@Test public void returnsSingleSecretWhenAllowed() throws Exception { SanitizedSecret sanitizedSecret = SanitizedSecret.fromSecret(secret); ImmutableList<String> secretNames = ImmutableList.of(sanitizedSecret.name()); BatchSecretRequest req = BatchSecretRequest.create(secretNames); when(aclDAO.getBatchSanitizedSecretsFor(client, secretNames)) .thenReturn(List.of(sanitizedSecret)); when(clientDAO.getClientByName(client.getName())).thenReturn(Optional.of(client)); when(secretController.getSecretsByName(secretNames)) .thenReturn(List.of(secret)); List<SecretDeliveryResponse> response = batchSecretDeliveryResource.getBatchSecret(client, req); assertThat(response).isEqualTo(ImmutableList.of(SecretDeliveryResponse.fromSecret(secret))); }
@Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) public List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request) { List<SanitizedSecret> clientAccessibleSecrets = aclDAO.getBatchSanitizedSecretsFor(client, request.secrets()); List<Secret> existingSecrets = secretController.getSecretsByName(request.secrets()); boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); List<String> forbiddenSecrets = new ArrayList<>(); for (String secretname : request.secrets()) { boolean secretExists = existingSecrets.stream().anyMatch(s -> s.getName().equals(secretname)); boolean secretAccessible = clientAccessibleSecrets.stream().anyMatch(s -> s.name().equals(secretname)); if (!(clientExists && secretExists)) { logger.warn("Client {} or secret {} does not exist (client exists={}, secret exists={})", client.getName(), secretname, clientExists, secretExists); throw new NotFoundException(); } if (!secretAccessible) { forbiddenSecrets.add(secretname); } } if (!forbiddenSecrets.isEmpty()) { throw new ForbiddenException(format("Access denied: %s to secret(s) '%s'", client.getName(), forbiddenSecrets)); } logger.info("Client {} granted access to {}.", client.getName(), clientAccessibleSecrets.stream().map(s -> s.name()).collect(toList())); try { return existingSecrets.stream() .map(SecretDeliveryResponse::fromSecret) .collect(toList()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating batch response for secrets %s", existingSecrets.stream().map(s -> s.getName()).collect(toList())), e); throw new InternalServerErrorException(); } }
BatchSecretDeliveryResource { @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) public List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request) { List<SanitizedSecret> clientAccessibleSecrets = aclDAO.getBatchSanitizedSecretsFor(client, request.secrets()); List<Secret> existingSecrets = secretController.getSecretsByName(request.secrets()); boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); List<String> forbiddenSecrets = new ArrayList<>(); for (String secretname : request.secrets()) { boolean secretExists = existingSecrets.stream().anyMatch(s -> s.getName().equals(secretname)); boolean secretAccessible = clientAccessibleSecrets.stream().anyMatch(s -> s.name().equals(secretname)); if (!(clientExists && secretExists)) { logger.warn("Client {} or secret {} does not exist (client exists={}, secret exists={})", client.getName(), secretname, clientExists, secretExists); throw new NotFoundException(); } if (!secretAccessible) { forbiddenSecrets.add(secretname); } } if (!forbiddenSecrets.isEmpty()) { throw new ForbiddenException(format("Access denied: %s to secret(s) '%s'", client.getName(), forbiddenSecrets)); } logger.info("Client {} granted access to {}.", client.getName(), clientAccessibleSecrets.stream().map(s -> s.name()).collect(toList())); try { return existingSecrets.stream() .map(SecretDeliveryResponse::fromSecret) .collect(toList()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating batch response for secrets %s", existingSecrets.stream().map(s -> s.getName()).collect(toList())), e); throw new InternalServerErrorException(); } } }
BatchSecretDeliveryResource { @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) public List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request) { List<SanitizedSecret> clientAccessibleSecrets = aclDAO.getBatchSanitizedSecretsFor(client, request.secrets()); List<Secret> existingSecrets = secretController.getSecretsByName(request.secrets()); boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); List<String> forbiddenSecrets = new ArrayList<>(); for (String secretname : request.secrets()) { boolean secretExists = existingSecrets.stream().anyMatch(s -> s.getName().equals(secretname)); boolean secretAccessible = clientAccessibleSecrets.stream().anyMatch(s -> s.name().equals(secretname)); if (!(clientExists && secretExists)) { logger.warn("Client {} or secret {} does not exist (client exists={}, secret exists={})", client.getName(), secretname, clientExists, secretExists); throw new NotFoundException(); } if (!secretAccessible) { forbiddenSecrets.add(secretname); } } if (!forbiddenSecrets.isEmpty()) { throw new ForbiddenException(format("Access denied: %s to secret(s) '%s'", client.getName(), forbiddenSecrets)); } logger.info("Client {} granted access to {}.", client.getName(), clientAccessibleSecrets.stream().map(s -> s.name()).collect(toList())); try { return existingSecrets.stream() .map(SecretDeliveryResponse::fromSecret) .collect(toList()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating batch response for secrets %s", existingSecrets.stream().map(s -> s.getName()).collect(toList())), e); throw new InternalServerErrorException(); } } @Inject  BatchSecretDeliveryResource(@Readonly SecretController secretController,
