diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedException.java b/scm-core/src/main/java/sonia/scm/user/ChangePasswordNotAllowedException.java similarity index 82% rename from scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedException.java rename to scm-core/src/main/java/sonia/scm/user/ChangePasswordNotAllowedException.java index 755cd709cc..b2925cf65c 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedException.java +++ b/scm-core/src/main/java/sonia/scm/user/ChangePasswordNotAllowedException.java @@ -1,4 +1,4 @@ -package sonia.scm.api.v2.resources; +package sonia.scm.user; public class ChangePasswordNotAllowedException extends RuntimeException { diff --git a/scm-core/src/main/java/sonia/scm/user/InvalidPasswordException.java b/scm-core/src/main/java/sonia/scm/user/InvalidPasswordException.java new file mode 100644 index 0000000000..beda2c83fb --- /dev/null +++ b/scm-core/src/main/java/sonia/scm/user/InvalidPasswordException.java @@ -0,0 +1,8 @@ +package sonia.scm.user; + +public class InvalidPasswordException extends RuntimeException { + + public InvalidPasswordException(String message) { + super(message); + } +} diff --git a/scm-core/src/main/java/sonia/scm/user/UserManager.java b/scm-core/src/main/java/sonia/scm/user/UserManager.java index 0a705c8d60..90dbcd74b3 100644 --- a/scm-core/src/main/java/sonia/scm/user/UserManager.java +++ b/scm-core/src/main/java/sonia/scm/user/UserManager.java @@ -38,6 +38,9 @@ package sonia.scm.user; import sonia.scm.Manager; import sonia.scm.search.Searchable; +import java.text.MessageFormat; +import java.util.function.Consumer; + /** * The central class for managing {@link User} objects. * This class is a singleton and is available via injection. @@ -68,4 +71,22 @@ public interface UserManager * @since 1.14 */ public String getDefaultType(); + + + /** + * Only account of the default type "xml" can change their password + */ + default Consumer getUserTypeChecker() { + return user -> { + if (!isTypeDefault(user)) { + throw new ChangePasswordNotAllowedException(MessageFormat.format("It is not possible to change password for User of type {0}", user.getType())); + } + }; + } + + default boolean isTypeDefault(User user) { + return getDefaultType().equals(user.getType()); + } + + } diff --git a/scm-it/src/test/java/sonia/scm/it/MeITCase.java b/scm-it/src/test/java/sonia/scm/it/MeITCase.java new file mode 100644 index 0000000000..1c7b5c9e03 --- /dev/null +++ b/scm-it/src/test/java/sonia/scm/it/MeITCase.java @@ -0,0 +1,79 @@ +package sonia.scm.it; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; +import sonia.scm.it.utils.ScmRequests; +import sonia.scm.it.utils.TestData; + +import static org.assertj.core.api.Assertions.assertThat; + +public class MeITCase { + + @Before + public void init() { + TestData.cleanup(); + } + + @Test + public void adminShouldChangeOwnPassword() { + String newPassword = TestData.USER_SCM_ADMIN + "1"; + // admin change the own password + ScmRequests.start() + .given() + .url(TestData.getMeUrl()) + .usernameAndPassword(TestData.USER_SCM_ADMIN, TestData.USER_SCM_ADMIN) + .getMeResource() + .assertStatusCode(200) + .usingMeResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE)) + .assertPassword(Assert::assertNull) + .assertType(s -> assertThat(s).isEqualTo("xml")) + .requestChangePassword(TestData.USER_SCM_ADMIN, newPassword) + .assertStatusCode(204); + // assert password is changed -> login with the new Password than undo changes + ScmRequests.start() + .given() + .url(TestData.getUserUrl(TestData.USER_SCM_ADMIN)) + .usernameAndPassword(TestData.USER_SCM_ADMIN, newPassword) + .getMeResource() + .assertStatusCode(200) + .usingMeResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE))// still admin + .requestChangePassword(newPassword, TestData.USER_SCM_ADMIN) + .assertStatusCode(204); + } + + @Test + public void shouldHidePasswordLinkIfUserTypeIsNotXML() { + String newUser = "user"; + String password = "pass"; + String type = "not XML Type"; + TestData.createUser(newUser, password, true, type); + ScmRequests.start() + .given() + .url(TestData.getMeUrl()) + .usernameAndPassword(newUser, password) + .getMeResource() + .assertStatusCode(200) + .usingMeResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE)) + .assertPassword(Assert::assertNull) + .assertType(s -> assertThat(s).isEqualTo(type)) + .assertPasswordLinkDoesNotExists(); + } + + @Test + public void shouldGet403IfUserIsNotAdmin() { + String newUser = "user"; + String password = "pass"; + String type = "xml"; + TestData.createUser(newUser, password, false, type); + ScmRequests.start() + .given() + .url(TestData.getMeUrl()) + .usernameAndPassword(newUser, password) + .getMeResource() + .assertStatusCode(403); + } +} diff --git a/scm-it/src/test/java/sonia/scm/it/PermissionsITCase.java b/scm-it/src/test/java/sonia/scm/it/PermissionsITCase.java index 63d8b46d47..f288d4891c 100644 --- a/scm-it/src/test/java/sonia/scm/it/PermissionsITCase.java +++ b/scm-it/src/test/java/sonia/scm/it/PermissionsITCase.java @@ -39,6 +39,8 @@ import org.junit.rules.TemporaryFolder; import org.junit.runner.RunWith; import org.junit.runners.Parameterized; import org.junit.runners.Parameterized.Parameters; +import sonia.scm.it.utils.RepositoryUtil; +import sonia.scm.it.utils.TestData; import sonia.scm.repository.PermissionType; import sonia.scm.repository.client.api.RepositoryClient; import sonia.scm.repository.client.api.RepositoryClientException; @@ -51,11 +53,11 @@ import java.util.Objects; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertNull; -import static sonia.scm.it.RepositoryUtil.addAndCommitRandomFile; -import static sonia.scm.it.RestUtil.given; -import static sonia.scm.it.ScmTypes.availableScmTypes; -import static sonia.scm.it.TestData.USER_SCM_ADMIN; -import static sonia.scm.it.TestData.callRepository; +import static sonia.scm.it.utils.RepositoryUtil.addAndCommitRandomFile; +import static sonia.scm.it.utils.RestUtil.given; +import static sonia.scm.it.utils.ScmTypes.availableScmTypes; +import static sonia.scm.it.utils.TestData.USER_SCM_ADMIN; +import static sonia.scm.it.utils.TestData.callRepository; @RunWith(Parameterized.class) public class PermissionsITCase { diff --git a/scm-it/src/test/java/sonia/scm/it/RepositoriesITCase.java b/scm-it/src/test/java/sonia/scm/it/RepositoriesITCase.java index 21d4d97b1b..c49a65bea2 100644 --- a/scm-it/src/test/java/sonia/scm/it/RepositoriesITCase.java +++ b/scm-it/src/test/java/sonia/scm/it/RepositoriesITCase.java @@ -42,6 +42,8 @@ import org.junit.rules.TemporaryFolder; import org.junit.runner.RunWith; import org.junit.runners.Parameterized; import org.junit.runners.Parameterized.Parameters; +import sonia.scm.it.utils.RepositoryUtil; +import sonia.scm.it.utils.TestData; import sonia.scm.repository.client.api.RepositoryClient; import sonia.scm.web.VndMediaType; @@ -53,11 +55,11 @@ import static org.hamcrest.Matchers.equalTo; import static org.hamcrest.Matchers.is; import static org.hamcrest.Matchers.nullValue; import static org.junit.Assert.assertEquals; -import static sonia.scm.it.RegExMatcher.matchesPattern; -import static sonia.scm.it.RestUtil.createResourceUrl; -import static sonia.scm.it.RestUtil.given; -import static sonia.scm.it.ScmTypes.availableScmTypes; -import static sonia.scm.it.TestData.repositoryJson; +import static sonia.scm.it.utils.RegExMatcher.matchesPattern; +import static sonia.scm.it.utils.RestUtil.createResourceUrl; +import static sonia.scm.it.utils.RestUtil.given; +import static sonia.scm.it.utils.ScmTypes.availableScmTypes; +import static sonia.scm.it.utils.TestData.repositoryJson; @RunWith(Parameterized.class) public class RepositoriesITCase { diff --git a/scm-it/src/test/java/sonia/scm/it/RepositoryAccessITCase.java b/scm-it/src/test/java/sonia/scm/it/RepositoryAccessITCase.java index 7bf04b7b81..4934094083 100644 --- a/scm-it/src/test/java/sonia/scm/it/RepositoryAccessITCase.java +++ b/scm-it/src/test/java/sonia/scm/it/RepositoryAccessITCase.java @@ -11,6 +11,9 @@ import org.junit.Test; import org.junit.rules.TemporaryFolder; import org.junit.runner.RunWith; import org.junit.runners.Parameterized; +import sonia.scm.it.utils.RepositoryUtil; +import sonia.scm.it.utils.ScmRequests; +import sonia.scm.it.utils.TestData; import sonia.scm.repository.Changeset; import sonia.scm.repository.client.api.ClientCommand; import sonia.scm.repository.client.api.RepositoryClient; @@ -28,10 +31,10 @@ import static java.lang.Thread.sleep; import static org.assertj.core.api.Assertions.assertThat; import static org.hamcrest.Matchers.equalTo; import static org.junit.Assert.assertNotNull; -import static sonia.scm.it.RestUtil.ADMIN_PASSWORD; -import static sonia.scm.it.RestUtil.ADMIN_USERNAME; -import static sonia.scm.it.RestUtil.given; -import static sonia.scm.it.ScmTypes.availableScmTypes; +import static sonia.scm.it.utils.RestUtil.ADMIN_PASSWORD; +import static sonia.scm.it.utils.RestUtil.ADMIN_USERNAME; +import static sonia.scm.it.utils.RestUtil.given; +import static sonia.scm.it.utils.ScmTypes.availableScmTypes; @RunWith(Parameterized.class) public class RepositoryAccessITCase { @@ -41,7 +44,7 @@ public class RepositoryAccessITCase { private final String repositoryType; private File folder; - private RepositoryRequests.AppliedRepositoryGetRequest repositoryGetRequest; + private ScmRequests.AppliedRepositoryRequest repositoryGetRequest; public RepositoryAccessITCase(String repositoryType) { this.repositoryType = repositoryType; @@ -56,12 +59,17 @@ public class RepositoryAccessITCase { public void init() { TestData.createDefault(); folder = tempFolder.getRoot(); - repositoryGetRequest = RepositoryRequests.start() + repositoryGetRequest = ScmRequests.start() .given() .url(TestData.getDefaultRepositoryUrl(repositoryType)) .usernameAndPassword(ADMIN_USERNAME, ADMIN_PASSWORD) - .get() + .getRepositoryResource() .assertStatusCode(HttpStatus.SC_OK); + ScmRequests.AppliedMeRequest meGetRequest = ScmRequests.start() + .given() + .url(TestData.getMeUrl()) + .usernameAndPassword(ADMIN_USERNAME, ADMIN_PASSWORD) + .getMeResource(); } @Test diff --git a/scm-it/src/test/java/sonia/scm/it/RepositoryRequests.java b/scm-it/src/test/java/sonia/scm/it/RepositoryRequests.java deleted file mode 100644 index 79300d7b45..0000000000 --- a/scm-it/src/test/java/sonia/scm/it/RepositoryRequests.java +++ /dev/null @@ -1,293 +0,0 @@ -package sonia.scm.it; - -import io.restassured.RestAssured; -import io.restassured.response.Response; - -import java.util.List; -import java.util.Map; -import java.util.function.Consumer; - - -/** - * Encapsulate rest requests of a repository in builder pattern - *

