@Test void testWildcardRedirectURL() throws Exception { String state = generator.generate(); String clientId = "authclient-" + generator.generate(); String scopes = "openid"; String redirectUri = "http*://subdomain.domain.com/**/path2?query1=value1"; setUpClients(clientId, scopes, scopes, GRANT_TYPES, true, redirectUri); String username = "authuser" + generator.generate(); String userScopes = "openid"; ScimUser developer = setUpUser(username, userScopes, OriginKeys.UAA, IdentityZoneHolder.get().getId()); MockHttpSession session = getAuthenticatedSession(developer); String requestedUri = "https://subdomain.domain.com/path1/path2?query1=value1"; ResultMatcher status = status().is3xxRedirection(); performAuthorize(state, clientId, "Basic " + new String(org.apache.commons.codec.binary.Base64.encodeBase64((clientId + ":" + SECRET).getBytes())), session, requestedUri, status); requestedUri = "http://subdomain.domain.com/path1/path2?query1=value1"; performAuthorize(state, clientId, "Basic " + new String(org.apache.commons.codec.binary.Base64.encodeBase64((clientId + ":" + SECRET).getBytes())), session, requestedUri, status); requestedUri = "http://subdomain.domain.com/path1/path1a/path1b/path2?query1=value1"; performAuthorize(state, clientId, "Basic " + new String(org.apache.commons.codec.binary.Base64.encodeBase64((clientId + ":" + SECRET).getBytes())), session, requestedUri, status); requestedUri = "https://wrongsub.domain.com/path1/path2?query1=value1"; status = status().is4xxClientError(); performAuthorize(state, clientId, "Basic " + new String(org.apache.commons.codec.binary.Base64.encodeBase64((clientId + ":" + SECRET).getBytes())), session, requestedUri, status); requestedUri = "https://subdomain.domain.com/path1/path2?query1=value1&query2=value2"; status = status().is4xxClientError(); performAuthorize(state, clientId, "Basic " + new String(org.apache.commons.codec.binary.Base64.encodeBase64((clientId + ":" + SECRET).getBytes())), session, requestedUri, status); }
@Test void password_grant() throws Exception { String username = "testuser" + generator.generate(); String userScopes = "uaa.user"; ScimUser user = setUpUser(username, userScopes, OriginKeys.UAA, IdentityZone.getUaa().getId()); assertEquals(1, webApplicationContext.getBean(JdbcTemplate.class).update("UPDATE users SET passwd_change_required = ? WHERE ID = ?", true, user.getId())); doPasswordGrant(username, SECRET, "cf", "", status().is4xxClientError()); }
@Test void testSilentAuthentication_Returns400_whenInvalidRedirectUrlIsProvided() throws Exception { MockHttpSession session = new MockHttpSession(); login(session); mockMvc.perform( get("/oauth/authorize?response_type=token&scope=openid&client_id=ant&prompt=none&redirect_uri=no good uri") .session(session) ) .andExpect(status().is4xxClientError()); }
@Test public void statusRanges() throws Exception { for (HttpStatus status : HttpStatus.values()) { MockHttpServletResponse response = new MockHttpServletResponse(); response.setStatus(status.value()); MvcResult mvcResult = new StubMvcResult(request, null, null, null, null, null, response); switch (status.series().value()) { case 1: this.matchers.is1xxInformational().match(mvcResult); break; case 2: this.matchers.is2xxSuccessful().match(mvcResult); break; case 3: this.matchers.is3xxRedirection().match(mvcResult); break; case 4: this.matchers.is4xxClientError().match(mvcResult); break; case 5: this.matchers.is5xxServerError().match(mvcResult); break; default: fail("Unexpected range for status code value " + status); } } }
.param("scope.0","scope.test.scope1") .andExpect(status().is4xxClientError()); .param("scope.0","scope.test.scope1") .andExpect(status().is4xxClientError());
+ "}" ).andExpect(status().is4xxClientError()) .andExpect(jsonPath("$.error", equalTo(expectedMessage)));
@Test public void testBackreference() throws Exception { mockMvc.perform(get("/rest/web/../../shouldnt/access/test.png")) .andExpect(status().is4xxClientError()); }
