You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@isis.apache.org by jo...@apache.org on 2020/11/08 12:06:46 UTC
[isis] branch ISIS-2454 updated (6e7b3f6 -> 3b5d87e)
This is an automated email from the ASF dual-hosted git repository.
joergrade pushed a change to branch ISIS-2454
in repository https://gitbox.apache.org/repos/asf/isis.git.
from 6e7b3f6 ISIS-2448 ChicagoFLF.ttf removed, as well as reference in kroviz.css. Doc amended.
new e05b354 ISIS-2454 test if cors filter is in filterchain (and credentials are checked) 1/n
new 3b5d87e ISIS-2454 test if cors filter is in filterchain (and credentials are checked) 2/n gradle change reverted
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
regressiontests/stable/build.gradle | 18 +--
regressiontests/stable/pom.xml | 4 +
...s.java => Configuration_headlessButSecure.java} | 160 +++++++++------------
.../isis/testdomain/rest/CorsFilterTest.java | 73 ++++++++++
4 files changed, 150 insertions(+), 105 deletions(-)
copy regressiontests/stable/src/main/java/org/apache/isis/testdomain/conf/{Configuration_headless.java => Configuration_headlessButSecure.java} (61%)
create mode 100644 regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java
[isis] 01/02: ISIS-2454 test if cors filter is in filterchain (and
credentials are checked) 1/n
Posted by jo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
joergrade pushed a commit to branch ISIS-2454
in repository https://gitbox.apache.org/repos/asf/isis.git
commit e05b354fbec007102970f08425aa61fbba6cfa5a
Author: Jörg Rade <jo...@kuehne-nagel.com>
AuthorDate: Fri Nov 6 17:50:01 2020 +0100
ISIS-2454 test if cors filter is in filterchain (and credentials are checked) 1/n
---
regressiontests/stable/build.gradle | 18 +--
regressiontests/stable/pom.xml | 4 +
.../conf/Configuration_headlessButSecure.java | 153 +++++++++++++++++++++
.../isis/testdomain/rest/CorsFilterTest.java | 73 ++++++++++
4 files changed, 239 insertions(+), 9 deletions(-)
diff --git a/regressiontests/stable/build.gradle b/regressiontests/stable/build.gradle
index 57e33a3..f15c757 100644
--- a/regressiontests/stable/build.gradle
+++ b/regressiontests/stable/build.gradle
@@ -15,8 +15,8 @@
// specific language governing permissions and limitations
// under the License.
-description = 'Apache Isis - Regression Tests'
-group = 'org.apache.isis.regressiontests'
+//description = 'Apache Isis - Regression Tests'
+//group = 'org.apache.isis.regressiontests'
plugins {
id 'java'
@@ -53,7 +53,7 @@ dependencies {
compile project(':org.apache.isis.viewer:isis-viewer-restfulobjects-viewer')
compile project(':org.apache.isis.viewer:isis-viewer-restfulobjects-jaxrsresteasy4')
compile project(':org.apache.isis.testing:isis-testing-fixtures-applib')
- compile project(':org.apache.isis.mappings:isis-mappings-restclient-api')
+// compile project(':org.apache.isis.mappings:isis-mappings-restclient-api')
compile project(':org.apache.isis.extensions:isis-extensions-modelannotation')
compile project(':org.apache.isis.extensions:isis-extensions-secman-model')
compile project(':org.apache.isis.extensions:isis-extensions-secman-encryption-jbcrypt')
@@ -83,26 +83,26 @@ datanucleus {
test {
// enable JUnit Platform (a.k.a. JUnit 5) support
useJUnitPlatform()
-
+
// explicitly include or exclude tests
// include 'org/foo/**'
// exclude 'org/boo/**'
-
+
// show standard out and standard error of the test JVM(s) on the console
testLogging.showStandardStreams = false
-
+
// set heap size for the test JVM(s)
minHeapSize = "128m"
maxHeapSize = "512m"
-
+
// set JVM arguments for the test JVM(s)
jvmArgs '-XX:MaxPermSize=256m'
-
+
// listen to events in the test execution lifecycle
beforeTest { descriptor ->
logger.lifecycle("Running test: " + descriptor)
}
-
+
// Fail the 'test' task on the first test failure
failFast = true
}
diff --git a/regressiontests/stable/pom.xml b/regressiontests/stable/pom.xml
index 46542c5..7bec1dc 100644
--- a/regressiontests/stable/pom.xml
+++ b/regressiontests/stable/pom.xml
@@ -36,5 +36,9 @@
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <groupId>org.apache.isis.extensions</groupId>
+ <artifactId>isis-extensions-cors-impl</artifactId>