- * A Get Request can be applied with the methods request*() - * These methods return a AppliedGet*Request object - * This object can be used to apply general assertions over the rest Assured response - * In the AppliedGet*Request classes there is a using*Response() method - * that return the *Response class containing specific operations related to the specific response - * the *Response class contains also the request*() method to apply the next GET request from a link in the response. - */ -public class RepositoryRequests { - - private String url; - private String username; - private String password; - - static RepositoryRequests start() { - return new RepositoryRequests(); - } - - Given given() { - return new Given(); - } - - - /** - * Apply a GET Request to the extracted url from the given link - * - * @param linkPropertyName the property name of link - * @param response the response containing the link - * @return the response of the GET request using the given link - */ - private Response getResponseFromLink(Response response, String linkPropertyName) { - return getResponse(response - .then() - .extract() - .path(linkPropertyName)); - } - - - /** - * Apply a GET Request to the given url and return the response. - * - * @param url the url of the GET request - * @return the response of the GET request using the given url - */ - private Response getResponse(String url) { - return RestAssured.given() - .auth().preemptive().basic(username, password) - .when() - .get(url); - } - - private void setUrl(String url) { - this.url = url; - } - - private void setUsername(String username) { - this.username = username; - } - - private void setPassword(String password) { - this.password = password; - } - - private String getUrl() { - return url; - } - - private String getUsername() { - return username; - } - - private String getPassword() { - return password; - } - - class Given { - - GivenUrl url(String url) { - setUrl(url); - return new GivenUrl(); - } - - } - - class GivenWithUrlAndAuth { - AppliedRepositoryGetRequest get() { - return new AppliedRepositoryGetRequest( - getResponse(url) - ); - } - } - - class AppliedGetRequest { - private Response response; - - public AppliedGetRequest(Response response) { - this.response = response; - } - - /** - * apply custom assertions to the actual response - * - * @param consumer consume the response in order to assert the content. the header, the payload etc.. - * @return the self object - */ - SELF assertResponse(Consumer consumer) { - consumer.accept(response); - return (SELF) this; - } - - /** - * special assertion of the status code - * - * @param expectedStatusCode the expected status code - * @return the self object - */ - SELF assertStatusCode(int expectedStatusCode) { - this.response.then().assertThat().statusCode(expectedStatusCode); - return (SELF) this; - } - - } - - class AppliedRepositoryGetRequest extends AppliedGetRequest { - - AppliedRepositoryGetRequest(Response response) { - super(response); - } - - RepositoryResponse usingRepositoryResponse() { - return new RepositoryResponse(super.response); - } - } - - class RepositoryResponse { - - private Response repositoryResponse; - - public RepositoryResponse(Response repositoryResponse) { - this.repositoryResponse = repositoryResponse; - } - - AppliedGetSourcesRequest requestSources() { - return new AppliedGetSourcesRequest(getResponseFromLink(repositoryResponse, "_links.sources.href")); - } - - AppliedGetChangesetsRequest requestChangesets() { - return new AppliedGetChangesetsRequest(getResponseFromLink(repositoryResponse, "_links.changesets.href")); - } - } - - class AppliedGetChangesetsRequest extends AppliedGetRequest { - - AppliedGetChangesetsRequest(Response response) { - super(response); - } - - ChangesetsResponse usingChangesetsResponse() { - return new ChangesetsResponse(super.response); - } - } - - class ChangesetsResponse { - private Response changesetsResponse; - - public ChangesetsResponse(Response changesetsResponse) { - this.changesetsResponse = changesetsResponse; - } - - ChangesetsResponse assertChangesets(Consumer> changesetsConsumer) { - List changesets = changesetsResponse.then().extract().path("_embedded.changesets"); - changesetsConsumer.accept(changesets); - return this; - } - - AppliedGetDiffRequest requestDiff(String revision) { - return new AppliedGetDiffRequest(getResponseFromLink(changesetsResponse, "_embedded.changesets.find{it.id=='" + revision + "'}._links.diff.href")); - } - - public AppliedGetModificationsRequest requestModifications(String revision) { - return new AppliedGetModificationsRequest(getResponseFromLink(changesetsResponse, "_embedded.changesets.find{it.id=='" + revision + "'}._links.modifications.href")); - } - } - - class AppliedGetSourcesRequest extends AppliedGetRequest { - - public AppliedGetSourcesRequest(Response sourcesResponse) { - super(sourcesResponse); - } - - SourcesResponse usingSourcesResponse() { - return new SourcesResponse(super.response); - } - } - - class SourcesResponse { - - private Response sourcesResponse; - - SourcesResponse(Response sourcesResponse) { - this.sourcesResponse = sourcesResponse; - } - - SourcesResponse assertRevision(Consumer assertRevision) { - String revision = sourcesResponse.then().extract().path("revision"); - assertRevision.accept(revision); - return this; - } - - SourcesResponse assertFiles(Consumer assertFiles) { - List files = sourcesResponse.then().extract().path("files"); - assertFiles.accept(files); - return this; - } - - AppliedGetChangesetsRequest requestFileHistory(String fileName) { - return new AppliedGetChangesetsRequest(getResponseFromLink(sourcesResponse, "_embedded.files.find{it.name=='" + fileName + "'}._links.history.href")); - } - - AppliedGetSourcesRequest requestSelf(String fileName) { - return new AppliedGetSourcesRequest(getResponseFromLink(sourcesResponse, "_embedded.files.find{it.name=='" + fileName + "'}._links.self.href")); - } - } - - class AppliedGetDiffRequest extends AppliedGetRequest { - - AppliedGetDiffRequest(Response response) { - super(response); - } - } - - class GivenUrl { - - GivenWithUrlAndAuth usernameAndPassword(String username, String password) { - setUsername(username); - setPassword(password); - return new GivenWithUrlAndAuth(); - } - } - - class AppliedGetModificationsRequest extends AppliedGetRequest { - public AppliedGetModificationsRequest(Response response) { super(response); } - ModificationsResponse usingModificationsResponse() { - return new ModificationsResponse(super.response); - } - - } - - class ModificationsResponse { - private Response resource; - - public ModificationsResponse(Response resource) { - this.resource = resource; - } - - ModificationsResponse assertRevision(Consumer assertRevision) { - String revision = resource.then().extract().path("revision"); - assertRevision.accept(revision); - return this; - } - - ModificationsResponse assertAdded(Consumer> assertAdded) { - List added = resource.then().extract().path("added"); - assertAdded.accept(added); - return this; - } - - ModificationsResponse assertRemoved(Consumer> assertRemoved) { - List removed = resource.then().extract().path("removed"); - assertRemoved.accept(removed); - return this; - } - - ModificationsResponse assertModified(Consumer> assertModified) { - List modified = resource.then().extract().path("modified"); - assertModified.accept(modified); - return this; - } - - } -} diff --git a/scm-it/src/test/java/sonia/scm/it/UserITCase.java b/scm-it/src/test/java/sonia/scm/it/UserITCase.java new file mode 100644 index 0000000000..65ed6b71bb --- /dev/null +++ b/scm-it/src/test/java/sonia/scm/it/UserITCase.java @@ -0,0 +1,112 @@ +package sonia.scm.it; + +import org.junit.Assert; +import org.junit.Before; +import org.junit.Test; +import sonia.scm.it.utils.ScmRequests; +import sonia.scm.it.utils.TestData; + +import static org.assertj.core.api.Assertions.assertThat; + +public class