@Test public void testBoundsGetBadSrs() throws Exception { this.mockMvc .perform(get("/rest/bounds/topp:states/4326/java")) .andExpect(status().is4xxClientError()); }
@Test public void testAbsolute() throws Exception { mockMvc.perform(get("/rest/web/org/geowebcache/shouldnt/access/test.png")) .andExpect(status().is4xxClientError()); }
@Test public void testBackreference2() throws Exception { mockMvc.perform(get("/rest/web/foo/../../../shouldnt/access/test.png")) .andExpect(status().is4xxClientError()); } }
@Test public void setByteStreamController() throws Exception { mockMvc.perform(get("/rest/web/doesnt%20exist")).andExpect(status().is4xxClientError()); }
@Test public void POST_whenAReferencedCredentialDoesNotExist_throwsAnError() throws Exception { doReturn( null ).when(mockCredentialVersionDataService).findMostRecent("/cred1"); final String expectedMessage = "The request could not be completed because the credential does not exist or you do not have sufficient authorization."; mockMvc.perform(post("/api/v1/interpolate") .header("Authorization", "Bearer " + ALL_PERMISSIONS_TOKEN) .contentType(MediaType.APPLICATION_JSON) .content( "{" + " \"pp-config-server\": [" + " {" + " \"credentials\": {" + " \"credhub-ref\": \"/cred1\"" + " }," + " \"label\": \"pp-config-server\"" + " }" + " ]" + "}" ) ).andExpect(status().is4xxClientError()) .andExpect(jsonPath("$.error", equalTo(expectedMessage))); }
@Test public void getCertificateVersionsByCredentialId_returnsError_whenUUIDIsInvalid() throws Exception { final MockHttpServletRequestBuilder get = get("/api/v1/certificates/" + "fake-uuid" + "/versions") .header("Authorization", "Bearer " + ALL_PERMISSIONS_TOKEN) .accept(APPLICATION_JSON) .contentType(APPLICATION_JSON); final String response = mockMvc.perform(get) .andDo(print()) .andExpect(status().is4xxClientError()) .andReturn().getResponse().getContentAsString(); assertThat(response, containsString( "The request could not be completed because the credential does not exist or you do not have sufficient authorization.")); } }
@Test public void whenPostOptionsRetentionTimeSmallerThanMin() throws Exception { final EventType defaultEventType = buildDefaultEventType(); defaultEventType.getOptions().setRetentionTime(86399999L); postEventType(defaultEventType) .andExpect(status().is4xxClientError()) .andExpect(content().string(new StringContains( "Field \\\"options.retention_time\\\" can not be less than 86400000"))); }
@Test public void whenPostOptionsRetentionTimeBiggerThanMax() throws Exception { final EventType defaultEventType = buildDefaultEventType(); defaultEventType.getOptions().setRetentionTime(345600001L); postEventType(defaultEventType) .andExpect(status().is4xxClientError()) .andExpect(content().string(new StringContains( "Field \\\"options.retention_time\\\" can not be more than 345600000"))); }
.contentType(TestUtil.APPLICATION_JSON_UTF8) .content(TestUtil.convertObjectToJsonBytes(duplicatedUser))) .andExpect(status().is4xxClientError());
.contentType(TestUtil.APPLICATION_JSON_UTF8) .content(TestUtil.convertObjectToJsonBytes(duplicatedUser))) .andExpect(status().is4xxClientError());
@Test public void delete_whenNameIsMissing_returnAnError() throws Exception { final MockHttpServletRequestBuilder delete = delete("/api/v1/data") .header("Authorization", "Bearer " + AuthConstants.ALL_PERMISSIONS_TOKEN) .accept(APPLICATION_JSON); mockMvc.perform(delete) .andExpect(status().is4xxClientError()) .andExpect(content().contentTypeCompatibleWith(APPLICATION_JSON)) .andExpect( jsonPath("$.error") .value("The query parameter name is required for this request.") ); }
@Test public void gettingACredential_byName_returnsAnErrorWhenTheNameIsNotGiven() throws Exception { final MockHttpServletRequestBuilder get = get("/api/v1/data?name=") .header("Authorization", "Bearer " + AuthConstants.ALL_PERMISSIONS_TOKEN) .accept(APPLICATION_JSON); mockMvc.perform(get) .andExpect(status().is4xxClientError()) .andExpect(content().contentTypeCompatibleWith(APPLICATION_JSON)) .andExpect( jsonPath("$.error") .value("The query parameter name is required for this request.") ); }