Merged 2.0.0-m3 into feature/global_config_v2_endpoint

scm-webapp/src/test/java/sonia/scm/api/v2/resources/AuthenticationResourceTest.java

@@ -0,0 +1,232 @@
+package sonia.scm.api.v2.resources;
+
+import com.github.sdorra.shiro.ShiroRule;
+import com.github.sdorra.shiro.SubjectAware;
+import org.jboss.resteasy.core.Dispatcher;
+import org.jboss.resteasy.mock.MockDispatcherFactory;
+import org.jboss.resteasy.mock.MockHttpRequest;
+import org.jboss.resteasy.mock.MockHttpResponse;
+import org.jboss.resteasy.spi.ResteasyProviderFactory;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+import sonia.scm.config.ScmConfiguration;
+import sonia.scm.security.AccessToken;
+import sonia.scm.security.AccessTokenBuilder;
+import sonia.scm.security.AccessTokenBuilderFactory;
+import sonia.scm.security.AccessTokenCookieIssuer;
+import sonia.scm.user.User;
+import sonia.scm.user.UserException;
+import sonia.scm.user.UserManager;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Date;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.eq;
+import static org.mockito.Mockito.*;
+
+@SubjectAware(
+  configuration = "classpath:sonia/scm/repository/shiro.ini"
+)
+@RunWith(MockitoJUnitRunner.class)
+public class AuthenticationResourceTest {
+
+  @Rule
+  public ShiroRule shiro = new ShiroRule();
+
+  private Dispatcher dispatcher = MockDispatcherFactory.createDispatcher();
+
+  @Mock
+  private AccessTokenBuilderFactory accessTokenBuilderFactory;
+
+  @Mock
+  private AccessTokenBuilder accessTokenBuilder;
+
+  private AccessTokenCookieIssuer cookieIssuer = new AccessTokenCookieIssuer(mock(ScmConfiguration.class));
+
+  private static final String AUTH_JSON_TRILLIAN = "{\n" +
+    "\t\"cookie\": true,\n" +
+    "\t\"grant_type\": \"password\",\n" +
+    "\t\"username\": \"trillian\",\n" +
+    "\t\"password\": \"secret\"\n" +
+    "}";
+
+  private static final String AUTH_FORMENCODED_TRILLIAN = "cookie=true&grant_type=password&username=trillian&password=secret";
+
+  private static final String AUTH_JSON_TRILLIAN_WRONG_PW = "{\n" +
+    "\t\"cookie\": true,\n" +
+    "\t\"grant_type\": \"password\",\n" +
+    "\t\"username\": \"trillian\",\n" +
+    "\t\"password\": \"justWrong\"\n" +
+    "}";
+
+  private static final String AUTH_JSON_NOT_EXISTING_USER = "{\n" +
+    "\t\"cookie\": true,\n" +
+    "\t\"grant_type\": \"password\",\n" +
+    "\t\"username\": \"iDoNotExist\",\n" +
+    "\t\"password\": \"doesNotMatter\"\n" +
+    "}";
+
+  private static final String AUTH_JSON_WITHOUT_USERNAME = String.join("\n",
+    "{",
+    "\"grant_type\": \"password\",",
+    "\"password\": \"tricia123\"",
+    "}"
+  );
+
+  private static final String AUTH_JSON_WITHOUT_PASSWORD = String.join("\n",
+    "{",
+    "\"grant_type\": \"password\",",
+    "\"username\": \"trillian\"",
+    "}"
+  );
+
+  private static final String AUTH_JSON_WITHOUT_GRANT_TYPE = String.join("\n",
+    "{",
+    "\"username\": \"trillian\",",
+    "\"password\": \"tricia123\"",
+    "}"
+  );
+
+  private static final String AUTH_JSON_WITH_INVALID_GRANT_TYPE = String.join("\n",
+    "{",
+    "\"grant_type\": \"el speciale\",",
+    "\"username\": \"trillian\",",
+    "\"password\": \"tricia123\"",
+    "}"
+  );
+
+  @Before
+  public void prepareEnvironment() {
+    AuthenticationResource authenticationResource = new AuthenticationResource(accessTokenBuilderFactory, cookieIssuer);
+    dispatcher.getRegistry().addSingletonResource(authenticationResource);
+
+    AccessToken accessToken = mock(AccessToken.class);
+    when(accessToken.getExpiration()).thenReturn(new Date(Long.MAX_VALUE));