UserITCase { + + @Before + public void init(){ + TestData.cleanup(); + } + + @Test + public void adminShouldChangeOwnPassword() { + String newPassword = TestData.USER_SCM_ADMIN + "1"; + // admin change the own password + ScmRequests.start() + .given() + .url(TestData.getUserUrl(TestData.USER_SCM_ADMIN)) + .usernameAndPassword(TestData.USER_SCM_ADMIN, TestData.USER_SCM_ADMIN) + .getUserResource() + .assertStatusCode(200) + .usingUserResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE)) + .assertPassword(Assert::assertNull) + .requestChangePassword(newPassword) // the oldPassword is not needed in the user resource + .assertStatusCode(204); + // assert password is changed -> login with the new Password than undo changes + ScmRequests.start() + .given() + .url(TestData.getUserUrl(TestData.USER_SCM_ADMIN)) + .usernameAndPassword(TestData.USER_SCM_ADMIN, newPassword) + .getUserResource() + .assertStatusCode(200) + .usingUserResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE)) + .assertPassword(Assert::assertNull) + .requestChangePassword(TestData.USER_SCM_ADMIN) + .assertStatusCode(204); + + } + + @Test + public void adminShouldChangePasswordOfOtherUser() { + String newUser = "user"; + String password = "pass"; + TestData.createUser(newUser, password, true, "xml"); + String newPassword = "new_password"; + // admin change the password of the user + ScmRequests.start() + .given() + .url(TestData.getUserUrl(newUser))// the admin get the user object + .usernameAndPassword(TestData.USER_SCM_ADMIN, TestData.USER_SCM_ADMIN) + .getUserResource() + .assertStatusCode(200) + .usingUserResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE)) // the user anonymous is not an admin + .assertPassword(Assert::assertNull) + .requestChangePassword(newPassword) // the oldPassword is not needed in the user resource + .assertStatusCode(204); + // assert password is changed + ScmRequests.start() + .given() + .url(TestData.getUserUrl(newUser)) + .usernameAndPassword(newUser, newPassword) + .getUserResource() + .assertStatusCode(200); + + } + + + @Test + public void shouldHidePasswordLinkIfUserTypeIsNotXML() { + String newUser = "user"; + String password = "pass"; + String type = "not XML Type"; + TestData.createUser(newUser, password, true, type); + ScmRequests.start() + .given() + .url(TestData.getMeUrl()) + .usernameAndPassword(newUser, password) + .getUserResource() + .assertStatusCode(200) + .usingUserResponse() + .assertAdmin(aBoolean -> assertThat(aBoolean).isEqualTo(Boolean.TRUE)) + .assertPassword(Assert::assertNull) + .assertType(s -> assertThat(s).isEqualTo(type)) + .assertPasswordLinkDoesNotExists(); + } + + @Test + public void shouldGet403IfUserIsNotAdmin() { + String newUser = "user"; + String password = "pass"; + String type = "xml"; + TestData.createUser(newUser, password, false, type); + ScmRequests.start() + .given() + .url(TestData.getMeUrl()) + .usernameAndPassword(newUser, password) + .getUserResource() + .assertStatusCode(403); + } + + + +} diff --git a/scm-it/src/test/java/sonia/scm/it/utils/NullAwareJsonObjectBuilder.java b/scm-it/src/test/java/sonia/scm/it/utils/NullAwareJsonObjectBuilder.java new file mode 100644 index 0000000000..31a12f1969 --- /dev/null +++ b/scm-it/src/test/java/sonia/scm/it/utils/NullAwareJsonObjectBuilder.java @@ -0,0 +1,95 @@ +package sonia.scm.it.utils; + +import javax.json.JsonArrayBuilder; +import javax.json.JsonObject; +import javax.json.JsonObjectBuilder; +import javax.json.JsonValue; +import java.math.BigDecimal; +import java.math.BigInteger; + +public class NullAwareJsonObjectBuilder implements JsonObjectBuilder { + public static JsonObjectBuilder wrap(JsonObjectBuilder builder) { + if (builder == null) { + throw new IllegalArgumentException("Can't wrap nothing."); + } + return new NullAwareJsonObjectBuilder(builder); + } + + private final JsonObjectBuilder builder; + + private NullAwareJsonObjectBuilder(JsonObjectBuilder builder) { + this.builder = builder; + } + + public JsonObjectBuilder add(String name, JsonValue value) { + return builder.add(name, (value == null) ? JsonValue.NULL : value); + } + + @Override + public JsonObjectBuilder add(String name, String value) { + if (value != null){ + return builder.add(name, value ); + }else{ + return builder.addNull(name); + } + } + + @Override + public JsonObjectBuilder add(String name, BigInteger value) { + if (value != null){ + return builder.add(name, value ); + }else{ + return builder.addNull(name); + } + } + + @Override + public JsonObjectBuilder add(String name, BigDecimal value) { + if (value != null){ + return builder.add(name, value ); + }else{ + return builder.addNull(name); + } + } + + @Override + public JsonObjectBuilder add(String s, int i) { + return builder.add(s, i); + } + + @Override + public JsonObjectBuilder add(String s, long l) { + return builder.add(s, l); + } + + @Override + public JsonObjectBuilder add(String s, double v) { + return builder.add(s, v); + } + + @Override + public JsonObjectBuilder add(String s, boolean b) { + return builder.add(s, b); + } + + @Override + public JsonObjectBuilder addNull(String s) { + return builder.addNull(s); + } + + @Override + public JsonObjectBuilder add(String s, JsonObjectBuilder jsonObjectBuilder) { + return builder.add(s, jsonObjectBuilder); + } + + @Override + public JsonObjectBuilder add(String s, JsonArrayBuilder jsonArrayBuilder) { + return builder.add(s, jsonArrayBuilder); + } + + @Override + public JsonObject build() { + return builder.build(); + } + +} diff --git a/scm-it/src/test/java/sonia/scm/it/RegExMatcher.java b/scm-it/src/test/java/sonia/scm/it/utils/RegExMatcher.java similarity index 87% rename from scm-it/src/test/java/sonia/scm/it/RegExMatcher.java rename to scm-it/src/test/java/sonia/scm/it/utils/RegExMatcher.java index e5dc7931d3..10386a682f 100644 --- a/scm-it/src/test/java/sonia/scm/it/RegExMatcher.java +++ b/scm-it/src/test/java/sonia/scm/it/utils/RegExMatcher.java @@ -1,4 +1,4 @@ -package sonia.scm.it; +package sonia.scm.it.utils; import org.hamcrest.BaseMatcher; import org.hamcrest.Description; @@ -6,7 +6,7 @@ import org.hamcrest.Matcher; import java.util.regex.Pattern; -class RegExMatcher extends BaseMatcher { +public class RegExMatcher extends BaseMatcher { public static Matcher matchesPattern(String pattern) { return new RegExMatcher(pattern); } diff --git a/scm-it/src/test/java/sonia/scm/it/RepositoryUtil.java b/scm-it/src/test/java/sonia/scm/it/utils/RepositoryUtil.java similarity index 81% rename from scm-it/src/test/java/sonia/scm/it/RepositoryUtil.java rename to scm-it/src/test/java/sonia/scm/it/utils/RepositoryUtil.java index 96b92a0bed..2987780bcb 100644 --- a/scm-it/src/test/java/sonia/scm/it/RepositoryUtil.java +++ b/scm-it/src/test/java/sonia/scm/it/utils/RepositoryUtil.java @@ -1,4 +1,4 @@ -package sonia.scm.it; +package sonia.scm.it.utils; import com.google.common.base.Charsets; import com.google.common.io.Files; @@ -24,11 +24,11 @@ public class RepositoryUtil { private static final RepositoryClientFactory REPOSITORY_CLIENT_FACTORY = new RepositoryClientFactory(); - static RepositoryClient createRepositoryClient(String repositoryType, File folder) throws IOException { + public static RepositoryClient createRepositoryClient(String repositoryType, File folder) throws IOException { return createRepositoryClient(repositoryType, folder, "scmadmin", "scmadmin"); } - static RepositoryClient createRepositoryClient(String repositoryType, File folder, String username, String password) throws IOException { + public static RepositoryClient createRepositoryClient(String repositoryType, File folder, String username, String password) throws IOException { String httpProtocolUrl = TestData.callRepository(username, password, repositoryType, HttpStatus.SC_OK) .extract() .path("_links.httpProtocol.href"); @@ -36,14 +36,14 @@ public class RepositoryUtil { return REPOSITORY_CLIENT_FACTORY.create(repositoryType, httpProtocolUrl, username, password, folder); } - static String addAndCommitRandomFile(RepositoryClient client, String username) throws IOException { + public static String addAndCommitRandomFile(RepositoryClient client, String username) throws IOException { String uuid = UUID.randomUUID().toString(); String name = "file-" + uuid + ".uuid"; createAndCommitFile(client, username, name, uuid); return name; } - static Changeset createAndCommitFile(RepositoryClient repositoryClient, String username, String fileName, String content) throws IOException { + public static Changeset createAndCommitFile(RepositoryClient repositoryClient, String username, String fileName, String content) throws IOException { writeAndAddFile(repositoryClient, fileName, content); return commit(repositoryClient, username, "added " + fileName); } @@ -59,7 +59,7 @@ public class RepositoryUtil { * @return the changeset with all modifications * @throws IOException */ - static Changeset commitMultipleFileModifications(RepositoryClient repositoryClient, String username, Map addedFiles, Map modifiedFiles, List removedFiles) throws IOException { + public static Changeset commitMultipleFileModifications(RepositoryClient repositoryClient, String username, Map addedFiles, Map modifiedFiles, List removedFiles) throws IOException { for (String fileName : addedFiles.keySet()) { writeAndAddFile(repositoryClient, fileName, addedFiles.get(fileName)); } @@ -80,7 +80,7 @@ public class RepositoryUtil { return file; } - static Changeset removeAndCommitFile(RepositoryClient repositoryClient, String username, String fileName) throws IOException { + public static Changeset removeAndCommitFile(RepositoryClient repositoryClient, String username, String fileName) throws IOException { deleteFileAndApplyRemoveCommand(repositoryClient, fileName); return commit(repositoryClient, username, "removed " + fileName); } @@ -115,7 +115,7 @@ public class RepositoryUtil { return changeset; } - static Tag addTag(RepositoryClient repositoryClient, String revision, String tagName) throws IOException { + public static Tag addTag(RepositoryClient repositoryClient, String revision, String tagName) throws IOException { if (repositoryClient.isCommandSupported(ClientCommand.TAG)) { Tag tag = repositoryClient.getTagCommand().setRevision(revision).tag(tagName, TestData.USER_SCM_ADMIN); if (repositoryClient.isCommandSupported(ClientCommand.PUSH)) { diff --git a/scm-it/src/test/java/sonia/scm/it/RestUtil.java b/scm-it/src/test/java/sonia/scm/it/utils/RestUtil.java similarity index 97% rename from scm-it/src/test/java/sonia/scm/it/RestUtil.java rename to scm-it/src/test/java/sonia/scm/it/utils/RestUtil.java index a7409e1995..c8b01a6d72 100644 --- a/scm-it/src/test/java/sonia/scm/it/RestUtil.java +++ b/scm-it/src/test/java/sonia/scm/it/utils/RestUtil.java @@ -1,4 +1,4 @@ -package sonia.scm.it; +package sonia.scm.it.utils; import io.restassured.RestAssured; import io.restassured.specification.RequestSpecification; diff --git a/scm-it/src/test/java/sonia/scm/it/utils/ScmRequests.java b/scm-it/src/test/java/sonia/scm/it/utils/ScmRequests.java new file mode 100644 index 0000000000..41fd9a1290 --- /dev/null +++ b/scm-it/src/test/java/sonia/scm/it/utils/ScmRequests.java @@ -0,0 +1,465 @@ +package sonia.scm.it.utils; + +import io.restassured.RestAssured; +import io.restassured.response.Response; +import sonia.scm.web.VndMediaType; + +import java.net.URI; +import java.util.List; +import java.util.Map; +import java.util.function.Consumer; + +import static org.hamcrest.Matchers.is; +import static sonia.scm.it.utils.TestData.createPasswordChangeJson; + + +/** + * Encapsulate rest requests of a repository in builder pattern + *

+ * A Get Request can be applied with the methods request*() + * These methods return a AppliedGet*Request object + * This object can be used to apply general assertions over the rest Assured response + * In the AppliedGet*Request classes there is a using*Response() method + * that return the *Response class containing specific operations related to the specific response + * the *Response class contains also the request*() method to apply the next GET request from a link in the response. + */ +public class ScmRequests { + + private String url; + private String username; + private String password; + + public static ScmRequests start() { + return new ScmRequests(); + } + + public Given given() { + return new Given(); + } + + + /** + * Apply a GET Request to the extracted url from the given link + * + * @param linkPropertyName the property name of link + * @param response the response containing the link + * @return the response of the GET request using the given link + */ + private Response applyGETRequestFromLink(Response response, String linkPropertyName) { + return applyGETRequest(response + .then() + .extract() + .path(linkPropertyName)); + } + + + /** + * Apply a GET Request to the given url and return the response. + * + * @param url the url of the GET request + * @return the response of the GET request using the given url + */ + private Response applyGETRequest(String url) { + return RestAssured.given() + .auth().preemptive().basic(username, password) + .when() + .get(url); + } + + + /** + * Apply a PUT Request to the extracted url from the given link + * + * @param response the response containing the link + * @param linkPropertyName the property name of link + * @param body + * @return the response of the PUT request using the given link + */ + private Response applyPUTRequestFromLink(Response response, String linkPropertyName, String content, String body) { + return applyPUTRequest(response + .then() + .extract() + .path(linkPropertyName), content, body); + } + + + /** + * Apply a PUT Request to the given url and return the response. + * + * @param url the url of the PUT request + * @param mediaType + * @param body + * @return the response of the PUT request using the given url + */ + private Response applyPUTRequest(String url, String mediaType, String body) { + return RestAssured.given() + .auth().preemptive().basic(username, password) + .when() + .contentType(mediaType) + .accept(mediaType) + .body(body) + .put(url); + } + + + private void setUrl(String url) { + this.url = url; + } + + private void setUsername(String username) { + this.username = username; + } + + private void setPassword(String password) { + this.password = password; + } + + private String getUrl() { + return url; + } + + private String getUsername() { + return username; + } + + private String getPassword() { + return password; + } + + public class Given { + + public GivenUrl url(String url) { + setUrl(url); + return new GivenUrl(); + } + + public GivenUrl url(URI url) { + setUrl(url.toString()); + return new GivenUrl(); + } + + } + + public class GivenWithUrlAndAuth { + public AppliedMeRequest getMeResource() { + return new AppliedMeRequest(applyGETRequest(url)); + } + + public AppliedUserRequest getUserResource() { + return new AppliedUserRequest(applyGETRequest(url)); + } + + public AppliedRepositoryRequest getRepositoryResource() { + return new AppliedRepositoryRequest( + applyGETRequest(url) + ); + } + } + + public class AppliedRequest { + private Response response; + + public AppliedRequest(Response response) { + this.response = response; + } + + /** + * apply custom assertions to the actual response + * + * @param consumer consume the response in order to assert the content. the header, the payload etc.. + * @return the self object + */ + public SELF assertResponse(Consumer consumer) { + consumer.accept(response); + return (SELF) this; + } + + /** + * special assertion of the status code + * + * @param expectedStatusCode the expected status code + * @return the self object + */ + public SELF assertStatusCode(int expectedStatusCode) { + this.response.then().assertThat().statusCode(expectedStatusCode); + return (SELF) this; + } + + } + + public class AppliedRepositoryRequest extends AppliedRequest { + + public AppliedRepositoryRequest(Response response) { + super(response); + } + + public RepositoryResponse usingRepositoryResponse() { + return new RepositoryResponse(super.response); + } + } + + public class RepositoryResponse { + + private Response repositoryResponse; + + public RepositoryResponse(Response repositoryResponse) { + this.repositoryResponse = repositoryResponse; + } + + public AppliedSourcesRequest requestSources() { + return new AppliedSourcesRequest(applyGETRequestFromLink(repositoryResponse, "_links.sources.href")); + } + + public AppliedChangesetsRequest requestChangesets() { + return new AppliedChangesetsRequest(applyGETRequestFromLink(repositoryResponse, "_links.changesets.href")); + } + } + + public class AppliedChangesetsRequest extends AppliedRequest { + + public AppliedChangesetsRequest(Response response) { + super(response); + } + + public ChangesetsResponse usingChangesetsResponse() { + return new ChangesetsResponse(super.response); + } + } + + public class ChangesetsResponse { + private Response changesetsResponse; + + public ChangesetsResponse(Response changesetsResponse) { + this.changesetsResponse = changesetsResponse; + } + + public ChangesetsResponse assertChangesets(Consumer> changesetsConsumer) { + List changesets = changesetsResponse.then().extract().path("_embedded.changesets"); + changesetsConsumer.accept(changesets); + return this; + } + + public AppliedDiffRequest requestDiff(String revision) { + return new AppliedDiffRequest(applyGETRequestFromLink(changesetsResponse, "_embedded.changesets.find{it.id=='" + revision + "'}._links.diff.href")); + } + + public AppliedModificationsRequest requestModifications(String revision) { + return new AppliedModificationsRequest(applyGETRequestFromLink(changesetsResponse, "_embedded.changesets.find{it.id=='" + revision + "'}._links.modifications.href")); + } + } + + public class AppliedSourcesRequest extends AppliedRequest { + + public AppliedSourcesRequest(Response sourcesResponse) { + super(sourcesResponse); + } + + public SourcesResponse usingSourcesResponse() { + return new SourcesResponse(super.response); + } + } + + public class SourcesResponse { + + private Response sourcesResponse; + + public SourcesResponse(Response sourcesResponse) { + this.sourcesResponse = sourcesResponse; + } + + public SourcesResponse assertRevision(Consumer assertRevision) { + String revision = sourcesResponse.then().extract().path("revision"); + assertRevision.accept(revision); + return this; + } + + public SourcesResponse assertFiles(Consumer assertFiles) { + List files = sourcesResponse.then().extract().path("files"); + assertFiles.accept(files); + return this; + } + + public