Make UnauthorizedHandler overridable

Two related changes here:
- Change from always throwing WebApplicationException when a user fails
to authenticate to throwing the result of the buildException method on
the unauthorized handler. This matches the pattern used in the built-in
BasicCredentialAuthFilter and OAuthCredentialAuthFilter.

- Add a `withUnauthorizedHandler` method to the bundle to set your own
UnauthorizedHandler. This gives you the ability to change the response
and exception thrown when a user fails to authenticate. For example, you
can redirect to a login page if you're building a browser application.

Author: adamhoward

src/main/java/org/dhatim/dropwizard/jwt/cookie/authentication/JwtCookieAuthBundle.java

@@ -24,6 +24,8 @@
 import io.dropwizard.auth.AuthFilter;
 import io.dropwizard.auth.AuthValueFactoryProvider;
 import io.dropwizard.auth.Authorizer;
+import io.dropwizard.auth.DefaultUnauthorizedHandler;
+import io.dropwizard.auth.UnauthorizedHandler;
 import io.dropwizard.jersey.setup.JerseyEnvironment;
 import io.dropwizard.setup.Bootstrap;
 import io.dropwizard.setup.Environment;
@@ -59,6 +61,7 @@ public class JwtCookieAuthBundle<C extends Configuration, P extends JwtCookiePri
     private final Function<Claims, P> deserializer;
     private Function<C, JwtCookieAuthConfiguration> configurationSupplier;
     private BiFunction<C, Environment, Key> keySuppplier;
+    private UnauthorizedHandler unauthorizedHandler;
 
     /**
      * Get a bundle instance that will use DefaultJwtCookiePrincipal
@@ -85,6 +88,7 @@ public JwtCookieAuthBundle(Class<P> principalType, Function<P, Claims> serialize
         this.serializer = serializer;
         this.deserializer = deserializer;
         this.configurationSupplier = c -> new JwtCookieAuthConfiguration();
+        this.unauthorizedHandler = new DefaultUnauthorizedHandler();
     }
 
     /**
@@ -109,6 +113,17 @@ public JwtCookieAuthBundle<C, P> withConfigurationSupplier(Function<C, JwtCookie
         return this;
     }
 
+    /**
+     * If you want to use a different unauthorized handler, specify it here
+     *
+     * @param unauthorizedHandler an UnauthorizedHandler that will be used whenever a request fails to authenticate
+     * @return this
+     */
+    public JwtCookieAuthBundle<C, P> withUnauthorizedHandler(UnauthorizedHandler unauthorizedHandler) {
+        this.unauthorizedHandler = unauthorizedHandler;
+        return this;
+    }
+
 
     @Override
     public void initialize(Bootstrap<?> bootstrap) {
@@ -147,6 +162,7 @@ public AuthFilter<String, P> getAuthRequestFilter(Key key, String cookieName) {
                 .setAuthenticator(new JwtCookiePrincipalAuthenticator(key, deserializer))
                 .setPrefix(JWT_COOKIE_PREFIX)
                 .setAuthorizer((Authorizer<P>) (P::isInRole))
+                .setUnauthorizedHandler(unauthorizedHandler)
                 .buildAuthFilter();
     }
 

src/main/java/org/dhatim/dropwizard/jwt/cookie/authentication/JwtCookieAuthRequestFilter.java

@@ -23,7 +23,6 @@
 import javax.annotation.Priority;
 import javax.ws.rs.InternalServerErrorException;
 import javax.ws.rs.Priorities;
-import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.Cookie;
 
@@ -54,7 +53,7 @@ public void filter(ContainerRequestContext crc) throws IOException {
                 }
             }
         }
-        throw new WebApplicationException(unauthorizedHandler.buildResponse(prefix, realm));
+        throw unauthorizedHandler.buildException(prefix, realm);
     }
 
     public static class Builder<P extends JwtCookiePrincipal> extends AuthFilterBuilder<String, P, JwtCookieAuthRequestFilter<P>> {