMs: 803
+    topics:
+      - name: "my-topic"
+        partitions:
+          - partitionIndex: 955
+            errorCode: 272
+            timestamp: 535
+            offset: 322
+            leaderEpoch: 274
+      - name: "unauthorized"
+        partitions:
+          - partitionIndex: 342
+            errorCode: 29
+            timestamp: -1
+            offset: -1
+            leaderEpoch: -1

kroxylicious-filters/kroxylicious-authorization/src/test/resources/scenarios/LIST_OFFSETS/10/denied-topic.yaml

@@ -0,0 +1,50 @@
+#
+# Copyright Kroxylicious Authors.
+#
+# Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
+#
+
+---
+metadata:
+  apiKeys: "LIST_OFFSETS"
+  apiVersion: 10
+  scenario: "if all topics in request are denied we short circuit respond"
+given:
+  mockedUpstreamResponses: [ ]
+  authorizerRules:
+    allowed:
+      - subject: "alice"
+        resourceName: "my-topic"
+        resourceClass: "TOPIC"
+        resourceType: "DESCRIBE"
+  topicNames: null
+when:
+  subject: "alice"
+  requestHeader:
+    requestApiKey: 2
+    requestApiVersion: 10
+    correlationId: 1
+    clientId: "clientId"
+  request:
+    replicaId: 674
+    isolationLevel: 119
+    topics:
+      - name: "unauthorized"
+        partitions:
+          - partitionIndex: 342
+            currentLeaderEpoch: 635
+            timestamp: 903
+    timeoutMs: 563
+then:
+  expectedResponseHeader:
+    correlationId: 1
+  expectedResponse:
+    throttleTimeMs: 0
+    topics:
+      - name: "unauthorized"
+        partitions:
+          - partitionIndex: 342
+            errorCode: 29
+            timestamp: -1
+            offset: -1
+            leaderEpoch: -1