AppliedChangesetsRequest requestFileHistory(String fileName) { + return new AppliedChangesetsRequest(applyGETRequestFromLink(sourcesResponse, "_embedded.files.find{it.name=='" + fileName + "'}._links.history.href")); + } + + public AppliedSourcesRequest requestSelf(String fileName) { + return new AppliedSourcesRequest(applyGETRequestFromLink(sourcesResponse, "_embedded.files.find{it.name=='" + fileName + "'}._links.self.href")); + } + } + + public class AppliedDiffRequest extends AppliedRequest { + + public AppliedDiffRequest(Response response) { + super(response); + } + } + + public class GivenUrl { + + public GivenWithUrlAndAuth usernameAndPassword(String username, String password) { + setUsername(username); + setPassword(password); + return new GivenWithUrlAndAuth(); + } + } + + public class AppliedModificationsRequest extends AppliedRequest { + public AppliedModificationsRequest(Response response) { + super(response); + } + + public ModificationsResponse usingModificationsResponse() { + return new ModificationsResponse(super.response); + } + + } + + public class ModificationsResponse { + private Response resource; + + public ModificationsResponse(Response resource) { + this.resource = resource; + } + + public ModificationsResponse assertRevision(Consumer assertRevision) { + String revision = resource.then().extract().path("revision"); + assertRevision.accept(revision); + return this; + } + + public ModificationsResponse assertAdded(Consumer> assertAdded) { + List added = resource.then().extract().path("added"); + assertAdded.accept(added); + return this; + } + + public ModificationsResponse assertRemoved(Consumer> assertRemoved) { + List removed = resource.then().extract().path("removed"); + assertRemoved.accept(removed); + return this; + } + + public ModificationsResponse assertModified(Consumer> assertModified) { + List modified = resource.then().extract().path("modified"); + assertModified.accept(modified); + return this; + } + + } + + public class AppliedMeRequest extends AppliedRequest { + + public AppliedMeRequest(Response response) { + super(response); + } + + public MeResponse usingMeResponse() { + return new MeResponse(super.response); + } + + } + + public class MeResponse extends UserResponse { + + + public MeResponse(Response response) { + super(response); + } + + public AppliedChangePasswordRequest requestChangePassword(String oldPassword, String newPassword) { + return new AppliedChangePasswordRequest(applyPUTRequestFromLink(super.response, "_links.password.href", VndMediaType.PASSWORD_CHANGE, createPasswordChangeJson(oldPassword, newPassword))); + } + + + } + + public class UserResponse extends ModelResponse { + + public static final String LINKS_PASSWORD_HREF = "_links.password.href"; + + public UserResponse(Response response) { + super(response); + } + + public SELF assertPassword(Consumer assertPassword) { + return super.assertSingleProperty(assertPassword, "password"); + } + + public SELF assertType(Consumer assertType) { + return assertSingleProperty(assertType, "type"); + } + + public SELF assertAdmin(Consumer assertAdmin) { + return assertSingleProperty(assertAdmin, "admin"); + } + + public SELF assertPasswordLinkDoesNotExists() { + return assertPropertyPathDoesNotExists(LINKS_PASSWORD_HREF); + } + + public SELF assertPasswordLinkExists() { + return assertPropertyPathExists(LINKS_PASSWORD_HREF); + } + + public AppliedChangePasswordRequest requestChangePassword(String newPassword) { + return new AppliedChangePasswordRequest(applyPUTRequestFromLink(super.response, LINKS_PASSWORD_HREF, VndMediaType.PASSWORD_CHANGE, createPasswordChangeJson(null, newPassword))); + } + + } + + + /** + * encapsulate standard assertions over model properties + */ + public class ModelResponse { + + protected Response response; + + public ModelResponse(Response response) { + this.response = response; + } + + public SELF assertSingleProperty(Consumer assertSingleProperty, String propertyJsonPath) { + T propertyValue = response.then().extract().path(propertyJsonPath); + assertSingleProperty.accept(propertyValue); + return (SELF) this; + } + + public SELF assertPropertyPathExists(String propertyJsonPath) { + response.then().assertThat().body("any { it.containsKey('" + propertyJsonPath + "')}", is(true)); + return (SELF) this; + } + + public SELF assertPropertyPathDoesNotExists(String propertyJsonPath) { + response.then().assertThat().body("this.any { it.containsKey('" + propertyJsonPath + "')}", is(false)); + return (SELF) this; + } + + public SELF assertArrayProperty(Consumer assertProperties, String propertyJsonPath) { + List properties = response.then().extract().path(propertyJsonPath); + assertProperties.accept(properties); + return (SELF) this; + } + } + + public class AppliedChangePasswordRequest extends AppliedRequest { + + public AppliedChangePasswordRequest(Response response) { + super(response); + } + + } + + public class AppliedUserRequest extends AppliedRequest { + + public AppliedUserRequest(Response response) { + super(response); + } + + public UserResponse usingUserResponse() { + return new UserResponse(super.response); + } + + } +} diff --git a/scm-it/src/test/java/sonia/scm/it/ScmTypes.java b/scm-it/src/test/java/sonia/scm/it/utils/ScmTypes.java similarity index 72% rename from scm-it/src/test/java/sonia/scm/it/ScmTypes.java rename to scm-it/src/test/java/sonia/scm/it/utils/ScmTypes.java index e8ba67e561..4c9ac0ea44 100644 --- a/scm-it/src/test/java/sonia/scm/it/ScmTypes.java +++ b/scm-it/src/test/java/sonia/scm/it/utils/ScmTypes.java @@ -1,12 +1,12 @@ -package sonia.scm.it; +package sonia.scm.it.utils; import sonia.scm.util.IOUtil; import java.util.ArrayList; import java.util.Collection; -class ScmTypes { - static Collection availableScmTypes() { +public class ScmTypes { + public static Collection availableScmTypes() { Collection params = new ArrayList<>(); params.add("git"); diff --git a/scm-it/src/test/java/sonia/scm/it/TestData.java b/scm-it/src/test/java/sonia/scm/it/utils/TestData.java similarity index 77% rename from scm-it/src/test/java/sonia/scm/it/TestData.java rename to scm-it/src/test/java/sonia/scm/it/utils/TestData.java index ae0e35004d..03da80ea3b 100644 --- a/scm-it/src/test/java/sonia/scm/it/TestData.java +++ b/scm-it/src/test/java/sonia/scm/it/utils/TestData.java @@ -1,4 +1,4 @@ -package sonia.scm.it; +package sonia.scm.it.utils; import io.restassured.response.ValidatableResponse; import org.apache.http.HttpStatus; @@ -8,14 +8,16 @@ import sonia.scm.repository.PermissionType; import sonia.scm.web.VndMediaType; import javax.json.Json; +import javax.json.JsonObjectBuilder; +import java.net.URI; import java.util.HashMap; import java.util.List; import java.util.Map; import static java.util.Arrays.asList; -import static sonia.scm.it.RestUtil.createResourceUrl; -import static sonia.scm.it.RestUtil.given; -import static sonia.scm.it.ScmTypes.availableScmTypes; +import static sonia.scm.it.utils.RestUtil.createResourceUrl; +import static sonia.scm.it.utils.RestUtil.given; +import static sonia.scm.it.utils.ScmTypes.availableScmTypes; public class TestData { @@ -26,6 +28,7 @@ public class TestData { private static final List PROTECTED_USERS = asList(USER_SCM_ADMIN, USER_ANONYMOUS); private static Map DEFAULT_REPOSITORIES = new HashMap<>(); + public static final JsonObjectBuilder JSON_BUILDER = NullAwareJsonObjectBuilder.wrap(Json.createObjectBuilder()); public static void createDefault() { cleanup(); @@ -44,27 +47,31 @@ public class TestData { } public static void createUser(String username, String password) { + createUser(username, password, false, "xml"); + } + + public static void createUser(String username, String password, boolean isAdmin, String type) { LOG.info("create user with username: {}", username); + String admin = isAdmin ? "true" : "false"; given(VndMediaType.USER) .when() - .content(" {\n" + - " \"active\": true,\n" + - " \"admin\": false,\n" + - " \"creationDate\": \"2018-08-21T12:26:46.084Z\",\n" + - " \"displayName\": \"" + username + "\",\n" + - " \"mail\": \"user1@scm-manager.org\",\n" + - " \"name\": \"" + username + "\",\n" + - " \"password\": \"" + password + "\",\n" + - " \"type\": \"xml\"\n" + - " \n" + - " }") - .post(createResourceUrl("users")) + .content(new StringBuilder() + .append(" {\n") + .append(" \"active\": true,\n") + .append(" \"admin\": ").append(admin).append(",\n") + .append(" \"creationDate\": \"2018-08-21T12:26:46.084Z\",\n") + .append(" \"displayName\": \"").append(username).append("\",\n") + .append(" \"mail\": \"user1@scm-manager.org\",\n") + .append(" \"name\": \"").append(username).append("\",\n") + .append(" \"password\": \"").append(password).append("\",\n") + .append(" \"type\": \"").append(type).append("\"\n") + .append(" }").toString()) + .post(getUsersUrl()) .then() .statusCode(HttpStatus.SC_CREATED) ; } - public static void createUserPermission(String name, PermissionType permissionType, String repositoryType) { String defaultPermissionUrl = TestData.getDefaultPermissionUrl(USER_SCM_ADMIN, USER_SCM_ADMIN, repositoryType); LOG.info("create permission with name {} and type: {} using the endpoint: {}", name, permissionType, defaultPermissionUrl); @@ -183,7 +190,7 @@ public class TestData { } public static String repositoryJson(String repositoryType) { - return Json.createObjectBuilder() + return JSON_BUILDER .add("contact", "zaphod.beeblebrox@hitchhiker.com") .add("description", "Heart of Gold") .add("name", "HeartOfGold-" + repositoryType) @@ -192,6 +199,29 @@ public class TestData { .build().toString(); } + public static URI getMeUrl() { + return RestUtil.createResourceUrl("me/"); + + } + + public static URI getUsersUrl() { + return RestUtil.createResourceUrl("users/"); + + } + + public static URI getUserUrl(String username) { + return getUsersUrl().resolve(username); + + } + + + public static String createPasswordChangeJson(String oldPassword, String newPassword) { + return JSON_BUILDER + .add("oldPassword", oldPassword) + .add("newPassword", newPassword) + .build().toString(); + } + public static void main(String[] args) { cleanup(); } diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedExceptionMapper.