archiva/archiva-modules/archiva-web/archiva-security/src/test/java/org/apache/archiva/security/ArchivaServletAuthenticatorTest.java

package org.apache.archiva.security;

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

import org.apache.archiva.redback.authentication.AuthenticationException;
import org.apache.archiva.redback.authentication.AuthenticationResult;
import org.apache.archiva.redback.authorization.UnauthorizedException;
import org.apache.archiva.redback.system.DefaultSecuritySession;
import org.apache.archiva.redback.system.SecuritySession;
import org.apache.archiva.redback.users.User;
import org.apache.archiva.redback.users.UserManager;
import org.apache.archiva.security.common.ArchivaRoleConstants;
import org.junit.Before;
import org.junit.Test;

import javax.inject.Inject;
import javax.inject.Named;
import javax.servlet.http.HttpServletRequest;

import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

/**
 * ArchivaServletAuthenticatorTest
 */
public class ArchivaServletAuthenticatorTest
    extends AbstractSecurityTest
{
    @Inject
    @Named( value = "servletAuthenticator#test" )
    private ServletAuthenticator servletAuth;

    private HttpServletRequest request;

    @Before
    @Override
    public void setUp()
        throws Exception
    {
        super.setUp();

        request = mock( HttpServletRequest.class );

        setupRepository( "corporate" );
    }

    protected void assignRepositoryManagerRole( String principal, String repoId )
        throws Exception
    {
        roleManager.assignTemplatedRole( ArchivaRoleConstants.TEMPLATE_REPOSITORY_MANAGER, repoId, principal );
    }

    @Test
    public void testIsAuthenticatedUserExists()
        throws Exception
    {
        AuthenticationResult result = new AuthenticationResult( true, "user", null );
        boolean isAuthenticated = servletAuth.isAuthenticated( request, result );

        assertTrue( isAuthenticated );
    }

    @Test
    public void testIsAuthenticatedUserDoesNotExist()
        throws Exception
    {
        AuthenticationResult result = new AuthenticationResult( false, "non-existing-user", null );
        try
        {
            servletAuth.isAuthenticated( request, result );
            fail( "Authentication exception should have been thrown." );
        }
        catch ( AuthenticationException e )
        {
            assertEquals( "User Credentials Invalid", e.getMessage() );
        }
    }

    @Test
    public void testIsAuthorizedUserHasWriteAccess()
        throws Exception
    {
        createUser( USER_ALPACA, "Al 'Archiva' Paca" );

        assignRepositoryManagerRole( USER_ALPACA, "corporate" );

        UserManager userManager = securitySystem.getUserManager();
        User user = userManager.findUser( USER_ALPACA );

        AuthenticationResult result = new AuthenticationResult( true, USER_ALPACA, null );

        SecuritySession session = new DefaultSecuritySession( result, user );
        boolean isAuthorized =
            servletAuth.isAuthorized( request, session, "corporate", ArchivaRoleConstants.OPERATION_ADD_ARTIFACT );

        assertTrue( isAuthorized );

        restoreGuestInitialValues( USER_ALPACA );
    }

    @Test
    public void testIsAuthorizedUserHasNoWriteAccess()
        throws Exception
    {
        createUser( USER_ALPACA, "Al 'Archiva' Paca" );

        assignRepositoryObserverRole( USER_ALPACA, "corporate" );

        //httpServletRequestControl.expectAndReturn( request.getRemoteAddr(), "192.168.111.111" );
        when( request.getRemoteAddr() ).thenReturn( "192.168.111.111" );

        UserManager userManager = securitySystem.getUserManager();
        User user = userManager.findUser( USER_ALPACA );

        AuthenticationResult result = new AuthenticationResult( true, USER_ALPACA, null );

        SecuritySession session = new DefaultSecuritySession( result, user );

        try
        {
            servletAuth.isAuthorized( request, session, "corporate", ArchivaRoleConstants.OPERATION_ADD_ARTIFACT );
            fail( "UnauthorizedException should have been thrown." );
        }
        catch ( UnauthorizedException e )
        {
            assertEquals( "Access denied for repository corporate", e.getMessage() );
        }

        restoreGuestInitialValues( USER_ALPACA );
    }

    @Test
    public void testIsAuthorizedUserHasReadAccess()
        throws Exception
    {
        createUser( USER_ALPACA, "Al 'Archiva' Paca" );

        assignRepositoryObserverRole( USER_ALPACA, "corporate" );

        UserManager userManager = securitySystem.getUserManager();
        User user = userManager.findUser( USER_ALPACA );

        AuthenticationResult result = new AuthenticationResult( true, USER_ALPACA, null );

        SecuritySession session = new DefaultSecuritySession( result, user );
        boolean isAuthorized =
            servletAuth.isAuthorized( request, session, "corporate", ArchivaRoleConstants.OPERATION_READ_REPOSITORY );

        assertTrue( isAuthorized );

        restoreGuestInitialValues( USER_ALPACA );
    }

    @Test
    public void testIsAuthorizedUserHasNoReadAccess()
        throws Exception
    {
        createUser( USER_ALPACA, "Al 'Archiva' Paca" );

        UserManager userManager = securitySystem.getUserManager();
        User user = userManager.findUser( USER_ALPACA );

        AuthenticationResult result = new AuthenticationResult( true, USER_ALPACA, null );

        SecuritySession session = new DefaultSecuritySession( result, user );
        try
        {
            servletAuth.isAuthorized( request, session, "corporate", ArchivaRoleConstants.OPERATION_READ_REPOSITORY );
            fail( "UnauthorizedException should have been thrown." );
        }
        catch ( UnauthorizedException e )
        {
            assertEquals( "Access denied for repository corporate", e.getMessage() );
        }

        restoreGuestInitialValues( USER_ALPACA );
    }

    @Test
    public void testIsAuthorizedGuestUserHasWriteAccess()
        throws Exception
    {
        assignRepositoryManagerRole( USER_GUEST, "corporate" );
        boolean isAuthorized =
            servletAuth.isAuthorized( USER_GUEST, "corporate", ArchivaRoleConstants.OPERATION_ADD_ARTIFACT );

        assertTrue( isAuthorized );

        // cleanup previously add karma
        restoreGuestInitialValues(USER_GUEST);

    }

    @Test
    public void testIsAuthorizedGuestUserHasNoWriteAccess()
        throws Exception
    {
        assignRepositoryObserverRole( USER_GUEST, "corporate" );

        boolean isAuthorized =
            servletAuth.isAuthorized( USER_GUEST, "corporate", ArchivaRoleConstants.OPERATION_ADD_ARTIFACT );
        assertFalse( isAuthorized );

        // cleanup previously add karma
        restoreGuestInitialValues(USER_GUEST);

    }

    @Test
    public void testIsAuthorizedGuestUserHasReadAccess()
        throws Exception
    {
        assignRepositoryObserverRole( USER_GUEST, "corporate" );

        boolean isAuthorized =
            servletAuth.isAuthorized( USER_GUEST, "corporate", ArchivaRoleConstants.OPERATION_READ_REPOSITORY );

        assertTrue( isAuthorized );

        // cleanup previously add karma
        restoreGuestInitialValues(USER_GUEST);
    }

    @Test
    public void testIsAuthorizedGuestUserHasNoReadAccess()
        throws Exception
    {
        boolean isAuthorized =
            servletAuth.isAuthorized( USER_GUEST, "corporate", ArchivaRoleConstants.OPERATION_READ_REPOSITORY );

        assertFalse( isAuthorized );
    }

}