@Test(expected = ForbiddenException.class) public void returnsUnauthorizedWhenDenied() throws Exception { when(aclDAO.getSanitizedSecretFor(client, secret.getName())).thenReturn(Optional.empty()); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretByName(secret.getName())) .thenReturn(Optional.of(secret)); secretDeliveryResource.getSecret(secret.getName(), client); }
@Timed @ExceptionMetered @GET public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName, @Auth Client client) { Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName); Optional<Secret> secret = secretController.getSecretByName(secretName); if (!sanitizedSecret.isPresent()) { boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); boolean secretExists = secret.isPresent(); if (clientExists && secretExists) { throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(), "/secret/" + secretName, client)); } else { if (clientExists) { logger.info("Client {} requested unknown secret {}", client.getName(), secretName); } throw new NotFoundException(); } } logger.info("Client {} granted access to {}.", client.getName(), secretName); try { return SecretDeliveryResponse.fromSecret(secret.get()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating response for secret %s", secretName), e); throw new InternalServerErrorException(); } }
SecretDeliveryResource { @Timed @ExceptionMetered @GET public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName, @Auth Client client) { Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName); Optional<Secret> secret = secretController.getSecretByName(secretName); if (!sanitizedSecret.isPresent()) { boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); boolean secretExists = secret.isPresent(); if (clientExists && secretExists) { throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(), "/secret/" + secretName, client)); } else { if (clientExists) { logger.info("Client {} requested unknown secret {}", client.getName(), secretName); } throw new NotFoundException(); } } logger.info("Client {} granted access to {}.", client.getName(), secretName); try { return SecretDeliveryResponse.fromSecret(secret.get()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating response for secret %s", secretName), e); throw new InternalServerErrorException(); } } }
SecretDeliveryResource { @Timed @ExceptionMetered @GET public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName, @Auth Client client) { Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName); Optional<Secret> secret = secretController.getSecretByName(secretName); if (!sanitizedSecret.isPresent()) { boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); boolean secretExists = secret.isPresent(); if (clientExists && secretExists) { throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(), "/secret/" + secretName, client)); } else { if (clientExists) { logger.info("Client {} requested unknown secret {}", client.getName(), secretName); } throw new NotFoundException(); } } logger.info("Client {} granted access to {}.", client.getName(), secretName); try { return SecretDeliveryResponse.fromSecret(secret.get()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating response for secret %s", secretName), e); throw new InternalServerErrorException(); } } @Inject  SecretDeliveryResource(@Readonly SecretController secretController,
      AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  SecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
      ClientDAO clientDAO); }
SecretDeliveryResource { @Timed @ExceptionMetered @GET public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName, @Auth Client client) { Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName); Optional<Secret> secret = secretController.getSecretByName(secretName); if (!sanitizedSecret.isPresent()) { boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); boolean secretExists = secret.isPresent(); if (clientExists && secretExists) { throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(), "/secret/" + secretName, client)); } else { if (clientExists) { logger.info("Client {} requested unknown secret {}", client.getName(), secretName); } throw new NotFoundException(); } } logger.info("Client {} granted access to {}.", client.getName(), secretName); try { return SecretDeliveryResponse.fromSecret(secret.get()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating response for secret %s", secretName), e); throw new InternalServerErrorException(); } } @Inject  SecretDeliveryResource(@Readonly SecretController secretController,
      AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  SecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
      ClientDAO clientDAO); @Timed @ExceptionMetered @GET SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName,
                                          @Auth Client client); }
SecretDeliveryResource { @Timed @ExceptionMetered @GET public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName, @Auth Client client) { Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName); Optional<Secret> secret = secretController.getSecretByName(secretName); if (!sanitizedSecret.isPresent()) { boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); boolean secretExists = secret.isPresent(); if (clientExists && secretExists) { throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(), "/secret/" + secretName, client)); } else { if (clientExists) { logger.info("Client {} requested unknown secret {}", client.getName(), secretName); } throw new NotFoundException(); } } logger.info("Client {} granted access to {}.", client.getName(), secretName); try { return SecretDeliveryResponse.fromSecret(secret.get()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating response for secret %s", secretName), e); throw new InternalServerErrorException(); } } @Inject  SecretDeliveryResource(@Readonly SecretController secretController,
      AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  SecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
      ClientDAO clientDAO); @Timed @ExceptionMetered @GET SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName,
                                          @Auth Client client);  }