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedExceptionMapper.java index e83be3e386..e9bb5304a5 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedExceptionMapper.java +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ChangePasswordNotAllowedExceptionMapper.java @@ -1,5 +1,7 @@ package sonia.scm.api.v2.resources; +import sonia.scm.user.ChangePasswordNotAllowedException; + import javax.ws.rs.core.Response; import javax.ws.rs.ext.ExceptionMapper; import javax.ws.rs.ext.Provider; diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/InvalidPasswordExceptionMapper.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/InvalidPasswordExceptionMapper.java new file mode 100644 index 0000000000..eda850d6ce --- /dev/null +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/InvalidPasswordExceptionMapper.java @@ -0,0 +1,17 @@ +package sonia.scm.api.v2.resources; + +import sonia.scm.user.InvalidPasswordException; + +import javax.ws.rs.core.Response; +import javax.ws.rs.ext.ExceptionMapper; +import javax.ws.rs.ext.Provider; + +@Provider +public class InvalidPasswordExceptionMapper implements ExceptionMapper { + @Override + public Response toResponse(InvalidPasswordException exception) { + return Response.status(Response.Status.UNAUTHORIZED) + .entity(exception.getMessage()) + .build(); + } +} diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MapperModule.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MapperModule.java index bebd7def23..a600d1f45a 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MapperModule.java +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MapperModule.java @@ -8,6 +8,7 @@ public class MapperModule extends AbstractModule { @Override protected void configure() { bind(UserDtoToUserMapper.class).to(Mappers.getMapper(UserDtoToUserMapper.class).getClass()); + bind(MeToUserDtoMapper.class).to(Mappers.getMapper(MeToUserDtoMapper.class).getClass()); bind(UserToUserDtoMapper.class).to(Mappers.getMapper(UserToUserDtoMapper.class).getClass()); bind(UserCollectionToDtoMapper.class); diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeResource.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeResource.java index 2967c0be4e..da9489a4bb 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeResource.java +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeResource.java @@ -4,7 +4,10 @@ import com.webcohesion.enunciate.metadata.rs.ResponseCode; import com.webcohesion.enunciate.metadata.rs.StatusCodes; import com.webcohesion.enunciate.metadata.rs.TypeHint; import org.apache.shiro.SecurityUtils; +import org.apache.shiro.authc.credential.PasswordService; +import sonia.scm.ConcurrentModificationException; import sonia.scm.NotFoundException; +import sonia.scm.user.InvalidPasswordException; import sonia.scm.user.User; import sonia.scm.user.UserManager; import sonia.scm.web.VndMediaType; @@ -19,6 +22,7 @@ import javax.ws.rs.core.Context; import javax.ws.rs.core.Request; import javax.ws.rs.core.Response; import javax.ws.rs.core.UriInfo; +import java.util.function.Consumer; /** @@ -26,15 +30,20 @@ import javax.ws.rs.core.UriInfo; */ @Path(MeResource.ME_PATH_V2) public class MeResource { - static final String ME_PATH_V2 = "v2/me/"; + public static final String ME_PATH_V2 = "v2/me/"; - private final UserToUserDtoMapper userToDtoMapper; + private final MeToUserDtoMapper meToUserDtoMapper; private final IdResourceManagerAdapter adapter; + private final PasswordService passwordService; + private final UserManager userManager; + @Inject - public MeResource(UserToUserDtoMapper userToDtoMapper, UserManager manager) { - this.userToDtoMapper = userToDtoMapper; + public MeResource(MeToUserDtoMapper meToUserDtoMapper, UserManager manager, PasswordService passwordService) { + this.meToUserDtoMapper = meToUserDtoMapper; this.adapter = new IdResourceManagerAdapter<>(manager, User.class); + this.passwordService = passwordService; + this.userManager = manager; } /** @@ -52,7 +61,7 @@ public class MeResource { public Response get(@Context Request request, @Context UriInfo uriInfo) throws NotFoundException { String id = (String) SecurityUtils.getSubject().getPrincipals().getPrimaryPrincipal(); - return adapter.get(id, userToDtoMapper::map); + return adapter.get(id, meToUserDtoMapper::map); } /** @@ -67,8 +76,19 @@ public class MeResource { }) @TypeHint(TypeHint.NO_CONTENT.class) @Consumes(VndMediaType.PASSWORD_CHANGE) - public Response changePassword(PasswordChangeDto passwordChange) throws NotFoundException { - String id = (String) SecurityUtils.getSubject().getPrincipals().getPrimaryPrincipal(); - return adapter.get(id, userToDtoMapper::map); + public Response changePassword(PasswordChangeDto passwordChangeDto) throws NotFoundException, ConcurrentModificationException { + String name = (String) SecurityUtils.getSubject().getPrincipals().getPrimaryPrincipal(); + return adapter.update(name, user -> user.changePassword(passwordService.encryptPassword(passwordChangeDto.getNewPassword())), userManager.getUserTypeChecker().andThen(getOldOriginalPasswordChecker(passwordChangeDto.getOldPassword()))); + } + + /** + * Match given old password from the dto with the stored password before updating + */ + private Consumer getOldOriginalPasswordChecker(String oldPassword) { + return user -> { + if (!user.getPassword().equals(passwordService.encryptPassword(oldPassword))) { + throw new InvalidPasswordException("The password is invalid"); + } + }; } } diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeToUserDtoMapper.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeToUserDtoMapper.java new file mode 100644 index 0000000000..b79dd9a766 --- /dev/null +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/MeToUserDtoMapper.java @@ -0,0 +1,41 @@ +package sonia.scm.api.v2.resources; + +import de.otto.edison.hal.Links; +import org.mapstruct.AfterMapping; +import org.mapstruct.Mapper; +import org.mapstruct.MappingTarget; +import sonia.scm.user.User; +import sonia.scm.user.UserManager; +import sonia.scm.user.UserPermissions; + +import javax.inject.Inject; + +import static de.otto.edison.hal.Link.link; +import static de.otto.edison.hal.Links.linkingTo; + +@Mapper +public abstract class MeToUserDtoMapper extends UserToUserDtoMapper{ + + @Inject + private UserManager userManager; + + @Inject + private ResourceLinks resourceLinks; + + + @AfterMapping + void appendLinks(User user, @MappingTarget UserDto target) { + Links.Builder linksBuilder = linkingTo().self(resourceLinks.me().self()); + if (UserPermissions.delete(user).isPermitted()) { + linksBuilder.single(link("delete", resourceLinks.me().delete(target.getName()))); + } + if (UserPermissions.modify(user).isPermitted()) { + linksBuilder.single(link("update", resourceLinks.me().update(target.getName()))); + } + if (userManager.isTypeDefault(user)) { + linksBuilder.single(link("password", resourceLinks.me().passwordChange())); + } + target.add(linksBuilder.build()); + } + +} diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ResourceLinks.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ResourceLinks.java index 1faa38a10c..f1f7b80ba8 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ResourceLinks.java +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/ResourceLinks.java @@ -92,6 +92,37 @@ class ResourceLinks { } } + MeLinks me() { + return new MeLinks(uriInfoStore.get(), this.user()); + } + + static class MeLinks { + private final LinkBuilder meLinkBuilder; + private UserLinks userLinks; + + MeLinks(UriInfo uriInfo, UserLinks user) { + meLinkBuilder = new LinkBuilder(uriInfo, MeResource.class); + userLinks = user; + } + + String self() { + return meLinkBuilder.method("get").parameters().href(); + } + + String delete(String name) { + return userLinks.delete(name); + } + + String update(String name) { + return userLinks.update(name); + } + + public String passwordChange() { + return meLinkBuilder.method("changePassword").parameters().href(); + } + } + + UserCollectionLinks userCollection() { return new UserCollectionLinks(uriInfoStore.get()); } diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserResource.