AuthResource { @POST @Path("/login") @ApiOperation(value = "Try to authenticate with credentials", response = AccountDTO.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful login"), @ApiResponse(code = 403, message = "Unsuccessful login"), @ApiResponse(code = 500, message = "Internal server error") }) @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) public Response login(@Context HttpServletRequest request, @Context HttpServletResponse response, @ApiParam(required = true, value = "Login request") LoginRequestDTO loginRequestDTO) throws EntityNotFoundException { String login = loginRequestDTO.getLogin(); String password = loginRequestDTO.getPassword(); Account account = accountManager.authenticateAccount(login, password); if (null != account && oAuthManager.isProvidedAccount(account)) { return Response.status(403).build(); } HttpSession session = request.getSession(); if (account != null && account.isEnabled()) { try { LOGGER.log(Level.INFO, "Authenticating response"); request.authenticate(response); } catch (IOException | ServletException e) { LOGGER.log(Level.WARNING, "Request.authenticate failed", e); return Response.status(Response.Status.FORBIDDEN).entity(e.getMessage()).build(); } UserGroupMapping userGroupMapping = accountManager.getUserGroupMapping(login); if (authConfig.isSessionEnabled()) { session.setAttribute("login", login); session.setAttribute("groups", userGroupMapping.getGroupName()); } AccountDTO accountDTO = mapper.map(account, AccountDTO.class); accountDTO.setAdmin(UserGroupMapping.ADMIN_ROLE_ID.equals(userGroupMapping.getGroupName())); Response.ResponseBuilder responseBuilder = Response.ok().entity(accountDTO); if (authConfig.isJwtEnabled()) { responseBuilder.header("jwt", JWTokenFactory.createAuthToken(authConfig.getJWTKey(), userGroupMapping)); } return responseBuilder.build(); } else { if (authConfig.isSessionEnabled()) { session.invalidate(); } return Response.status(Response.Status.FORBIDDEN).build(); } } AuthResource(); @PostConstruct void init(); @POST @Path("/login") @ApiOperation(value = "Try to authenticate with credentials", response = AccountDTO.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful login"), @ApiResponse(code = 403, message = "Unsuccessful login"), @ApiResponse(code = 500, message = "Internal server error") }) @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) Response login(@Context HttpServletRequest request, @Context HttpServletResponse response,
            @ApiParam(required = true, value = "Login request") LoginRequestDTO loginRequestDTO); @POST @Path("/recovery") @ApiOperation(value = "Send password recovery request", response = Response.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 204, message = "Successful request"), @ApiResponse(code = 403, message = "Forbidden"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) Response sendPasswordRecovery(
            @ApiParam(required = true, value = "Password recovery request") PasswordRecoveryRequestDTO passwordRecoveryRequestDTO); @POST @Path("/recover") @ApiOperation(value = "Recover account password", response = Response.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 204, message = "Successful recover request"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) Response sendPasswordRecover(
            @ApiParam(required = true, value = "Password recovery process") PasswordRecoverDTO passwordRecoverDTO); @GET @Path("/logout") @ApiOperation(value = "Log out connected user", response = Response.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 204, message = "Successful logout"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) Response logout(@Context HttpServletRequest request); @GET @Path("/providers") @ApiOperation(value = "Get registered OAuth providers", response = OAuthProviderPublicDTO.class, responseContainer = "List", authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of providers. It can be an empty list."), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) Response getProviders(); @GET @Path("/providers/{id}") @ApiOperation(value = "Get OAuth provider details", response = OAuthProviderPublicDTO.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of provider."), @ApiResponse(code = 404, message = "Provider not found"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) OAuthProviderPublicDTO getProvider(
            @ApiParam(required = true, value = "Provider id") @PathParam("id") Integer providerId); @POST @Path("/oauth") @ApiOperation(value = "Try to authenticate with OAuth", response = AccountDTO.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful login"), @ApiResponse(code = 403, message = "Unsuccessful login"), @ApiResponse(code = 500, message = "Internal server error") }) @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) Response oAuthLogin(@Context HttpServletRequest request, @Context HttpServletResponse response,
            @ApiParam(required = true, value = "OAuth login request") OAuthLoginRequestDTO oAuthLoginRequestDTO);  }
@Test public void loginTest() throws EntityNotFoundException, IOException, ServletException { Mockito.when(loginDTO.getLogin()).thenReturn("login"); Mockito.when(loginDTO.getPassword()).thenReturn("root"); Mockito.when(accountManager.authenticateAccount(loginDTO.getLogin(), loginDTO.getPassword())) .thenReturn(account); Mockito.when(request.getSession()).thenReturn(session); Mockito.when(oAuthManager.isProvidedAccount(account)).thenReturn(true); Response res = resource.login(request, response, loginDTO); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus()); Mockito.when(oAuthManager.isProvidedAccount(account)).thenReturn(false); Mockito.when(account.isEnabled()).thenReturn(false); Mockito.when(authConfig.isSessionEnabled()).thenReturn(true); res = resource.login(request, response, loginDTO); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus()); Mockito.when(oAuthManager.isProvidedAccount(account)).thenReturn(false); Mockito.when(account.isEnabled()).thenReturn(true); Mockito.when(accountManager.getUserGroupMapping(loginDTO.getLogin())).thenReturn(userGroupMapping); Mockito.when(userGroupMapping.getGroupName()).thenReturn(UserGroupMapping.ADMIN_ROLE_ID); Mockito.when(authConfig.isSessionEnabled()).thenReturn(true); res = resource.login(request, response, loginDTO); Object entity = res.getEntity(); Assert.assertEquals(Response.Status.OK.getStatusCode(), res.getStatus()); Assert.assertTrue(entity.getClass().isAssignableFrom(AccountDTO.class)); Assert.assertEquals(loginDTO.getLogin(), ((AccountDTO) entity).getLogin()); Assert.assertTrue(((AccountDTO) entity).isAdmin()); Mockito.when(userGroupMapping.getGroupName()).thenReturn(UserGroupMapping.REGULAR_USER_ROLE_ID); res = resource.login(request, response, loginDTO); entity = res.getEntity(); Assert.assertEquals(Response.Status.OK.getStatusCode(), res.getStatus()); Assert.assertTrue(entity.getClass().isAssignableFrom(AccountDTO.class)); Assert.assertEquals(loginDTO.getLogin(), ((AccountDTO) entity).getLogin()); Assert.assertFalse(((AccountDTO) entity).isAdmin()); Mockito.when(userGroupMapping.getGroupName()).thenReturn(UserGroupMapping.GUEST_ROLE_ID); res = resource.login(request, response, loginDTO); entity = res.getEntity(); Assert.assertEquals(Response.Status.OK.getStatusCode(), res.getStatus()); Assert.assertTrue(entity.getClass().isAssignableFrom(AccountDTO.class)); Assert.assertEquals(loginDTO.getLogin(), ((AccountDTO) entity).getLogin()); Assert.assertFalse(((AccountDTO) entity).isAdmin()); Mockito.when(request.authenticate(response)).thenThrow(new IOException()); res = resource.login(request, response, loginDTO); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus()); }