SecretDeliveryResource { @Timed @ExceptionMetered @GET public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName, @Auth Client client) { Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName); Optional<Secret> secret = secretController.getSecretByName(secretName); if (!sanitizedSecret.isPresent()) { boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); boolean secretExists = secret.isPresent(); if (clientExists && secretExists) { throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(), "/secret/" + secretName, client)); } else { if (clientExists) { logger.info("Client {} requested unknown secret {}", client.getName(), secretName); } throw new NotFoundException(); } } logger.info("Client {} granted access to {}.", client.getName(), secretName); try { return SecretDeliveryResponse.fromSecret(secret.get()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating response for secret %s", secretName), e); throw new InternalServerErrorException(); } } @Inject  SecretDeliveryResource(@Readonly SecretController secretController,
      AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  SecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
      ClientDAO clientDAO); @Timed @ExceptionMetered @GET SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName,
                                          @Auth Client client);  }
@Test public void returnsSecretWhenAllowed() throws Exception { Secret secret = new Secret(0, "secret_name", null, () -> "unused_secret", "checksum", NOW, null, NOW, null, null, null, null, 0, 1L, NOW, null); SanitizedSecret sanitizedSecret = SanitizedSecret.fromSecret(secret); String name = sanitizedSecret.name(); when(aclDAO.getSanitizedSecretFor(client, name)) .thenReturn(Optional.of(sanitizedSecret)); when(secretController.getSecretByName(name)) .thenReturn(Optional.of(secret)); SecretDeliveryResponse response = secretDeliveryResource.getSecret(sanitizedSecret.name(), client); assertThat(response).isEqualTo(SecretDeliveryResponse.fromSecret(secret)); }
@Test public void returnsVersionedSecretWhenAllowed() throws Exception { String name = "secret_name"; Secret versionedSecret = new Secret(2, name, null, () -> "U3BpZGVybWFu", "checksum", NOW, null, NOW, null, null, null, null, 0, 1L, NOW, null); when(aclDAO.getSanitizedSecretFor(client, name)) .thenReturn(Optional.of(SanitizedSecret.fromSecret(versionedSecret))); when(secretController.getSecretByName(name)) .thenReturn(Optional.of(versionedSecret)); String displayName = versionedSecret.getDisplayName(); SecretDeliveryResponse response = secretDeliveryResource.getSecret(displayName, client); assertThat(response).isEqualTo(SecretDeliveryResponse.fromSecret(versionedSecret)); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenClientDoesNotExist() throws Exception { when(aclDAO.getSanitizedSecretFor(client, secret.getName())).thenReturn(Optional.empty()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.empty()); when(secretController.getSecretByName(secret.getName())) .thenReturn(Optional.of(secret)); secretDeliveryResource.getSecret(secret.getName(), client); }
@Test(expected = NotFoundException.class) public void returnsNotFoundWhenSecretDoesNotExist() throws Exception { when(aclDAO.getSanitizedSecretFor(client, "secret_name")).thenReturn(Optional.empty()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretByName("secret_name")) .thenReturn(Optional.empty()); secretDeliveryResource.getSecret("secret_name", client); }
@Test(expected = ForbiddenException.class) public void returnsUnauthorizedWhenDenied() throws Exception { when(aclDAO.getSanitizedSecretFor(client, secret.getName())).thenReturn(Optional.empty()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretByName(secret.getName())) .thenReturn(Optional.of(secret)); secretDeliveryResource.getSecret(secret.getName(), client); }
@Test public void doesNotEscapeBase64() throws Exception { String name = secretBase64.getName(); when(aclDAO.getSanitizedSecretFor(client, name)) .thenReturn(Optional.of(SanitizedSecret.fromSecret(secretBase64))); when(secretController.getSecretByName(name)) .thenReturn(Optional.of(secretBase64)); SecretDeliveryResponse response = secretDeliveryResource.getSecret(secretBase64.getName(), client); assertThat(response.getSecret()).isEqualTo(secretBase64.getSecret()); }