source.dussan.org Git - sonarqube.git/blob

   1 /*
   2  * SonarQube
   3  * Copyright (C) 2009-2020 SonarSource SA
   4  * mailto:info AT sonarsource DOT com
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 3 of the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public License
  17  * along with this program; if not, write to the Free Software Foundation,
  18  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  19  */
  20 package org.sonar.server.authentication.ws;
  21
  22 import java.io.PrintWriter;
  23 import java.io.StringWriter;
  24 import java.util.Optional;
  25 import javax.servlet.FilterChain;
  26 import javax.servlet.http.HttpServletRequest;
  27 import javax.servlet.http.HttpServletResponse;
  28 import org.junit.Before;
  29 import org.junit.Test;
  30 import org.sonar.api.config.internal.MapSettings;
  31 import org.sonar.api.server.ws.WebService;
  32 import org.sonar.server.authentication.BasicAuthentication;
  33 import org.sonar.server.authentication.JwtHttpHandler;
  34 import org.sonar.server.authentication.event.AuthenticationException;
  35 import org.sonar.server.ws.ServletFilterHandler;
  36 import org.sonar.test.JsonAssert;
  37 import org.sonarqube.ws.MediaTypes;
  38
  39 import static org.assertj.core.api.Assertions.assertThat;
  40 import static org.mockito.Mockito.doThrow;
  41 import static org.mockito.Mockito.mock;
  42 import static org.mockito.Mockito.verify;
  43 import static org.mockito.Mockito.when;
  44 import static org.sonar.db.user.UserTesting.newUserDto;
  45
  46 public class ValidateActionTest {
  47
  48   StringWriter stringWriter = new StringWriter();
  49
  50   HttpServletRequest request = mock(HttpServletRequest.class);
  51   HttpServletResponse response = mock(HttpServletResponse.class);
  52   FilterChain chain = mock(FilterChain.class);
  53
  54   BasicAuthentication basicAuthentication = mock(BasicAuthentication.class);
  55   JwtHttpHandler jwtHttpHandler = mock(JwtHttpHandler.class);
  56
  57   MapSettings settings = new MapSettings();
  58
  59   ValidateAction underTest = new ValidateAction(settings.asConfig(), basicAuthentication, jwtHttpHandler);
  60
  61   @Before
  62   public void setUp() throws Exception {
  63     PrintWriter writer = new PrintWriter(stringWriter);
  64     when(response.getWriter()).thenReturn(writer);
  65   }
  66
  67   @Test
  68   public void verify_definition() {
  69     String controllerKey = "foo";
  70     WebService.Context context = new WebService.Context();
  71     WebService.NewController newController = context.createController(controllerKey);
  72     underTest.define(newController);
  73     newController.done();
  74
  75     WebService.Action validate = context.controller(controllerKey).action("validate");
  76     assertThat(validate).isNotNull();
  77     assertThat(validate.handler()).isInstanceOf(ServletFilterHandler.class);
  78     assertThat(validate.responseExampleAsString()).isNotEmpty();
  79     assertThat(validate.params()).isEmpty();
  80   }
  81
  82   @Test
  83   public void return_true_when_jwt_token_is_set() throws Exception {
  84     when(jwtHttpHandler.validateToken(request, response)).thenReturn(Optional.of(newUserDto()));
  85     when(basicAuthentication.authenticate(request)).thenReturn(Optional.empty());
  86
  87     underTest.doFilter(request, response, chain);
  88
  89     verify(response).setContentType(MediaTypes.JSON);
  90     JsonAssert.assertJson(stringWriter.toString()).isSimilarTo("{\"valid\":true}");
  91   }
  92
  93   @Test
  94   public void return_true_when_basic_auth() throws Exception {
  95     when(jwtHttpHandler.validateToken(request, response)).thenReturn(Optional.empty());
  96     when(basicAuthentication.authenticate(request)).thenReturn(Optional.of(newUserDto()));
  97
  98     underTest.doFilter(request, response, chain);
  99
 100     verify(response).setContentType(MediaTypes.JSON);
 101     JsonAssert.assertJson(stringWriter.toString()).isSimilarTo("{\"valid\":true}");
 102   }
 103
 104   @Test
 105   public void return_true_when_no_jwt_nor_basic_auth_and_no_force_authentication() throws Exception {
 106     settings.setProperty("sonar.forceAuthentication", "false");
 107     when(jwtHttpHandler.validateToken(request, response)).thenReturn(Optional.empty());
 108     when(basicAuthentication.authenticate(request)).thenReturn(Optional.empty());
 109
 110     underTest.doFilter(request, response, chain);
 111
 112     verify(response).setContentType(MediaTypes.JSON);
 113     JsonAssert.assertJson(stringWriter.toString()).isSimilarTo("{\"valid\":true}");
 114   }
 115
 116   @Test
 117   public void return_false_when_no_jwt_nor_basic_auth_and_force_authentication_is_true() throws Exception {
 118     settings.setProperty("sonar.forceAuthentication", "true");
 119     when(jwtHttpHandler.validateToken(request, response)).thenReturn(Optional.empty());
 120     when(basicAuthentication.authenticate(request)).thenReturn(Optional.empty());
 121
 122     underTest.doFilter(request, response, chain);
 123
 124     verify(response).setContentType(MediaTypes.JSON);
 125     JsonAssert.assertJson(stringWriter.toString()).isSimilarTo("{\"valid\":false}");
 126   }
 127
 128   @Test
 129   public void return_false_when_jwt_throws_unauthorized_exception() throws Exception {
 130     doThrow(AuthenticationException.class).when(jwtHttpHandler).validateToken(request, response);
 131     when(basicAuthentication.authenticate(request)).thenReturn(Optional.empty());
 132
 133     underTest.doFilter(request, response, chain);
 134
 135     verify(response).setContentType(MediaTypes.JSON);
 136     JsonAssert.assertJson(stringWriter.toString()).isSimilarTo("{\"valid\":false}");
 137   }
 138
 139   @Test
 140   public void return_false_when_basic_authenticator_throws_unauthorized_exception() throws Exception {
 141     when(jwtHttpHandler.validateToken(request, response)).thenReturn(Optional.empty());
 142     doThrow(AuthenticationException.class).when(basicAuthentication).authenticate(request);
 143
 144     underTest.doFilter(request, response, chain);
 145
 146     verify(response).setContentType(MediaTypes.JSON);
 147     JsonAssert.assertJson(stringWriter.toString()).isSimilarTo("{\"valid\":false}");
 148   }
 149 }