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserResource.java index 126d738e1e..714ca432ee 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserResource.java +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserResource.java @@ -20,8 +20,6 @@ import javax.ws.rs.Path; import javax.ws.rs.PathParam; import javax.ws.rs.Produces; import javax.ws.rs.core.Response; -import java.text.MessageFormat; -import java.util.function.Consumer; public class UserResource { @@ -130,18 +128,7 @@ public class UserResource { }) @TypeHint(TypeHint.NO_CONTENT.class) public Response changePassword(@PathParam("id") String name, @Valid PasswordChangeDto passwordChangeDto) throws NotFoundException, ConcurrentModificationException { - return adapter.update(name, user -> user.changePassword(passwordService.encryptPassword(passwordChangeDto.getNewPassword())), getUserTypeChecker()); + return adapter.update(name, user -> user.changePassword(passwordService.encryptPassword(passwordChangeDto.getNewPassword())), userManager.getUserTypeChecker()); } - - /** - * Only account of the default type "xml" can change their password - */ - private Consumer getUserTypeChecker() { - return user -> { - if (!userManager.getDefaultType().equals(user.getType())) { - throw new ChangePasswordNotAllowedException(MessageFormat.format("It is not possible to change password for User of type {0}", user.getType())); - } - }; - } } diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserToUserDtoMapper.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserToUserDtoMapper.java index 75566c1c3b..d23f8de744 100644 --- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserToUserDtoMapper.java +++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/UserToUserDtoMapper.java @@ -45,7 +45,7 @@ public abstract class UserToUserDtoMapper extends BaseMapper { if (UserPermissions.modify(user).isPermitted()) { linksBuilder.single(link("update", resourceLinks.user().update(target.getName()))); } - if (userManager.getDefaultType().equals(user.getType())) { + if (userManager.isTypeDefault(user)) { linksBuilder.single(link("password", resourceLinks.user().passwordChange(target.getName()))); } target.add(linksBuilder.build()); diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/DispatcherMock.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/DispatcherMock.java index dc6a4095df..a1abdb6ff4 100644 --- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/DispatcherMock.java +++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/DispatcherMock.java @@ -16,6 +16,7 @@ public class DispatcherMock { dispatcher.getProviderFactory().registerProvider(ConcurrentModificationExceptionMapper.class); dispatcher.getProviderFactory().registerProvider(InternalRepositoryExceptionMapper.class); dispatcher.getProviderFactory().registerProvider(ChangePasswordNotAllowedExceptionMapper.class); + dispatcher.getProviderFactory().registerProvider(InvalidPasswordExceptionMapper.class); return dispatcher; } } diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeResourceTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeResourceTest.java index 340533b5d2..b0109d86b7 100644 --- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeResourceTest.java +++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeResourceTest.java @@ -2,8 +2,8 @@ package sonia.scm.api.v2.resources; import com.github.sdorra.shiro.ShiroRule; import com.github.sdorra.shiro.SubjectAware; +import org.apache.shiro.authc.credential.PasswordService; import org.jboss.resteasy.core.Dispatcher; -import org.jboss.resteasy.mock.MockDispatcherFactory; import org.jboss.resteasy.mock.MockHttpRequest; import org.jboss.resteasy.mock.MockHttpResponse; import org.junit.Before; @@ -23,11 +23,17 @@ import java.net.URISyntaxException; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertTrue; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.ArgumentMatchers.eq; import static org.mockito.Mockito.doNothing; +import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; import static org.mockito.MockitoAnnotations.initMocks; +import static sonia.scm.api.v2.resources.DispatcherMock.createDispatcher; @SubjectAware( + username = "trillian", + password = "secret", configuration = "classpath:sonia/scm/repository/shiro.ini" ) public class MeResourceTest { @@ -35,8 +41,7 @@ public class MeResourceTest { @Rule public ShiroRule shiro = new ShiroRule(); - private Dispatcher dispatcher = MockDispatcherFactory.createDispatcher(); - + private Dispatcher dispatcher; private final ResourceLinks resourceLinks = ResourceLinksMock.createMock(URI.create("/")); @Mock @@ -48,21 +53,27 @@ public class MeResourceTest { private UserManager userManager; @InjectMocks - private UserToUserDtoMapperImpl userToDtoMapper; + private MeToUserDtoMapperImpl userToDtoMapper; private ArgumentCaptor userCaptor = ArgumentCaptor.forClass(User.class); + @Mock + private PasswordService passwordService; + private User originalUser; + @Before public void prepareEnvironment() throws Exception { initMocks(this); - createDummyUser("trillian"); + originalUser = createDummyUser("trillian"); when(userManager.create(userCaptor.capture())).thenAnswer(invocation -> invocation.getArguments()[0]); doNothing().when(userManager).modify(userCaptor.capture()); doNothing().when(userManager).delete(userCaptor.capture()); + when(userManager.isTypeDefault(userCaptor.capture())).thenCallRealMethod(); + when(userManager.getUserTypeChecker()).thenCallRealMethod(); when(userManager.getDefaultType()).thenReturn("xml"); userToDtoMapper.setResourceLinks(resourceLinks); - MeResource meResource = new MeResource(userToDtoMapper, userManager); - dispatcher.getRegistry().addSingletonResource(meResource); + MeResource meResource = new MeResource(userToDtoMapper, userManager, passwordService); + dispatcher = createDispatcher(meResource); when(uriInfo.getBaseUri()).thenReturn(URI.create("/")); when(uriInfoStore.get()).thenReturn(uriInfo); } @@ -79,13 +90,77 @@ public class MeResourceTest { assertEquals(HttpServletResponse.SC_OK, response.getStatus()); assertTrue(response.getContentAsString().contains("\"name\":\"trillian\"")); assertTrue(response.getContentAsString().contains("\"password\":null")); - assertTrue(response.getContentAsString().contains("\"self\":{\"href\":\"/v2/users/trillian\"}")); + assertTrue(response.getContentAsString().contains("\"self\":{\"href\":\"/v2/me/\"}")); assertTrue(response.getContentAsString().contains("\"delete\":{\"href\":\"/v2/users/trillian\"}")); } + @Test + @SubjectAware(username = "trillian", password = "secret") + public void shouldEncryptPasswordBeforeChanging() throws Exception { + String newPassword = "pwd123"; + String encryptedNewPassword = "encrypted123"; + String oldPassword = "notEncriptedSecret"; + String content = String.format("{ \"oldPassword\": \"%s\" , \"newPassword\": \"%s\" }", oldPassword, newPassword); + MockHttpRequest request = MockHttpRequest + .put("/" + MeResource.ME_PATH_V2 + "password") + .contentType(VndMediaType.PASSWORD_CHANGE) + .content(content.getBytes()); + MockHttpResponse response = new MockHttpResponse(); + when(passwordService.encryptPassword(eq(newPassword))).thenReturn(encryptedNewPassword); + when(passwordService.encryptPassword(eq(oldPassword))).thenReturn("secret"); + + dispatcher.invoke(request, response); + + assertEquals(HttpServletResponse.SC_NO_CONTENT, response.getStatus()); + verify(userManager).modify(any(User.class)); + User updatedUser = userCaptor.getValue(); + assertEquals(encryptedNewPassword, updatedUser.getPassword()); + } + + @Test + @SubjectAware(username = "trillian", password = "secret") + public void shouldGet400OnChangePasswordOfUserWithNonDefaultType() throws Exception { + originalUser.setType("not an xml type"); + String newPassword = "pwd123"; + String oldPassword = "notEncriptedSecret"; + String content = String.format("{ \"oldPassword\": \"%s\" , \"newPassword\": \"%s\" }", oldPassword, newPassword); + MockHttpRequest request = MockHttpRequest + .put("/" + MeResource.ME_PATH_V2 + "password") + .contentType(VndMediaType.PASSWORD_CHANGE) + .content(content.getBytes()); + MockHttpResponse response = new MockHttpResponse(); + when(passwordService.encryptPassword(newPassword)).thenReturn("encrypted123"); + when(passwordService.encryptPassword(eq(oldPassword))).thenReturn("secret"); + + dispatcher.invoke(request, response); + + assertEquals(HttpServletResponse.SC_BAD_REQUEST, response.getStatus()); + } + + @Test + @SubjectAware(username = "trillian", password = "secret") + public void shouldGet401OnChangePasswordIfOldPasswordDoesNotMatchOriginalPassword() throws Exception { + String newPassword = "pwd123"; + String oldPassword = "notEncriptedSecret"; + String content = String.format("{ \"oldPassword\": \"%s\" , \"newPassword\": \"%s\" }", oldPassword, newPassword); + MockHttpRequest request = MockHttpRequest + .put("/" + MeResource.ME_PATH_V2 + "password") + .contentType(VndMediaType.PASSWORD_CHANGE) + .content(content.getBytes()); + MockHttpResponse response = new MockHttpResponse(); + when(passwordService.encryptPassword(newPassword)).thenReturn("encrypted123"); + when(passwordService.encryptPassword(eq(oldPassword))).thenReturn("differentThanSecret"); + + dispatcher.invoke(request, response); + + assertEquals(HttpServletResponse.SC_UNAUTHORIZED, response.getStatus()); + } + + private User createDummyUser(String name) { User user = new