1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17 package org.apache.juneau.rest.annotation;
18
19 import org.apache.juneau.*;
20 import org.apache.juneau.rest.*;
21 import org.apache.juneau.rest.guard.*;
22 import org.apache.juneau.rest.mock.*;
23 import org.junit.jupiter.api.*;
24
25 class RestOp_Guards_Test extends TestBase {
26
27
28
29
30
31 @Rest
32 public static class A {
33 @RestOp(guards=A1.class)
34 public String a1() {
35 return "OK-a1";
36 }
37 @RestOp(guards={A1.class,A2.class})
38 public String a2() {
39 return "OK-a2";
40 }
41 @RestGet(guards=A1.class)
42 public String b1() {
43 return "OK-b1";
44 }
45 @RestGet(guards={A1.class,A2.class})
46 public String b2() {
47 return "OK-b2";
48 }
49 @RestPut(guards=A1.class)
50 public String c1() {
51 return "OK-c1";
52 }
53 @RestPut(guards={A1.class,A2.class})
54 public String c2() {
55 return "OK-c2";
56 }
57 @RestPost(guards=A1.class)
58 public String d1() {
59 return "OK-d1";
60 }
61 @RestPost(guards={A1.class,A2.class})
62 public String d2() {
63 return "OK-d2";
64 }
65 @RestDelete(guards=A1.class)
66 public String e1() {
67 return "OK-e1";
68 }
69 @RestDelete(guards={A1.class,A2.class})
70 public String e2() {
71 return "OK-e2";
72 }
73 public static class A1 extends RestGuard {
74 @Override
75 public boolean isRequestAllowed(RestRequest req) {
76 return req.getQueryParam("t1").orElse("").equals("1");
77 }
78 }
79 public static class A2 extends RestGuard {
80 @Override
81 public boolean isRequestAllowed(RestRequest req) {
82 return req.getQueryParam("t2").orElse("").equals("2");
83 }
84 }
85 }
86
87 @Test void a01_basic() throws Exception {
88 var a = MockRestClient.buildLax(A.class);
89
90 a.get("/a1?t1=1")
91 .run()
92 .assertContent("OK-a1");
93 a.get("/a1?noTrace=true")
94 .run()
95 .assertStatus(403)
96 .assertContent().isContains("Access denied by guard");
97 a.get("/a2?noTrace=true")
98 .run()
99 .assertStatus(403)
100 .assertContent().isContains("Access denied by guard");
101 a.get("/a2?noTrace=true&t1=1")
102 .run()
103 .assertStatus(403)
104 .assertContent().isContains("Access denied by guard");
105 a.get("/a2?noTrace=true&t2=2")
106 .run()
107 .assertStatus(403)
108 .assertContent().isContains("Access denied by guard");
109 a.get("/a2?t1=1&t2=2")
110 .run()
111 .assertContent("OK-a2");
112
113 a.get("/b1?t1=1")
114 .run()
115 .assertContent("OK-b1");
116 a.get("/b1?noTrace=true")
117 .run()
118 .assertStatus(403)
119 .assertContent().isContains("Access denied by guard");
120 a.get("/b2?noTrace=true")
121 .run()
122 .assertStatus(403)
123 .assertContent().isContains("Access denied by guard");
124 a.get("/b2?noTrace=true&t1=1")
125 .run()
126 .assertStatus(403)
127 .assertContent().isContains("Access denied by guard");
128 a.get("/b2?noTrace=true&t2=2")
129 .run()
130 .assertStatus(403)
131 .assertContent().isContains("Access denied by guard");
132 a.get("/b2?t1=1&t2=2")
133 .run()
134 .assertContent("OK-b2");
135
136 a.put("/c1?t1=1")
137 .run()
138 .assertContent("OK-c1");
139 a.put("/c1?noTrace=true")
140 .run()
141 .assertStatus(403)
142 .assertContent().isContains("Access denied by guard");
143 a.put("/c2?noTrace=true")
144 .run()
145 .assertStatus(403)
146 .assertContent().isContains("Access denied by guard");
147 a.put("/c2?noTrace=true&t1=1")
148 .run()
149 .assertStatus(403)
150 .assertContent().isContains("Access denied by guard");
151 a.put("/c2?noTrace=true&t2=2")
152 .run()
153 .assertStatus(403)
154 .assertContent().isContains("Access denied by guard");
155 a.put("/c2?t1=1&t2=2")
156 .run()
157 .assertContent("OK-c2");
158
159 a.post("/d1?t1=1")
160 .run()
161 .assertContent("OK-d1");
162 a.post("/d1?noTrace=true")
163 .run()
164 .assertStatus(403)
165 .assertContent().isContains("Access denied by guard");
166 a.post("/d2?noTrace=true")
167 .run()
168 .assertStatus(403)
169 .assertContent().isContains("Access denied by guard");
170 a.post("/d2?noTrace=true&t1=1")
171 .run()
172 .assertStatus(403)
173 .assertContent().isContains("Access denied by guard");
174 a.post("/d2?noTrace=true&t2=2")
175 .run()
176 .assertStatus(403)
177 .assertContent().isContains("Access denied by guard");
178 a.post("/d2?t1=1&t2=2")
179 .run()
180 .assertContent("OK-d2");
181
182 a.delete("/e1?t1=1")
183 .run()
184 .assertContent("OK-e1");
185 a.delete("/e1?noTrace=true")
186 .run()
187 .assertStatus(403)
188 .assertContent().isContains("Access denied by guard");
189 a.delete("/e2?noTrace=true")
190 .run()
191 .assertStatus(403)
192 .assertContent().isContains("Access denied by guard");
193 a.delete("/e2?noTrace=true&t1=1")
194 .run()
195 .assertStatus(403)
196 .assertContent().isContains("Access denied by guard");
197 a.delete("/e2?noTrace=true&t2=2")
198 .run()
199 .assertStatus(403)
200 .assertContent().isContains("Access denied by guard");
201 a.delete("/e2?t1=1&t2=2")
202 .run()
203 .assertContent("OK-e2");
204 }
205 }