+ </dependency>
</dependencies>
</project>
diff --git a/regressiontests/stable/src/main/java/org/apache/isis/testdomain/conf/Configuration_headlessButSecure.java b/regressiontests/stable/src/main/java/org/apache/isis/testdomain/conf/Configuration_headlessButSecure.java
new file mode 100644
index 0000000..4cb1a4e
--- /dev/null
+++ b/regressiontests/stable/src/main/java/org/apache/isis/testdomain/conf/Configuration_headlessButSecure.java
@@ -0,0 +1,153 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.isis.testdomain.conf;
+
+import javax.inject.Inject;
+import javax.inject.Provider;
+import javax.inject.Singleton;
+
+import lombok.RequiredArgsConstructor;
+import lombok.val;
+import org.apache.isis.applib.annotation.OrderPrecedence;
+import org.apache.isis.applib.services.command.Command;
+import org.apache.isis.applib.services.iactn.Interaction;
+import org.apache.isis.applib.services.iactn.InteractionContext;
+import org.apache.isis.applib.services.metrics.MetricsService;
+import org.apache.isis.commons.internal.debug._Probe;
+import org.apache.isis.core.metamodel.services.command.CommandServiceInternal;
+import org.apache.isis.core.runtime.events.iactn.IsisInteractionLifecycleEvent;
+import org.apache.isis.extensions.cors.impl.IsisModuleExtCorsImpl;
+import org.apache.isis.extensions.modelannotation.metamodel.IsisModuleExtModelAnnotation;
+import org.apache.isis.security.bypass.IsisModuleSecurityBypass;
+import org.springframework.context.annotation.*;
+
+import org.apache.isis.core.runtimeservices.IsisModuleCoreRuntimeServices;
+import org.apache.isis.extensions.secman.api.SecurityModuleConfig;
+import org.apache.isis.extensions.secman.api.permission.PermissionsEvaluationService;
+import org.apache.isis.extensions.secman.api.permission.PermissionsEvaluationServiceAllowBeatsVeto;
+import org.apache.isis.testdomain.util.kv.KVStoreForTesting;
+import org.springframework.context.event.EventListener;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.TransactionDefinition;
+import org.springframework.transaction.TransactionException;
+import org.springframework.transaction.TransactionStatus;
+
+import java.util.Optional;
+
+@Configuration
+@Import({
+ IsisModuleCoreRuntimeServices.class,
+ //IsisModuleCoreSecurity.class,
+ IsisModuleSecurityBypass.class,
+ IsisModuleExtModelAnnotation.class, // @Model support
+ IsisModuleExtCorsImpl.class,
+ Configuration_headlessButSecure.HeadlessCommandSupport.class,
+ KVStoreForTesting.class, // Helper for JUnit Tests
+})
+public class Configuration_headlessButSecure {
+
+ @Service
+ @Order(OrderPrecedence.MIDPOINT)
+ @RequiredArgsConstructor(onConstructor_ = {@Inject})
+ public static class HeadlessCommandSupport {
+
+ private final Provider<InteractionContext> interactionContextProvider;
+ private final CommandServiceInternal commandService;
+
+ @EventListener(IsisInteractionLifecycleEvent.class)
+ public void onIsisInteractionLifecycleEvent(IsisInteractionLifecycleEvent event) {
+ switch (event.getEventType()) {
+ case HAS_STARTED:
+ _Probe.errOut("Interaction HAS_STARTED conversationId=%s", event.getConversationId());
+ setupCommandCreateIfMissing();
+ break;
+ case IS_ENDING:
+ _Probe.errOut("Interaction IS_ENDING conversationId=%s", event.getConversationId());
+ break;
+ default:
+ break;
+ }
+ }
+
+ public void setupCommandCreateIfMissing() {
+ val interactionContext = interactionContextProvider.get();
+ @SuppressWarnings("unused") final Interaction interaction = Optional.ofNullable(interactionContext.getInteraction())
+ .orElseGet(() -> {
+ val newCommand = new Command();
+ val newInteraction = new Interaction(newCommand);
+ interactionContext.setInteraction(newInteraction);
+ return newInteraction;
+ });
+ }
+
+ }
+
+ @Bean
+ @Singleton
+ public PlatformTransactionManager platformTransactionManager() {
+ return new PlatformTransactionManager() {
+
+ @Override
+ public void rollback(TransactionStatus status) throws TransactionException {
+ }
+
+ @Override
+ public TransactionStatus getTransaction(TransactionDefinition definition) throws TransactionException {
+ return null;
+ }
+
+ @Override
+ public void commit(TransactionStatus status) throws TransactionException {
