Search in sources :

Example 81 with APIGatewayProxyRequestEvent

use of com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent in project di-authentication-api by alphagov.

the class CheckUserExistsHandlerTest method shouldReturn400IfEmailAddressIsInvalid.

@Test
void shouldReturn400IfEmailAddressIsInvalid() {
    usingValidSession();
    APIGatewayProxyRequestEvent event = new APIGatewayProxyRequestEvent();
    event.setBody("{ \"email\": \"joe.bloggs\" }");
    event.setHeaders(Map.of("Session-Id", session.getSessionId()));
    event.setRequestContext(contextWithSourceIp("123.123.123.123"));
    APIGatewayProxyResponseEvent result = handler.handleRequest(event, context);
    assertEquals(400, result.getStatusCode());
    assertThat(result, hasJsonBody(ErrorResponse.ERROR_1004));
    verify(auditService).submitAuditEvent(FrontendAuditableEvent.CHECK_USER_INVALID_EMAIL, "aws-session-id", session.getSessionId(), AuditService.UNKNOWN, AuditService.UNKNOWN, "joe.bloggs", "123.123.123.123", AuditService.UNKNOWN, PersistentIdHelper.PERSISTENT_ID_UNKNOWN_VALUE);
}
Also used : APIGatewayProxyRequestEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent) APIGatewayProxyResponseEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent) Test(org.junit.jupiter.api.Test)

Example 82 with APIGatewayProxyRequestEvent

use of com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent in project di-authentication-api by alphagov.

the class LoginHandlerTest method shouldKeepUserLockedWhenTheyEnterSuccessfulLoginRequestInNewSession.

@Test
void shouldKeepUserLockedWhenTheyEnterSuccessfulLoginRequestInNewSession() {
    UserProfile userProfile = generateUserProfile(null);
    when(authenticationService.getUserProfileByEmailMaybe(EMAIL)).thenReturn(Optional.of(userProfile));
    when(authenticationService.login(userCredentials, PASSWORD)).thenReturn(true);
    when(codeStorageService.getIncorrectPasswordCount(EMAIL)).thenReturn(5);
    usingValidSession();
    APIGatewayProxyRequestEvent event = new APIGatewayProxyRequestEvent();
    event.setRequestContext(contextWithSourceIp("123.123.123.123"));
    event.setHeaders(Map.of("Session-Id", session.getSessionId()));
    event.setBody(format("{ \"password\": \"%s\", \"email\": \"%s\" }", PASSWORD, EMAIL));
    APIGatewayProxyResponseEvent result = handler.handleRequest(event, context);
    assertThat(result, hasStatus(400));
    assertThat(result, hasJsonBody(ErrorResponse.ERROR_1028));
    verify(auditService).submitAuditEvent(FrontendAuditableEvent.ACCOUNT_TEMPORARILY_LOCKED, "aws-session-id", session.getSessionId(), "", userProfile.getSubjectID(), userProfile.getEmail(), "123.123.123.123", userProfile.getPhoneNumber(), PersistentIdHelper.PERSISTENT_ID_UNKNOWN_VALUE);
}
Also used : UserProfile(uk.gov.di.authentication.shared.entity.UserProfile) APIGatewayProxyRequestEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent) APIGatewayProxyResponseEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent) Test(org.junit.jupiter.api.Test)

Example 83 with APIGatewayProxyRequestEvent

use of com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent in project di-authentication-api by alphagov.

the class LoginHandlerTest method shouldReturn200IfLoginIsSuccessful.

@Test
void shouldReturn200IfLoginIsSuccessful() throws JsonProcessingException, Json.JsonException {
    when(configurationService.getTermsAndConditionsVersion()).thenReturn("1.0");
    String persistentId = "some-persistent-id-value";
    Map<String, String> headers = new HashMap<>();
    headers.put(PersistentIdHelper.PERSISTENT_ID_HEADER_NAME, persistentId);
    headers.put("Session-Id", session.getSessionId());
    UserProfile userProfile = generateUserProfile(null);
    when(authenticationService.getUserProfileByEmailMaybe(EMAIL)).thenReturn(Optional.of(userProfile));
    when(authenticationService.login(userCredentials, PASSWORD)).thenReturn(true);
    when(clientSession.getAuthRequestParams()).thenReturn(generateAuthRequest().toParameters());
    usingValidSession();
    APIGatewayProxyRequestEvent event = new APIGatewayProxyRequestEvent();
    event.setRequestContext(contextWithSourceIp("123.123.123.123"));
    event.setHeaders(headers);
    event.setBody(format("{ \"password\": \"%s\", \"email\": \"%s\" }", PASSWORD, EMAIL.toUpperCase()));
    APIGatewayProxyResponseEvent result = handler.handleRequest(event, context);
    assertThat(result, hasStatus(200));
    LoginResponse response = objectMapper.readValue(result.getBody(), LoginResponse.class);
    assertThat(response.getRedactedPhoneNumber(), equalTo(RedactPhoneNumberHelper.redactPhoneNumber(PHONE_NUMBER)));
    assertThat(response.getLatestTermsAndConditionsAccepted(), equalTo(true));
    verify(authenticationService).getUserProfileByEmailMaybe(EMAIL);
    verify(auditService).submitAuditEvent(FrontendAuditableEvent.LOG_IN_SUCCESS, "aws-session-id", session.getSessionId(), "", userProfile.getSubjectID(), userProfile.getEmail(), "123.123.123.123", userProfile.getPhoneNumber(), persistentId);
}
Also used : LoginResponse(uk.gov.di.authentication.frontendapi.entity.LoginResponse) UserProfile(uk.gov.di.authentication.shared.entity.UserProfile) APIGatewayProxyRequestEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent) HashMap(java.util.HashMap) APIGatewayProxyResponseEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent) Test(org.junit.jupiter.api.Test)

