SignatureFilter extends JsonSecurityRequestFilterBase { @Override protected Optional<ErrorResponse> filter(DiscFilterRequest request) { if ( request.getAttribute(SecurityContext.ATTRIBUTE_NAME) == null && request.getHeader("X-Authorization") != null) try { getSecurityContext(request).ifPresent(securityContext -> { request.setUserPrincipal(securityContext.principal()); request.setRemoteUser(securityContext.principal().getName()); request.setAttribute(SecurityContext.ATTRIBUTE_NAME, securityContext); }); } catch (Exception e) { logger.log(Level.FINE, () -> "Exception verifying signed request: " + Exceptions.toMessageString(e)); } return Optional.empty(); } @Inject  SignatureFilter(Controller controller);   }
@Test public void testFilter() { HttpRequest.Builder request = HttpRequest.newBuilder(URI.create("https: byte[] emptyBody = new byte[0]; verifySecurityContext(requestOf(request.copy().method("GET", HttpRequest.BodyPublishers.ofByteArray(emptyBody)).build(), emptyBody), null); verifySecurityContext(requestOf(signer.signed(request.copy(), Method.GET, InputStream::nullInputStream), emptyBody), null); applications.lockApplicationOrThrow(appId, application -> applications.store(application.withDeployKey(otherPublicKey))); verifySecurityContext(requestOf(signer.signed(request.copy(), Method.GET, InputStream::nullInputStream), emptyBody), null); applications.lockApplicationOrThrow(appId, application -> applications.store(application.withDeployKey(publicKey))); verifySecurityContext(requestOf(signer.signed(request.copy(), Method.GET, InputStream::nullInputStream), emptyBody), new SecurityContext(new SimplePrincipal("headless@my-tenant.my-app"), Set.of(Role.reader(id.tenant()), Role.headless(id.tenant(), id.application())))); byte[] hiBytes = new byte[]{0x48, 0x69}; verifySecurityContext(requestOf(signer.signed(request.copy(), Method.POST, () -> new ByteArrayInputStream(hiBytes)), hiBytes), new SecurityContext(new SimplePrincipal("headless@my-tenant.my-app"), Set.of(Role.reader(id.tenant()), Role.headless(id.tenant(), id.application())))); tester.curator().writeTenant(new CloudTenant(appId.tenant(), Optional.empty(), ImmutableBiMap.of(publicKey, () -> "user"))); verifySecurityContext(requestOf(signer.signed(request.copy(), Method.POST, () -> new ByteArrayInputStream(hiBytes)), hiBytes), new SecurityContext(new SimplePrincipal("user"), Set.of(Role.reader(id.tenant()), Role.developer(id.tenant())))); verifySecurityContext(requestOf(request.copy().method("GET", HttpRequest.BodyPublishers.ofByteArray(emptyBody)).build(), emptyBody), null); }