changeEmailService.beginEmailChange(userId, userEmail, newEmail.getNewEmail(), clientId, redirectUri); } catch (UaaException e) { if (e.getHttpStatus() == 409) {
response = changeEmailService.completeVerification(code); } catch (UaaException e) { return handleExceptionConsideringAuthentication(model, httpServletResponse);
@Test public void testVerifyEmailWithRedirectUrl() throws Exception { UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(),"user-id-001", null); when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); Map<String,String> response = new HashMap<>(); response.put("userId", "user-id-001"); response.put("username", "new@example.com"); response.put("email", "new@example.com"); response.put("redirect_url", "//example.com/callback"); when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("login?success=change_email_success&form_redirect_uri=//example.com/callback")); }
@Test public void testChangeEmail() throws Exception { setupSecurityContext(); MockHttpServletRequestBuilder post = post("/change_email.do") .contentType(APPLICATION_FORM_URLENCODED) .param("newEmail", "new@example.com") .param("client_id", "app"); mockMvc.perform(post) .andExpect(status().isFound()) .andExpect(redirectedUrl("email_sent?code=email_change")); verify(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "app", null); }
@Test public void testVerifyEmail() throws Exception { UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(),"user-id-001", null); when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); Map<String,String> response = new HashMap<>(); response.put("userId", "user-id-001"); response.put("username", "new@example.com"); response.put("email", "new@example.com"); when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("login?success=change_email_success")); }
@Test public void testChangeEmailWithClientIdAndRedirectUri() throws Exception { setupSecurityContext(); MockHttpServletRequestBuilder post = post("/change_email.do") .contentType(APPLICATION_FORM_URLENCODED) .param("newEmail", "new@example.com") .param("client_id", "app") .param("redirect_uri", "http://redirect.uri"); mockMvc.perform(post) .andExpect(status().isFound()) .andExpect(redirectedUrl("email_sent?code=email_change")); verify(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "app", "http://redirect.uri"); }
@Test public void testVerifyEmailWithRedirectWhenAuthenticated() throws Exception { UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(),"user-id-001", null); when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); Map<String,String> response = new HashMap<>(); response.put("userId", "user-id-001"); response.put("username", "new@example.com"); response.put("email", "new@example.com"); response.put("redirect_url", "//example.com/callback"); when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); setupSecurityContext(); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("//example.com/callback")); UaaPrincipal principal = ((UaaPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal()); Assert.assertEquals("user-id-001", principal.getId()); Assert.assertEquals("new@example.com", principal.getName()); Assert.assertEquals("new@example.com", principal.getEmail()); }
@Test public void testChangeEmailWithUsernameConflict() throws Exception { setupSecurityContext(); doThrow(new UaaException("username already exists", 409)).when(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "", null); MockHttpServletRequestBuilder post = post("/change_email.do") .contentType(APPLICATION_FORM_URLENCODED) .param("newEmail", "new@example.com") .param("client_id", ""); mockMvc.perform(post) .andExpect(status().isUnprocessableEntity()) .andExpect(view().name("change_email")) .andExpect(model().attribute("error_message_code", "username_exists")) .andExpect(model().attribute("email", "user@example.com")); }
@Test public void testVerifyEmailWhenAutheticatedAsOtherUser() throws Exception { UaaUser user = new UaaUser("user-id-002", "new2@example.com", "password", "new2@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(),"user-id-002", null); when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); Map<String,String> response = new HashMap<>(); response.put("userId", "user-id-002"); response.put("username", "new2@example.com"); response.put("email", "new2@example.com"); when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); setupSecurityContext(); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("profile?success_message_code=email_change.success")); UaaPrincipal principal = ((UaaPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal()); Assert.assertEquals("user-id-001", principal.getId()); Assert.assertEquals("bob", principal.getName()); Assert.assertEquals("user@example.com", principal.getEmail()); }
@Test public void testVerifyEmailWhenAuthenticated() throws Exception { UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(),"user-id-001", null); when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); Map<String,String> response = new HashMap<>(); response.put("userId", "user-id-001"); response.put("username", "new@example.com"); response.put("email", "new@example.com"); when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); setupSecurityContext(); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("profile?success_message_code=email_change.success")); UaaPrincipal principal = ((UaaPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal()); Assert.assertEquals("user-id-001", principal.getId()); Assert.assertEquals("new@example.com", principal.getName()); Assert.assertEquals("new@example.com", principal.getEmail()); }
@Test public void testVerifyEmailDoesNotDeleteAuthenticationMethods() throws Exception { UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(),"user-id-001", null); when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); Map<String,String> response = new HashMap<>(); response.put("userId", "user-id-001"); response.put("username", "new@example.com"); response.put("email", "new@example.com"); when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); setupSecurityContext(); UaaAuthentication authentication = (UaaAuthentication) SecurityContextHolder.getContext().getAuthentication(); authentication.setAuthenticationMethods(Collections.singleton("pwd")); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("profile?success_message_code=email_change.success")); UaaPrincipal principal = ((UaaPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal()); Assert.assertEquals("user-id-001", principal.getId()); Assert.assertEquals("new@example.com", principal.getName()); Assert.assertEquals("new@example.com", principal.getEmail()); authentication = (UaaAuthentication) SecurityContextHolder.getContext().getAuthentication(); assertNotNull(authentication.getAuthenticationMethods()); Assert.assertTrue(authentication.getAuthenticationMethods().contains("pwd")); Assert.assertEquals(1, authentication.getAuthenticationMethods().size()); }
@Test public void testVerifyEmailWithInvalidCode() throws Exception { Authentication authentication = new AnonymousAuthenticationToken( "anon", "anonymousUser", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS") ); SecurityContextHolder.getContext().setAuthentication(authentication); when(changeEmailService.completeVerification("the_secret_code")).thenThrow(new UaaException("Bad Request", 400)); MockHttpServletRequestBuilder get = get("/verify_email") .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isUnprocessableEntity()) .andExpect(view().name("error")); setupSecurityContext(); mockMvc.perform(get) .andExpect(status().isFound()) .andExpect(redirectedUrl("profile?error_message_code=email_change.invalid_code")); }