1+ /*
2+ * CDDL HEADER START
3+ *
4+ * The contents of this file are subject to the terms of the
5+ * Common Development and Distribution License (the "License").
6+ * You may not use this file except in compliance with the License.
7+ *
8+ * See LICENSE.txt included in this distribution for the specific
9+ * language governing permissions and limitations under the License.
10+ *
11+ * When distributing Covered Code, include this CDDL HEADER in each
12+ * file and include the License file at LICENSE.txt.
13+ * If applicable, add the following below this CDDL HEADER, with the
14+ * fields enclosed by brackets "[]" replaced with your own identifying
15+ * information: Portions Copyright [yyyy] [name of copyright owner]
16+ *
17+ * CDDL HEADER END
18+ */
19+
20+ /*
21+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
22+ */
23+ package org .opengrok .web ;
24+
25+ import jakarta .servlet .FilterChain ;
26+ import jakarta .servlet .FilterConfig ;
27+ import jakarta .servlet .ServletException ;
28+ import jakarta .servlet .http .HttpServletRequest ;
29+ import jakarta .servlet .http .HttpServletResponse ;
30+ import org .junit .jupiter .api .Test ;
31+ import org .junit .jupiter .params .ParameterizedTest ;
32+ import org .junit .jupiter .params .provider .ValueSource ;
33+ import org .opengrok .indexer .configuration .Project ;
34+ import org .opengrok .indexer .configuration .RuntimeEnvironment ;
35+ import org .opengrok .indexer .web .DummyHttpServletRequest ;
36+ import org .opengrok .indexer .web .Prefix ;
37+ import org .opengrok .web .api .v1 .RestApp ;
38+
39+ import java .io .IOException ;
40+
41+ import static org .mockito .ArgumentMatchers .anyInt ;
42+ import static org .mockito .ArgumentMatchers .anyString ;
43+ import static org .mockito .Mockito .mock ;
44+ import static org .mockito .Mockito .never ;
45+ import static org .mockito .Mockito .verify ;
46+ import static org .mockito .Mockito .when ;
47+
48+ /**
49+ * Provides coverage for the {@link AuthorizationFilter} class.
50+ */
51+ class AuthorizationFilterTest {
52+ /**
53+ * Test that requests that start with API path are let through.
54+ */
55+ @ Test
56+ void testApiPath () throws ServletException , IOException {
57+ AuthorizationFilter filter = new AuthorizationFilter ();
58+ HttpServletRequest request = new DummyHttpServletRequest () {
59+ @ Override
60+ public String getServletPath () {
61+ return RestApp .API_PATH + "foo" ;
62+ }
63+ };
64+ HttpServletResponse response = mock (HttpServletResponse .class );
65+
66+ FilterChain chain = mock (FilterChain .class );
67+ // The init() method is currently empty, however it does not hurt to exercise it in case that changes.
68+ FilterConfig filterConfig = mock (FilterConfig .class );
69+ filter .init (filterConfig );
70+ filter .doFilter (request , response , chain );
71+
72+ verify (chain ).doFilter (request , response );
73+ verify (response , never ()).sendError (anyInt ());
74+ verify (response , never ()).sendError (anyInt (), anyString ());
75+ }
76+
77+ @ ParameterizedTest
78+ @ ValueSource (booleans = {true , false })
79+ void testIsAllowed (boolean isAllowed ) throws ServletException , IOException {
80+ AuthorizationFilter filter = new AuthorizationFilter ();
81+ PageConfig pageConfig = mock (PageConfig .class );
82+ Project project = mock (Project .class );
83+ when (pageConfig .getProject ()).thenReturn (project );
84+ when (pageConfig .isAllowed (project )).thenReturn (isAllowed );
85+ when (pageConfig .getEnv ()).thenReturn (RuntimeEnvironment .getInstance ());
86+ HttpServletRequest request = new DummyHttpServletRequest () {
87+ @ Override
88+ public String getServletPath () {
89+ return Prefix .DOWNLOAD_P .toString ();
90+ }
91+
92+ @ Override
93+ public String getRemoteUser () {
94+ return "user" ;
95+ }
96+
97+ @ Override
98+ public String getRequestURI () {
99+ return "URI" ;
100+ }
101+
102+ @ Override
103+ public Object getAttribute (String s ) {
104+ if (s .equals (PageConfig .ATTR_NAME )) {
105+ return pageConfig ;
106+ }
107+
108+ return "X" ;
109+ }
110+ };
111+ HttpServletResponse response = mock (HttpServletResponse .class );
112+
113+ FilterChain chain = mock (FilterChain .class );
114+ // The init() method is currently empty, however it does not hurt to exercise it in case that changes.
115+ FilterConfig filterConfig = mock (FilterConfig .class );
116+ filter .init (filterConfig );
117+ filter .doFilter (request , response , chain );
118+
119+ if (isAllowed ) {
120+ verify (chain ).doFilter (request , response );
121+ verify (response , never ()).sendError (anyInt ());
122+ verify (response , never ()).sendError (anyInt (), anyString ());
123+ } else {
124+ verify (chain , never ()).doFilter (request , response );
125+ verify (response ).sendError (HttpServletResponse .SC_FORBIDDEN , "Access forbidden" );
126+ }
127+ }
128+ }
0 commit comments