You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by rc...@apache.org on 2020/12/17 07:40:23 UTC
[james-project] branch master updated: JAMES-1644
AccessTokenAuthenticationStrategy should read data only once
This is an automated email from the ASF dual-hosted git repository.
rcordier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
The following commit(s) were added to refs/heads/master by this push:
new 61bc266 JAMES-1644 AccessTokenAuthenticationStrategy should read data only once
61bc266 is described below
commit 61bc2667e02b4d7c8dd4c7666298791e799fc853
Author: Benoit Tellier <bt...@linagora.com>
AuthorDate: Tue Dec 15 16:30:29 2020 +0700
JAMES-1644 AccessTokenAuthenticationStrategy should read data only once
Today the same access token is read twice:
- once upon 'isValid'
- once upon 'getUsername'
We can remove intermediate call to isValid as getUsername will throw anyway.
---
.../james/jmap/http/AccessTokenAuthenticationStrategy.java | 1 -
.../jmap/http/AccessTokenAuthenticationStrategyTest.java | 13 +++++--------
2 files changed, 5 insertions(+), 9 deletions(-)
diff --git a/server/protocols/jmap-draft/src/main/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategy.java b/server/protocols/jmap-draft/src/main/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategy.java
index e584ef1..ab351cf 100644
--- a/server/protocols/jmap-draft/src/main/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategy.java
+++ b/server/protocols/jmap-draft/src/main/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategy.java
@@ -49,7 +49,6 @@ public class AccessTokenAuthenticationStrategy implements AuthenticationStrategy
return Mono.fromCallable(() -> authHeaders(httpRequest))
.filter(tokenString -> !tokenString.startsWith("Bearer"))
.map(AccessToken::fromString)
- .filterWhen(accessTokenManager::isValid)
.flatMap(item -> Mono.from(accessTokenManager.getUsernameFromToken(item)))
.map(mailboxManager::createSystemSession)
.onErrorResume(InvalidAccessToken.class, error -> Mono.error(new UnauthorizedException("Invalid access token", error)))
diff --git a/server/protocols/jmap-draft/src/test/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategyTest.java b/server/protocols/jmap-draft/src/test/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategyTest.java
index 05c2d2b..c519cea 100644
--- a/server/protocols/jmap-draft/src/test/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategyTest.java
+++ b/server/protocols/jmap-draft/src/test/java/org/apache/james/jmap/http/AccessTokenAuthenticationStrategyTest.java
@@ -28,6 +28,7 @@ import java.util.UUID;
import org.apache.james.core.Username;
import org.apache.james.jmap.api.access.AccessToken;
+import org.apache.james.jmap.api.access.exceptions.InvalidAccessToken;
import org.apache.james.jmap.draft.crypto.AccessTokenManagerImpl;
import org.apache.james.jmap.exceptions.UnauthorizedException;
import org.apache.james.mailbox.MailboxManager;
@@ -79,7 +80,7 @@ public class AccessTokenAuthenticationStrategyTest {
}
@Test
- public void createMailboxSessionShouldReturnEmptyWhenAuthHeaderIsInvalid() {
+ public void createMailboxSessionShouldThrowWhenAuthHeaderIsInvalid() {
Username username = Username.of("123456789");
MailboxSession fakeMailboxSession = mock(MailboxSession.class);
@@ -89,14 +90,12 @@ public class AccessTokenAuthenticationStrategyTest {
UUID authHeader = UUID.randomUUID();
AccessToken accessToken = AccessToken.fromString(authHeader.toString());
when(mockedAccessTokenManager.getUsernameFromToken(accessToken))
- .thenReturn(Mono.just(username));
+ .thenReturn(Mono.error(new InvalidAccessToken(accessToken)));
when(mockedHeaders.get(AUTHORIZATION_HEADERS))
.thenReturn(authHeader.toString());
- when(mockedAccessTokenManager.isValid(accessToken))
- .thenReturn(Mono.just(false));
- assertThat(testee.createMailboxSession(mockedRequest).blockOptional())
- .isEmpty();
+ assertThatThrownBy(() -> testee.createMailboxSession(mockedRequest).blockOptional())
+ .isInstanceOf(UnauthorizedException.class);
}
@Test
@@ -125,8 +124,6 @@ public class AccessTokenAuthenticationStrategyTest {
.thenReturn(Mono.just(username));
when(mockedHeaders.get(AUTHORIZATION_HEADERS))
.thenReturn(authHeader.toString());
- when(mockedAccessTokenManager.isValid(accessToken))
- .thenReturn(Mono.just(true));
MailboxSession result = testee.createMailboxSession(mockedRequest).block();
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org