Examples with EndpointAccessChecker dev.hilla.auth.EndpointAccessChecker used on opensource projects

Example 6 with EndpointAccessChecker

use of dev.hilla.auth.EndpointAccessChecker in project flow by vaadin.

the class EndpointControllerTest method should_Return404_When_IllegalAccessToMethodIsPerformed.

@Test
public void should_Return404_When_IllegalAccessToMethodIsPerformed() {
    String accessErrorMessage = "Access error";
    EndpointAccessChecker restrictingCheckerMock = mock(EndpointAccessChecker.class);
    when(restrictingCheckerMock.check(Mockito.any(), Mockito.any())).thenReturn(accessErrorMessage);
    EndpointNameChecker nameCheckerMock = mock(EndpointNameChecker.class);
    when(nameCheckerMock.check(TEST_ENDPOINT_NAME)).thenReturn(null);
    ExplicitNullableTypeChecker explicitNullableTypeCheckerMock = mock(ExplicitNullableTypeChecker.class);
    ResponseEntity<String> response = createVaadinController(TEST_ENDPOINT, new ObjectMapper(), restrictingCheckerMock, nameCheckerMock, explicitNullableTypeCheckerMock, null).serveEndpoint(TEST_ENDPOINT_NAME, TEST_METHOD.getName(), null, requestMock);
    assertEquals(HttpStatus.UNAUTHORIZED, response.getStatusCode());
    String responseBody = response.getBody();
    assertEndpointInfoPresent(responseBody);
    assertTrue(String.format("Invalid response body: '%s'", responseBody), responseBody.contains(accessErrorMessage));
    verify(restrictingCheckerMock).check(Mockito.any(), Mockito.any());
    Mockito.verifyNoMoreInteractions(restrictingCheckerMock);
    verify(restrictingCheckerMock, times(1)).check(Mockito.any(), Mockito.any());
}

Example 7 with EndpointAccessChecker

use of dev.hilla.auth.EndpointAccessChecker in project flow by vaadin.

the class EndpointControllerTest method should_clearVaadinRequestInsntace_after_EndpointCall.

@Test
public void should_clearVaadinRequestInsntace_after_EndpointCall() {
    EndpointController vaadinController = createVaadinController(TEST_ENDPOINT, new EndpointAccessChecker(new AccessAnnotationChecker()));
    vaadinController.serveEndpoint(TEST_ENDPOINT_NAME, "getUserName", createRequestParameters("{}"), requestMock);
    Assert.assertNull(CurrentInstance.get(VaadinRequest.class));
    Assert.assertNull(VaadinRequest.getCurrent());
}

Example 8 with EndpointAccessChecker

use of dev.hilla.auth.EndpointAccessChecker in project flow by vaadin.

the class EndpointControllerTest method should_NotCallMethodAnonymously_When_UserPrincipalIsNotInRole.

@Test
public void should_NotCallMethodAnonymously_When_UserPrincipalIsNotInRole() {
    EndpointController vaadinController = createVaadinController(TEST_ENDPOINT, new EndpointAccessChecker(new AccessAnnotationChecker()));
    ResponseEntity<String> response = vaadinController.serveEndpoint(TEST_ENDPOINT_NAME, "testRoleAllowed", createRequestParameters("{}"), requestMock);
    assertEquals(HttpStatus.UNAUTHORIZED, response.getStatusCode());
    assertTrue(response.getBody().contains(EndpointAccessChecker.ACCESS_DENIED_MSG));
}

Example 9 with EndpointAccessChecker

use of dev.hilla.auth.EndpointAccessChecker in project flow by vaadin.

the class EndpointInvoker method invokeVaadinEndpointMethod.

