BatchSecretDeliveryResource { @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) public List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request) { List<SanitizedSecret> clientAccessibleSecrets = aclDAO.getBatchSanitizedSecretsFor(client, request.secrets()); List<Secret> existingSecrets = secretController.getSecretsByName(request.secrets()); boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); List<String> forbiddenSecrets = new ArrayList<>(); for (String secretname : request.secrets()) { boolean secretExists = existingSecrets.stream().anyMatch(s -> s.getName().equals(secretname)); boolean secretAccessible = clientAccessibleSecrets.stream().anyMatch(s -> s.name().equals(secretname)); if (!(clientExists && secretExists)) { logger.warn("Client {} or secret {} does not exist (client exists={}, secret exists={})", client.getName(), secretname, clientExists, secretExists); throw new NotFoundException(); } if (!secretAccessible) { forbiddenSecrets.add(secretname); } } if (!forbiddenSecrets.isEmpty()) { throw new ForbiddenException(format("Access denied: %s to secret(s) '%s'", client.getName(), forbiddenSecrets)); } logger.info("Client {} granted access to {}.", client.getName(), clientAccessibleSecrets.stream().map(s -> s.name()).collect(toList())); try { return existingSecrets.stream() .map(SecretDeliveryResponse::fromSecret) .collect(toList()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating batch response for secrets %s", existingSecrets.stream().map(s -> s.getName()).collect(toList())), e); throw new InternalServerErrorException(); } } @Inject  BatchSecretDeliveryResource(@Readonly SecretController secretController,
                                     AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  BatchSecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
                              ClientDAO clientDAO); @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request);  }
@Test public void returnsSingleSecretWhenAllowed() throws Exception { SanitizedSecret sanitizedSecret = SanitizedSecret.fromSecret(secret); ImmutableList<String> secretNames = ImmutableList.of(sanitizedSecret.name()); BatchSecretRequest req = BatchSecretRequest.create(secretNames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretNames)) .thenReturn(List.of(sanitizedSecret)); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretNames)) .thenReturn(List.of(secret)); List<SecretDeliveryResponse> response = batchSecretDeliveryResource.getBatchSecret(client, req); assertThat(response).isEqualTo(ImmutableList.of(SecretDeliveryResponse.fromSecret(secret))); }
@Test public void returnsMultipleSecretsWhenAllowed() throws Exception { SanitizedSecret sanitizedSecret = SanitizedSecret.fromSecret(secret); SanitizedSecret sanitizedSecret2 = SanitizedSecret.fromSecret(secret2); ImmutableList<String> secretnames = ImmutableList.of(sanitizedSecret.name(), sanitizedSecret2.name()); BatchSecretRequest req = BatchSecretRequest.create(secretnames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretnames)) .thenReturn(List.of(sanitizedSecret, sanitizedSecret2)); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretnames)) .thenReturn(List.of(secret, secret2)); List<SecretDeliveryResponse> response = batchSecretDeliveryResource.getBatchSecret(client, req); assertThat(response).containsExactlyInAnyOrder(SecretDeliveryResponse.fromSecret(secret), SecretDeliveryResponse.fromSecret(secret2)); }
@Test(expected = ForbiddenException.class) public void returnsForbiddenWhenOneOfSecretsNotAllowed() throws Exception { SanitizedSecret sanitizedSecret = SanitizedSecret.fromSecret(secret); SanitizedSecret forbiddenSecret = SanitizedSecret.fromSecret(secret2); ImmutableList<String> secretnames = ImmutableList.of(sanitizedSecret.name(), forbiddenSecret.name()); BatchSecretRequest req = BatchSecretRequest.create(secretnames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretnames)) .thenReturn(List.of(sanitizedSecret)); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretnames)) .thenReturn(List.of(secret, secret2)); batchSecretDeliveryResource.getBatchSecret(client, req); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenOneOfSecretsDoesNotExistAndOneForbidden() throws Exception { ImmutableList<String> secretnames = ImmutableList.of("secretthatdoesnotexist", secret.getName()); BatchSecretRequest req = BatchSecretRequest.create(secretnames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretnames)) .thenReturn(List.of()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretnames)) .thenReturn(List.of(secret)); batchSecretDeliveryResource.getBatchSecret(client, req); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenOneOfSecretsDoesNotExistAndOneForbiddenReverse() throws Exception { ImmutableList<String> secretnames = ImmutableList.of(secret.getName(), "secretthatdoesnotexist"); BatchSecretRequest req = BatchSecretRequest.create(secretnames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretnames)) .thenReturn(List.of()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretnames)) .thenReturn(List.of(secret)); batchSecretDeliveryResource.getBatchSecret(client, req); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenOneOfSecretsDoesNotExist() throws Exception { SanitizedSecret sanitizedSecret = SanitizedSecret.fromSecret(secret); ImmutableList<String> secretnames = ImmutableList.of(sanitizedSecret.name(), "secretthatdoesnotexist"); BatchSecretRequest req = BatchSecretRequest.create(secretnames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretnames)) .thenReturn(List.of(sanitizedSecret)); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretnames)) .thenReturn(List.of(secret)); batchSecretDeliveryResource.getBatchSecret(client, req); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenClientDoesNotExist() throws Exception { when(aclDAO.getBatchSanitizedSecretsFor(client, ImmutableList.of(secret.getName()))).thenReturn(ImmutableList.of()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.empty()); when(secretController.getSecretsByName(ImmutableList.of(secret.getName()))) .thenReturn(ImmutableList.of(secret)); batchSecretDeliveryResource.getBatchSecret(client, BatchSecretRequest.create(ImmutableList.of(secret.getName()))); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenSecretDoesNotExist() throws Exception { when(aclDAO.getBatchSanitizedSecretsFor(client, ImmutableList.of("secret_name"))).thenReturn(ImmutableList.of()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(ImmutableList.of("secret_name"))) .thenReturn(ImmutableList.of()); batchSecretDeliveryResource.getBatchSecret(client, BatchSecretRequest.create(ImmutableList.of("secret_name"))); }
@Test(expected = ForbiddenException.class) public void returnsUnauthorizedWhenDenied() throws Exception { when(aclDAO.getBatchSanitizedSecretsFor(client, ImmutableList.of(secret.getName()))).thenReturn(ImmutableList.<SanitizedSecret>of()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(ImmutableList.of(secret.getName()))) .thenReturn(ImmutableList.<Secret>of(secret)); batchSecretDeliveryResource.getBatchSecret(client, BatchSecretRequest.create(ImmutableList.of(secret.getName()))); }
@Test public void doesNotEscapeBase64() throws Exception { String name = secretBase64.getName(); when(aclDAO.getBatchSanitizedSecretsFor(client, ImmutableList.of(name))) .thenReturn(ImmutableList.of(SanitizedSecret.fromSecret(secretBase64))); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(ImmutableList.of(name))) .thenReturn(ImmutableList.of(secretBase64)); List<SecretDeliveryResponse> response = batchSecretDeliveryResource.getBatchSecret(client, BatchSecretRequest.create(ImmutableList.of(secretBase64.getName()))); assertThat(response.size()).isEqualTo(1); assertThat(response.get(0).getSecret()).isEqualTo(secretBase64.getSecret()); }