+ }
+ };
+ }
+
+ @Bean
+ @Singleton
+ public MetricsService metricsService() {
+ return new MetricsService() {
+
+ @Override
+ public int numberObjectsLoaded() {
+ return 0;
+ }
+
+ @Override
+ public int numberObjectsDirtied() {
+ return 0;
+ }
+ };
+ }
+
+ @Bean
+ @Singleton
+ public SecurityModuleConfig securityModuleConfigBean() {
+ return SecurityModuleConfig.builder()
+ .build();
+ }
+
+ @Bean
+ @Singleton
+ public PermissionsEvaluationService permissionsEvaluationService() {
+ return new PermissionsEvaluationServiceAllowBeatsVeto();
+ }
+
+}
\ No newline at end of file
diff --git a/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java b/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java
new file mode 100644
index 0000000..d7d8100
--- /dev/null
+++ b/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.isis.testdomain.rest;
+
+import org.apache.isis.testdomain.conf.Configuration_headlessButSecure;
+import org.apache.isis.testdomain.rospec.Configuration_usingRoSpec;
+import org.apache.isis.testdomain.util.rest.RestEndpointService;
+import org.apache.isis.viewer.restfulobjects.jaxrsresteasy4.IsisModuleViewerRestfulObjectsJaxrsResteasy4;
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.context.annotation.Import;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.ActiveProfiles;
+import org.junit.runner.RunWith;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@ActiveProfiles("test")
+@RunWith(SpringRunner.class)
+@SpringBootTest(
+ classes = RestEndpointService.class,
+ properties = {
+ "sven = pass, admin_role",
+ "admin_role = *"
+ },
+ webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@Import({
+ Configuration_headlessButSecure.class,
+ Configuration_usingRoSpec.class,
+ IsisModuleViewerRestfulObjectsJaxrsResteasy4.class,
+})
+class CorsFilterTest {
+
+ @LocalServerPort
+ private int port;
+
+ @Test
+ public void ensureCorsFilterIsInChain() {
+ final String url = "http://localhost:" + port + "/restful/user";
+ final TestRestTemplate testRestTemplate = new TestRestTemplate();
+ final ResponseEntity<String> response = testRestTemplate
+ //TODO sven/pass not enforced due to usage of IsisModuleCoreSecurity _headlessButSecure
+ .withBasicAuth("user", "passwd")
+ .getForEntity(url, String.class);
+
+ assertThat(response.getStatusCode(), equalTo(HttpStatus.OK));
+ assertTrue(response.getBody().length() > 0);
+ }
+
+}
+
[isis] 02/02: ISIS-2454 test if cors filter is in filterchain (and
credentials are checked) 2/n gradle change reverted
Posted by jo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
joergrade pushed a commit to branch ISIS-2454
in repository https://gitbox.apache.org/repos/asf/isis.git
commit 3b5d87e0bf2fe698aeeb59a75b6882b052385f43
Author: Jörg Rade <jo...@kuehne-nagel.com>
AuthorDate: Sun Nov 8 13:00:16 2020 +0100
ISIS-2454 test if cors filter is in filterchain (and credentials are checked) 2/n
gradle change reverted
---
.../test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java b/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java
index d7d8100..2ef8878 100644
--- a/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java
+++ b/regressiontests/stable/src/test/java/org/apache/isis/testdomain/rest/CorsFilterTest.java
@@ -42,8 +42,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
@SpringBootTest(
classes = RestEndpointService.class,
properties = {
- "sven = pass, admin_role",
- "admin_role = *"
+// "sven = pass, admin_role",
+// "admin_role = *"
},
webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@Import({
@@ -61,8 +61,8 @@ class CorsFilterTest {
final String url = "http://localhost:" + port + "/restful/user";
final TestRestTemplate testRestTemplate = new TestRestTemplate();
final ResponseEntity<String> response = testRestTemplate
- //TODO sven/pass not enforced due to usage of IsisModuleCoreSecurity _headlessButSecure
- .withBasicAuth("user", "passwd")
+ //TODO sven/pass not enforced. Credentials are not checked, only occurrence of HTTPBA field in request header
+ .withBasicAuth("any", "any")
.getForEntity(url, String.class);
assertThat(response.getStatusCode(), equalTo(HttpStatus.OK));