                                     AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  BatchSecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
                              ClientDAO clientDAO); }
BatchSecretDeliveryResource { @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) public List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request) { List<SanitizedSecret> clientAccessibleSecrets = aclDAO.getBatchSanitizedSecretsFor(client, request.secrets()); List<Secret> existingSecrets = secretController.getSecretsByName(request.secrets()); boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); List<String> forbiddenSecrets = new ArrayList<>(); for (String secretname : request.secrets()) { boolean secretExists = existingSecrets.stream().anyMatch(s -> s.getName().equals(secretname)); boolean secretAccessible = clientAccessibleSecrets.stream().anyMatch(s -> s.name().equals(secretname)); if (!(clientExists && secretExists)) { logger.warn("Client {} or secret {} does not exist (client exists={}, secret exists={})", client.getName(), secretname, clientExists, secretExists); throw new NotFoundException(); } if (!secretAccessible) { forbiddenSecrets.add(secretname); } } if (!forbiddenSecrets.isEmpty()) { throw new ForbiddenException(format("Access denied: %s to secret(s) '%s'", client.getName(), forbiddenSecrets)); } logger.info("Client {} granted access to {}.", client.getName(), clientAccessibleSecrets.stream().map(s -> s.name()).collect(toList())); try { return existingSecrets.stream() .map(SecretDeliveryResponse::fromSecret) .collect(toList()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating batch response for secrets %s", existingSecrets.stream().map(s -> s.getName()).collect(toList())), e); throw new InternalServerErrorException(); } } @Inject  BatchSecretDeliveryResource(@Readonly SecretController secretController,
                                     AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  BatchSecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
                              ClientDAO clientDAO); @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request); }
BatchSecretDeliveryResource { @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) public List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request) { List<SanitizedSecret> clientAccessibleSecrets = aclDAO.getBatchSanitizedSecretsFor(client, request.secrets()); List<Secret> existingSecrets = secretController.getSecretsByName(request.secrets()); boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent(); List<String> forbiddenSecrets = new ArrayList<>(); for (String secretname : request.secrets()) { boolean secretExists = existingSecrets.stream().anyMatch(s -> s.getName().equals(secretname)); boolean secretAccessible = clientAccessibleSecrets.stream().anyMatch(s -> s.name().equals(secretname)); if (!(clientExists && secretExists)) { logger.warn("Client {} or secret {} does not exist (client exists={}, secret exists={})", client.getName(), secretname, clientExists, secretExists); throw new NotFoundException(); } if (!secretAccessible) { forbiddenSecrets.add(secretname); } } if (!forbiddenSecrets.isEmpty()) { throw new ForbiddenException(format("Access denied: %s to secret(s) '%s'", client.getName(), forbiddenSecrets)); } logger.info("Client {} granted access to {}.", client.getName(), clientAccessibleSecrets.stream().map(s -> s.name()).collect(toList())); try { return existingSecrets.stream() .map(SecretDeliveryResponse::fromSecret) .collect(toList()); } catch (IllegalArgumentException e) { logger.error(format("Failed creating batch response for secrets %s", existingSecrets.stream().map(s -> s.getName()).collect(toList())), e); throw new InternalServerErrorException(); } } @Inject  BatchSecretDeliveryResource(@Readonly SecretController secretController,
                                     AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory); @VisibleForTesting  BatchSecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
                              ClientDAO clientDAO); @Timed @ExceptionMetered @POST @Consumes(APPLICATION_JSON) List<SecretDeliveryResponse> getBatchSecret(@Auth Client client, @Valid BatchSecretRequest request);  }