+    when(accessTokenBuilder.build()).thenReturn(accessToken);
+
+    when(accessTokenBuilderFactory.create()).thenReturn(accessTokenBuilder);
+
+    HttpServletRequest servletRequest = mock(HttpServletRequest.class);
+    ResteasyProviderFactory.getContextDataMap().put(HttpServletRequest.class, servletRequest);
+
+    HttpServletResponse servletResponse = mock(HttpServletResponse.class);
+    ResteasyProviderFactory.getContextDataMap().put(HttpServletResponse.class, servletResponse);
+  }
+
+  @Test
+  public void shouldAuthCorrectly() throws URISyntaxException {
+
+    MockHttpRequest request = getMockHttpRequest(AUTH_JSON_TRILLIAN);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_NO_CONTENT, response.getStatus());
+  }
+
+  @Test
+  public void shouldAuthCorrectlyWithFormencodedData() throws URISyntaxException {
+
+    MockHttpRequest request = getMockHttpRequestUrlEncoded(AUTH_FORMENCODED_TRILLIAN);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_NO_CONTENT, response.getStatus());
+  }
+
+
+  @Test
+  public void shouldNotAuthUserWithWrongPassword() throws URISyntaxException {
+
+    MockHttpRequest request = getMockHttpRequest(AUTH_JSON_TRILLIAN_WRONG_PW);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_UNAUTHORIZED, response.getStatus());
+  }
+
+  @Test
+  public void shouldNotAuthNonexistingUser() throws URISyntaxException {
+    MockHttpRequest request = getMockHttpRequest(AUTH_JSON_NOT_EXISTING_USER);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_UNAUTHORIZED, response.getStatus());
+  }
+
+  @Test
+  public void shouldReturnBadStatusIfPasswordParameterIsMissing() throws URISyntaxException {
+    shouldReturnBadRequest(AUTH_JSON_WITHOUT_USERNAME);
+  }
+
+  @Test
+  public void shouldReturnBadStatusIfUsernameParameterIsMissing() throws URISyntaxException {
+    shouldReturnBadRequest(AUTH_JSON_WITHOUT_PASSWORD);
+  }
+
+  @Test
+  public void shouldReturnBadStatusIfGrantTypeParameterIsMissing() throws URISyntaxException {
+    shouldReturnBadRequest(AUTH_JSON_WITHOUT_GRANT_TYPE);
+  }
+
+  @Test
+  public void shouldReturnBadStatusIfGrantTypeParameterIsInvalid() throws URISyntaxException {
+    shouldReturnBadRequest(AUTH_JSON_WITH_INVALID_GRANT_TYPE);
+  }
+
+  @Test
+  @SubjectAware(username = "trillian", password = "secret")
+  public void shouldSuccessfullyLogoutUser() throws URISyntaxException {
+    MockHttpRequest request = MockHttpRequest.delete("/" + AuthenticationResource.PATH + "/access_token");
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+    assertEquals(HttpServletResponse.SC_NO_CONTENT, response.getStatus());
+  }
+
+
+  private void shouldReturnBadRequest(String requestBody) throws URISyntaxException {
+    MockHttpRequest request = getMockHttpRequest(requestBody);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_BAD_REQUEST, response.getStatus());
+  }
+
+  private MockHttpRequest getMockHttpRequest(String jsonPayload) throws URISyntaxException {
+    MockHttpRequest request = MockHttpRequest.post("/" + AuthenticationResource.PATH + "/access_token");
+
+    request.content(jsonPayload.getBytes());
+    request.contentType(MediaType.APPLICATION_JSON_TYPE);
+    return request;
+  }
+
+  private MockHttpRequest getMockHttpRequestUrlEncoded(String payload) throws URISyntaxException {
+    MockHttpRequest request = MockHttpRequest.post("/" + AuthenticationResource.PATH + "/access_token");
+
+    request.content(payload.getBytes());
+    request.contentType(MediaType.APPLICATION_FORM_URLENCODED_TYPE);
+    return request;
+  }
+
+}

scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeResourceTest.java

@@ -0,0 +1,104 @@
+package sonia.scm.api.v2.resources;
+
+import com.github.sdorra.shiro.ShiroRule;
+import com.github.sdorra.shiro.SubjectAware;
+import com.google.common.io.Resources;
+import org.apache.shiro.authc.credential.PasswordService;
+import org.apache.shiro.subject.PrincipalCollection;
+import org.apache.shiro.subject.Subject;
+import org.jboss.resteasy.core.Dispatcher;
+import org.jboss.resteasy.mock.MockDispatcherFactory;
+import org.jboss.resteasy.mock.MockHttpRequest;
+import org.jboss.resteasy.mock.MockHttpResponse;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import sonia.scm.PageResult;
+import sonia.scm.user.User;
+import sonia.scm.user.UserException;
+import sonia.scm.user.UserManager;
+import sonia.scm.web.VndMediaType;
+
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+
+import static java.util.Collections.singletonList;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.eq;
+import static org.mockito.Mockito.*;
+import static org.mockito.MockitoAnnotations.initMocks;
+
+@SubjectAware(
+  configuration = "classpath:sonia/scm/repository/shiro.ini"
+)
+public class MeResourceTest {
+
+  @Rule
+  public ShiroRule shiro = new ShiroRule();
+
+  private Dispatcher dispatcher = MockDispatcherFactory.createDispatcher();
+
+
+  private final ResourceLinks resourceLinks = ResourceLinksMock.createMock(URI.create("/"));
+  @Mock
+  private UriInfo uriInfo;
+  @Mock
+  private UriInfoStore uriInfoStore;
+
+  @Mock
+  private UserManager userManager;
+
+  @InjectMocks
+  private UserToUserDtoMapperImpl userToDtoMapper;
+
+  private ArgumentCaptor<User> userCaptor = ArgumentCaptor.forClass(User.class);
+
+  @Before
+  public void prepareEnvironment() throws IOException, UserException {
+    initMocks(this);
+    createDummyUser("trillian");
+    when(userManager.create(userCaptor.capture())).thenAnswer(invocation -> invocation.getArguments()[0]);
+    doNothing().when(userManager).modify(userCaptor.capture());
+    doNothing().when(userManager).delete(userCaptor.capture());
+    userToDtoMapper.setResourceLinks(resourceLinks);
+    MeResource meResource = new MeResource(userToDtoMapper, userManager);
+    dispatcher.getRegistry().addSingletonResource(meResource);
+    when(uriInfo.getBaseUri()).thenReturn(URI.create("/"));
+    when(uriInfoStore.get()).thenReturn(uriInfo);
+  }
+
+  @Test
+  @SubjectAware(username = "trillian", password = "secret")
+  public void shouldReturnCurrentlyAuthenticatedUser() throws URISyntaxException {
+    MockHttpRequest request = MockHttpRequest.get("/" + MeResource.ME_PATH_V2);
+    request.accept(VndMediaType.USER);
+    MockHttpResponse response = new MockHttpResponse();
+
+    dispatcher.invoke(request, response);
+
+    assertEquals(HttpServletResponse.SC_OK, response.getStatus());
+    assertTrue(response.getContentAsString().contains("\"name\":\"trillian\""));
+    assertTrue(response.getContentAsString().contains("\"password\":\"__dummypassword__\""));
+    assertTrue(response.getContentAsString().contains("\"self\":{\"href\":\"/v2/users/trillian\"}"));
+    assertTrue(response.getContentAsString().contains("\"delete\":{\"href\":\"/v2/users/trillian\"}"));
+  }
+
+  private User createDummyUser(String name) {
+    User user = new User();
+    user.setName(name);
+    user.setPassword("secret");
+    user.setCreationDate(System.currentTimeMillis());
+    when(userManager.get(name)).thenReturn(user);
+    return user;
+  }
+}

scm-webapp/src/test/java/sonia/scm/filter/SecurityFilterTest.java

@@ -100,14 +100,29 @@ public class SecurityFilterTest {
   }
   
   /**
-   * Tests filter on authentication endpoint.
-   * 
+   * Tests filter on authentication endpoint v1.
+   *
    * @throws IOException
    * @throws ServletException 
    */
   @Test
-  public void testDoOnAuthenticationUrl() throws IOException, ServletException {
-    when(request.getRequestURI()).thenReturn("/scm/api/rest/authentication");
+  public void testDoOnAuthenticationUrlV1() throws IOException, ServletException {
+    checkIfAuthenticationUrlIsPassedThrough("/scm/api/rest/auth/access_token");
+  }
+
+  /**
+   * Tests filter on authentication endpoint v2.
+   *
+   * @throws IOException
+   * @throws ServletException
+   */
+  @Test
+  public void testDoOnAuthenticationUrlV2() throws IOException, ServletException {
+    checkIfAuthenticationUrlIsPassedThrough("/scm/api/rest/v2/auth/access_token");
+  }
+
+  private void checkIfAuthenticationUrlIsPassedThrough(String uri) throws IOException, ServletException {
+    when(request.getRequestURI()).thenReturn(uri);
     securityFilter.doFilter(request, response, chain);
     verify(request, never()).setAttribute(Mockito.anyString(), Mockito.any());
     verify(chain).doFilter(request, response);
@@ -235,4 +250,4 @@ public class SecurityFilterTest {
     
   }
 
-}
+}

scm-webapp/src/test/java/sonia/scm/security/SecurityRequestsTest.java

@@ -0,0 +1,37 @@
+package sonia.scm.security;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+
+import javax.servlet.http.HttpServletRequest;
+
+import static org.junit.Assert.*;
+import static org.mockito.Mockito.when;
+
+/**
+ * Created by masuewer on 04.07.18.
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class SecurityRequestsTest {
+
+  @Mock
+  private HttpServletRequest request;
+
+  @Test
+  public void testIsAuthenticationRequestWithContextPath() {
+    when(request.getRequestURI()).thenReturn("/scm/api/rest/auth/access_token");
+    when(request.getContextPath()).thenReturn("/scm");
+
+    assertTrue(SecurityRequests.isAuthenticationRequest(request));
+  }
+
+  @Test
+  public void testIsAuthenticationRequest() throws Exception {
+    assertTrue(SecurityRequests.isAuthenticationRequest("/api/rest/auth/access_token"));
+    assertTrue(SecurityRequests.isAuthenticationRequest("/api/rest/v2/auth/access_token"));
+    assertFalse(SecurityRequests.isAuthenticationRequest("/api/rest/repositories"));
+    assertFalse(SecurityRequests.isAuthenticationRequest("/api/rest/v2/repositories"));
+  }
+}