Example 84 with APIGatewayProxyRequestEvent

use of com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent in project di-authentication-api by alphagov.

the class LoginHandlerTest method shouldReturn401IfMigratedUserHasInvalidCredentials.

@Test
void shouldReturn401IfMigratedUserHasInvalidCredentials() {
    String legacySubjectId = new Subject().getValue();
    UserProfile userProfile = generateUserProfile(legacySubjectId);
    when(authenticationService.getUserProfileByEmailMaybe(EMAIL)).thenReturn(Optional.of(userProfile));
    when(userMigrationService.processMigratedUser(userCredentials, PASSWORD)).thenReturn(false);
    APIGatewayProxyRequestEvent event = new APIGatewayProxyRequestEvent();
    event.setHeaders(Map.of("Session-Id", session.getSessionId()));
    event.setBody(format("{ \"password\": \"%s\", \"email\": \"%s\" }", PASSWORD, EMAIL));
    usingValidSession();
    APIGatewayProxyResponseEvent result = handler.handleRequest(event, context);
    assertThat(result, hasStatus(401));
    assertThat(result, hasJsonBody(ErrorResponse.ERROR_1008));
}
Also used : UserProfile(uk.gov.di.authentication.shared.entity.UserProfile) APIGatewayProxyRequestEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent) APIGatewayProxyResponseEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent) Subject(com.nimbusds.oauth2.sdk.id.Subject) Test(org.junit.jupiter.api.Test)

Example 85 with APIGatewayProxyRequestEvent

use of com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent in project di-authentication-api by alphagov.

the class MfaHandlerTest method shouldReturn400IfUserIsBlockedFromAttemptingMfaCodes.

@Test
void shouldReturn400IfUserIsBlockedFromAttemptingMfaCodes() {
    usingValidSession();
    when(codeStorageService.isBlockedForEmail(TEST_EMAIL_ADDRESS, CODE_BLOCKED_KEY_PREFIX)).thenReturn(true);
    APIGatewayProxyRequestEvent event = new APIGatewayProxyRequestEvent();
    event.setHeaders(Map.of("Session-Id", session.getSessionId()));
    event.setBody(format("{ \"email\": \"%s\"}", TEST_EMAIL_ADDRESS));
    event.setRequestContext(contextWithSourceIp("123.123.123.123"));
    APIGatewayProxyResponseEvent result = handler.handleRequest(event, context);
    assertEquals(400, result.getStatusCode());
    assertThat(result, hasJsonBody(ErrorResponse.ERROR_1027));
    verify(auditService).submitAuditEvent(FrontendAuditableEvent.MFA_INVALID_CODE_REQUEST, "aws-session-id", session.getSessionId(), "", AuditService.UNKNOWN, TEST_EMAIL_ADDRESS, "123.123.123.123", AuditService.UNKNOWN, PersistentIdHelper.PERSISTENT_ID_UNKNOWN_VALUE);
}
Also used : APIGatewayProxyRequestEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent) APIGatewayProxyResponseEvent(com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent) Test(org.junit.jupiter.api.Test)

Aggregations

APIGatewayProxyRequestEvent (com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent)239 Test (org.junit.jupiter.api.Test)217 APIGatewayProxyResponseEvent (com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent)182 HashMap (java.util.HashMap)70 ArgumentMatchers.anyString (org.mockito.ArgumentMatchers.anyString)37 ParameterizedTest (org.junit.jupiter.params.ParameterizedTest)33 ErrorObject (com.nimbusds.oauth2.sdk.ErrorObject)29 NotifyRequest (uk.gov.di.authentication.shared.entity.NotifyRequest)17 URI (java.net.URI)15 Map (java.util.Map)15 UserProfile (uk.gov.di.authentication.shared.entity.UserProfile)14 Context (com.amazonaws.services.lambda.runtime.Context)13 NotifyRequest (uk.gov.di.accountmanagement.entity.NotifyRequest)13 Subject (com.nimbusds.oauth2.sdk.id.Subject)12 Instant (java.time.Instant)11 Matchers.containsString (org.hamcrest.Matchers.containsString)11 ClientID (com.nimbusds.oauth2.sdk.id.ClientID)10 AuthenticationRequest (com.nimbusds.openid.connect.sdk.AuthenticationRequest)10 ObjectMapper (com.fasterxml.jackson.databind.ObjectMapper)8 JWSObject (com.nimbusds.jose.JWSObject)8