AdminServiceAuthenticationFilter implements Filter { @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException { if (bizConfig.isAdminServiceAccessControlEnabled()) { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) resp; String token = request.getHeader(HttpHeaders.AUTHORIZATION); if (!checkAccessToken(token)) { logger.warn("Invalid access token: {} for uri: {}", token, request.getRequestURI()); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); return; } } chain.doFilter(req, resp); } AdminServiceAuthenticationFilter(BizConfig bizConfig); @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain); @Override void destroy();  }
@Test public void testWithAccessControlDisabled() throws Exception { when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(false); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(bizConfig, never()).getAdminServiceAccessTokens(); verify(servletRequest, never()).getHeader(HttpHeaders.AUTHORIZATION); verify(servletResponse, never()).sendError(anyInt(), anyString()); }
@Test public void testWithAccessControlEnabledWithTokenSpecifiedWithValidTokenPassed() throws Exception { String someValidToken = "someToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()).thenReturn(someValidToken); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(someValidToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(bizConfig, times(1)).getAdminServiceAccessTokens(); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); }
@Test public void testWithAccessControlEnabledWithTokenSpecifiedWithInvalidTokenPassed() throws Exception { String someValidToken = "someValidToken"; String someInvalidToken = "someInvalidToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()).thenReturn(someValidToken); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(someInvalidToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(bizConfig, times(1)).getAdminServiceAccessTokens(); verify(servletResponse, times(1)) .sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); verify(filterChain, never()).doFilter(servletRequest, servletResponse); }
@Test public void testWithAccessControlEnabledWithTokenSpecifiedWithNoTokenPassed() throws Exception { String someValidToken = "someValidToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()).thenReturn(someValidToken); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(null); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(bizConfig, times(1)).getAdminServiceAccessTokens(); verify(servletResponse, times(1)) .sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); verify(filterChain, never()).doFilter(servletRequest, servletResponse); }
@Test public void testWithAccessControlEnabledWithMultipleTokenSpecifiedWithValidTokenPassed() throws Exception { String someToken = "someToken"; String anotherToken = "anotherToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()) .thenReturn(String.format("%s,%s", someToken, anotherToken)); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(someToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(bizConfig, times(1)).getAdminServiceAccessTokens(); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); }
@Test public void testWithAccessControlEnabledWithNoTokenSpecifiedWithTokenPassed() throws Exception { String someToken = "someToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()).thenReturn(null); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(someToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(bizConfig, times(1)).getAdminServiceAccessTokens(); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); }
@Test public void testWithAccessControlEnabledWithNoTokenSpecifiedWithNoTokenPassed() throws Exception { String someToken = "someToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()).thenReturn(null); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(null); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(bizConfig, times(1)).isAdminServiceAccessControlEnabled(); verify(bizConfig, times(1)).getAdminServiceAccessTokens(); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); }
@Test public void testWithConfigChanged() throws Exception { String someToken = "someToken"; String anotherToken = "anotherToken"; String yetAnotherToken = "yetAnotherToken"; when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(true); when(bizConfig.getAdminServiceAccessTokens()).thenReturn(someToken); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(someToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); initVariables(); when(bizConfig.getAdminServiceAccessTokens()) .thenReturn(String.format("%s,%s", anotherToken, yetAnotherToken)); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(someToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(servletResponse, times(1)) .sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); verify(filterChain, never()).doFilter(servletRequest, servletResponse); initVariables(); when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(anotherToken); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); initVariables(); when(bizConfig.isAdminServiceAccessControlEnabled()).thenReturn(false); authenticationFilter.doFilter(servletRequest, servletResponse, filterChain); verify(filterChain, times(1)).doFilter(servletRequest, servletResponse); verify(servletResponse, never()).sendError(anyInt(), anyString()); verify(servletRequest, never()).getHeader(HttpHeaders.AUTHORIZATION); }