private ResponseEntity<String> invokeVaadinEndpointMethod(String endpointName, String methodName, Method methodToInvoke, ObjectNode body, VaadinEndpointData vaadinEndpointData, HttpServletRequest request) throws JsonProcessingException {
    EndpointAccessChecker accessChecker = getAccessChecker(request.getServletContext());
    String checkError = accessChecker.check(methodToInvoke, request);
    if (checkError != null) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(createResponseErrorObject(String.format("Endpoint '%s' method '%s' request cannot be accessed, reason: '%s'", endpointName, methodName, checkError)));
    }
    Map<String, JsonNode> requestParameters = getRequestParameters(body);
    Type[] javaParameters = getJavaParameters(methodToInvoke, ClassUtils.getUserClass(vaadinEndpointData.getEndpointObject()));
    if (javaParameters.length != requestParameters.size()) {
        return ResponseEntity.badRequest().body(createResponseErrorObject(String.format("Incorrect number of parameters for endpoint '%s' method '%s', " + "expected: %s, got: %s", endpointName, methodName, javaParameters.length, requestParameters.size())));
    }
    Object[] vaadinEndpointParameters;
    try {
        vaadinEndpointParameters = getVaadinEndpointParameters(requestParameters, javaParameters, methodName, endpointName);
    } catch (EndpointValidationException e) {
        getLogger().debug("Endpoint '{}' method '{}' received invalid response", endpointName, methodName, e);
        return ResponseEntity.badRequest().body(vaadinEndpointMapper.writeValueAsString(e.getSerializationData()));
    }
    Set<ConstraintViolation<Object>> methodParameterConstraintViolations = validator.forExecutables().validateParameters(vaadinEndpointData.getEndpointObject(), methodToInvoke, vaadinEndpointParameters);
    if (!methodParameterConstraintViolations.isEmpty()) {
        return ResponseEntity.badRequest().body(vaadinEndpointMapper.writeValueAsString(new EndpointValidationException(String.format("Validation error in endpoint '%s' method '%s'", endpointName, methodName), createMethodValidationErrors(methodParameterConstraintViolations)).getSerializationData()));
    }
    Object returnValue;
    try {
        returnValue = methodToInvoke.invoke(vaadinEndpointData.getEndpointObject(), vaadinEndpointParameters);
    } catch (IllegalArgumentException e) {
        String errorMessage = String.format("Received incorrect arguments for endpoint '%s' method '%s'. " + "Expected parameter types (and their order) are: '[%s]'", endpointName, methodName, listMethodParameterTypes(javaParameters));
        getLogger().debug(errorMessage, e);
        return ResponseEntity.badRequest().body(createResponseErrorObject(errorMessage));
    } catch (IllegalAccessException e) {
        String errorMessage = String.format("Endpoint '%s' method '%s' access failure", endpointName, methodName);
        getLogger().error(errorMessage, e);
        return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(createResponseErrorObject(errorMessage));
    } catch (InvocationTargetException e) {
        return handleMethodExecutionError(endpointName, methodName, e);
    }
    returnValue = endpointTransferMapper.toTransferType(returnValue);
    String implicitNullError = this.explicitNullableTypeChecker.checkValueForAnnotatedElement(returnValue, methodToInvoke);
    if (implicitNullError != null) {
        EndpointException returnValueException = new EndpointException(String.format("Unexpected return value in endpoint '%s' method '%s'. %s", endpointName, methodName, implicitNullError));
        getLogger().error(returnValueException.getMessage());
        return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(vaadinEndpointMapper.writeValueAsString(returnValueException.getSerializationData()));
    }
    Set<ConstraintViolation<Object>> returnValueConstraintViolations = validator.forExecutables().validateReturnValue(vaadinEndpointData.getEndpointObject(), methodToInvoke, returnValue);
    if (!returnValueConstraintViolations.isEmpty()) {
        getLogger().error("Endpoint '{}' method '{}' had returned a value that has validation errors: '{}', this might cause bugs on the client side. Fix the method implementation.", endpointName, methodName, returnValueConstraintViolations);
    }
    return ResponseEntity.ok(vaadinEndpointMapper.writeValueAsString(returnValue));
}