User(); user.setName(name); + user.setType("xml"); user.setPassword("secret"); user.setCreationDate(System.currentTimeMillis()); when(userManager.get(name)).thenReturn(user); diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeToUserDtoMapperTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeToUserDtoMapperTest.java new file mode 100644 index 0000000000..4f40098da5 --- /dev/null +++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/MeToUserDtoMapperTest.java @@ -0,0 +1,135 @@ +package sonia.scm.api.v2.resources; + +import org.apache.shiro.subject.Subject; +import org.apache.shiro.subject.support.SubjectThreadState; +import org.apache.shiro.util.ThreadContext; +import org.apache.shiro.util.ThreadState; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.mockito.InjectMocks; +import org.mockito.Mock; +import sonia.scm.user.User; +import sonia.scm.user.UserManager; + +import java.net.URI; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.mockito.ArgumentMatchers.eq; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; +import static org.mockito.MockitoAnnotations.initMocks; + +public class MeToUserDtoMapperTest { + + private final URI baseUri = URI.create("http://example.com/base/"); + @SuppressWarnings("unused") // Is injected + private final ResourceLinks resourceLinks = ResourceLinksMock.createMock(baseUri); + + @Mock + private UserManager userManager; + + @InjectMocks + private MeToUserDtoMapperImpl mapper; + + private final Subject subject = mock(Subject.class); + private final ThreadState subjectThreadState = new SubjectThreadState(subject); + + private URI expectedBaseUri; + private URI expectedUserBaseUri; + + @Before + public void init() { + initMocks(this); + when(userManager.getDefaultType()).thenReturn("xml"); + expectedBaseUri = baseUri.resolve(MeResource.ME_PATH_V2 + "/"); + expectedUserBaseUri = baseUri.resolve(UserRootResource.USERS_PATH_V2 + "/"); + subjectThreadState.bind(); + ThreadContext.bind(subject); + } + + @After + public void unbindSubject() { + ThreadContext.unbindSubject(); + } + + @Test + public void shouldMapTheUpdateLink() { + User user = createDefaultUser(); + when(subject.isPermitted("user:modify:abc")).thenReturn(true); + + UserDto userDto = mapper.map(user); + assertEquals("expected update link", expectedUserBaseUri.resolve("abc").toString(), userDto.getLinks().getLinkBy("update").get().getHref()); + + when(subject.isPermitted("user:modify:abc")).thenReturn(false); + userDto = mapper.map(user); + assertFalse("expected no update link", userDto.getLinks().getLinkBy("update").isPresent()); + } + + @Test + public void shouldMapTheSelfLink() { + User user = createDefaultUser(); + when(subject.isPermitted("user:modify:abc")).thenReturn(true); + + UserDto userDto = mapper.map(user); + assertEquals("expected self link", expectedBaseUri.toString(), userDto.getLinks().getLinkBy("self").get().getHref()); + + } + + @Test + public void shouldMapTheDeleteLink() { + User user = createDefaultUser(); + when(subject.isPermitted("user:delete:abc")).thenReturn(true); + + UserDto userDto = mapper.map(user); + assertEquals("expected update link", expectedUserBaseUri.resolve("abc").toString(), userDto.getLinks().getLinkBy("delete").get().getHref()); + + when(subject.isPermitted("user:delete:abc")).thenReturn(false); + userDto = mapper.map(user); + assertFalse("expected no delete link", userDto.getLinks().getLinkBy("delete").isPresent()); + } + + @Test + public void shouldGetPasswordLinkOnlyForDefaultUserType() { + User user = createDefaultUser(); + when(subject.isPermitted("user:modify:abc")).thenReturn(true); + when(userManager.isTypeDefault(eq(user))).thenReturn(true); + + UserDto userDto = mapper.map(user); + + assertEquals("expected password link with modify permission", expectedBaseUri.resolve("password").toString(), userDto.getLinks().getLinkBy("password").get().getHref()); + + when(subject.isPermitted("user:modify:abc")).thenReturn(false); + userDto = mapper.map(user); + assertEquals("expected password link on mission modify permission", expectedBaseUri.resolve("password").toString(), userDto.getLinks().getLinkBy("password").get().getHref()); + + when(userManager.isTypeDefault(eq(user))).thenReturn(false); + + userDto = mapper.map(user); + + assertFalse("expected no password link", userDto.getLinks().getLinkBy("password").isPresent()); + } + + + @Test + public void shouldGetEmptyPasswordProperty() { + User user = createDefaultUser(); + user.setPassword("myHighSecurePassword"); + when(subject.isPermitted("user:modify:abc")).thenReturn(true); + + UserDto userDto = mapper.map(user); + + assertThat(userDto.getPassword()).as("hide password for the me resource").isBlank(); + } + + private User createDefaultUser() { + User user = new User(); + user.setName("abc"); + user.setCreationDate(1L); + return user; + } + + +} diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/ResourceLinksMock.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/ResourceLinksMock.java index 1d0fac68e3..5e5897eb2a 100644 --- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/ResourceLinksMock.java +++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/ResourceLinksMock.java @@ -13,7 +13,9 @@ public class ResourceLinksMock { UriInfo uriInfo = mock(UriInfo.class); when(uriInfo.getBaseUri()).thenReturn(baseUri); - when(resourceLinks.user()).thenReturn(new ResourceLinks.UserLinks(uriInfo)); + ResourceLinks.UserLinks userLinks = new ResourceLinks.UserLinks(uriInfo); + when(resourceLinks.user()).thenReturn(userLinks); + when(resourceLinks.me()).thenReturn(new ResourceLinks.MeLinks(uriInfo,userLinks)); when(resourceLinks.userCollection()).thenReturn(new ResourceLinks.UserCollectionLinks(uriInfo)); when(resourceLinks.group()).thenReturn(new ResourceLinks.GroupLinks(uriInfo)); when(resourceLinks.groupCollection()).thenReturn(new ResourceLinks.GroupCollectionLinks(uriInfo)); diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserRootResourceTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserRootResourceTest.java index d75fd606ec..35cd755a5d 100644 --- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserRootResourceTest.java +++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserRootResourceTest.java @@ -68,6 +68,8 @@ public class UserRootResourceTest { initMocks(this); originalUser = createDummyUser("Neo"); when(userManager.create(userCaptor.capture())).thenAnswer(invocation -> invocation.getArguments()[0]); + when(userManager.isTypeDefault(userCaptor.capture())).thenCallRealMethod(); + when(userManager.getUserTypeChecker()).thenCallRealMethod(); doNothing().when(userManager).modify(userCaptor.capture()); doNothing().when(userManager).delete(userCaptor.capture()); when(userManager.getDefaultType()).thenReturn("xml"); @@ -114,7 +116,7 @@ public class UserRootResourceTest { @Test public void shouldEncryptPasswordBeforeChanging() throws Exception { String newPassword = "pwd123"; - String content = MessageFormat.format("'{'\"newPassword\": \"{0}\"'}'", newPassword); + String content = String.format("{\"newPassword\": \"%s\"}", newPassword); MockHttpRequest request = MockHttpRequest .put("/" + UserRootResource.USERS_PATH_V2 + "Neo/password") .contentType(VndMediaType.PASSWORD_CHANGE) @@ -134,7 +136,7 @@ public class UserRootResourceTest { public void shouldGet400OnChangePasswordOfUserWithNonDefaultType() throws Exception { originalUser.setType("not an xml type"); String newPassword = "pwd123"; - String content = MessageFormat.format("'{'\"newPassword\": \"{0}\"'}'", newPassword); + String content = String.format("{\"newPassword\": \"%s\"}", newPassword); MockHttpRequest request = MockHttpRequest .put("/" + UserRootResource.USERS_PATH_V2 + "Neo/password") .contentType(VndMediaType.PASSWORD_CHANGE) diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserToUserDtoMapperTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserToUserDtoMapperTest.java index 4c9388cd18..7570a3f162 100644 --- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserToUserDtoMapperTest.java +++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/UserToUserDtoMapperTest.java @@ -18,6 +18,7 @@ import java.time.Instant; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; +import static org.mockito.ArgumentMatchers.eq; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; import static org.mockito.MockitoAnnotations.initMocks; @@ -67,12 +68,17 @@ public class UserToUserDtoMapperTest { public void shouldGetPasswordLinkOnlyForDefaultUserType() { User user = createDefaultUser(); when(subject.isPermitted("user:modify:abc")).thenReturn(true); - user.setType("xml"); + when(userManager.isTypeDefault(eq(user))).thenReturn(true); UserDto userDto = mapper.map(user); - assertEquals("expected password link", expectedBaseUri.resolve("abc/password").toString(), userDto.getLinks().getLinkBy("password").get().getHref()); - user.setType("db"); + assertEquals("expected password link with modify permission", expectedBaseUri.resolve("abc/password").toString(), userDto.getLinks().getLinkBy("password").get().getHref()); + + when(subject.isPermitted("user:modify:abc")).thenReturn(false); + userDto = mapper.map(user); + assertEquals("expected password link on mission modify permission", expectedBaseUri.resolve("abc/password").toString(), userDto.getLinks().getLinkBy("password").get().getHref()); + + when(userManager.isTypeDefault(eq(user))).thenReturn(false); userDto = mapper.map(user);