Develop Reference

#CrossOrigin only works when register one domain

I wanted to make an connection between frontend and backend so I used #CrossOrigin annotation Like below.
#CrossOrigin(origins = "http://localhost:3000, http://server ip:3000, http://backend.com:3000")
#RestController
#RequestMapping("/member")
public class MemberController {
Logger logger = LoggerFactory.getLogger(MemberController.class);
private MemberService ms;
private Encryption encrypt;
private S3FileUploadService sfu;
#Autowired
public MemberController(MemberService ms, Encryption encrypt,S3FileUploadService sfu) {
this.ms = ms;
this.encrypt = encrypt;
this.sfu = sfu;
}
#GetMapping("/login")
public FrontMember login(#RequestHeader("Authorization") String autho) {
logger.info("Authorization : " + autho);
String memberInform = encrypt.aesDecrypt(autho);
String[] idPwd = memberInform.split("/");
Member loginTry = new Member();
loginTry.setEmail(idPwd[0]);
loginTry.setPwd(encrypt.shaEncryption(idPwd[1]));
Member authorizedUser = ms.login(loginTry);
if(authorizedUser == null){
logger.warn("No member info");
return null;
}else{
logger.info("Member Get : "+authorizedUser.toString());
String hashMemberNum = encrypt.aesEncrypt(Integer.toString(authorizedUser.getMemberNum()));
String mgHash = encrypt.aesEncrypt(Integer.toString(authorizedUser.getMg()));
FrontMember fm = new FrontMember(hashMemberNum, authorizedUser.getNickName(), authorizedUser.getPfUrl(),mgHash);
logger.info("Login User : "+fm.toString());
return fm;
}
}
}
But it doesn't work unless I only put one domain on origin like below.
#CrossOrigin(origins = "http://localhost:3000")
I want to put several domain at crossorigin.
How can I solve this problem?

Check the Official document of CrossOrign,we can found below description:
So the reason is that you have made a wrong invocation,if you need to allow multiple origins,you need to use an array contains of string instead of single string
In order to make your code work,you can try with below:
#CrossOrigin(origins = {"http://localhost:3000", "http://server ip:3000", "http://backend.com:3000"})
#RestController
#RequestMapping("/member")
public class MemberController {
}

How can I create unit test for void method which just change data and save it

I have some handler(in this example I just use controller):
#RestController
public class MessageController {
private final TaskExecutor taskExecutor;
private final Operation operation;
private final MessageLogService messageLogService;
public MessageController(TaskExecutor taskExecutor, Operation operation, MessageLogService messageLogService) {
this.taskExecutor = taskExecutor;
this.operation = operation;
this.messageLogService = messageLogService;
}
#PostMapping(value = "/process")
public String handleMessage(MessageRequest messageRequest){
MessageLog messageLog = messageLogService.createNewMessageLog();
taskExecutor.execute(() -> {
try {
operation.process(messageLog.getGuid(), messageRequest);
} catch (MessageLogDoesNotExistException e) {
throw new RuntimeException(e);
}
});
return "REQUEST_QUOTED";
}
}
I receive some request.
I create new MessageLog in DB with status "NEW" and some default(and some data from the request in the real project) values and save.
I send messageRequest and MessageLog's guid to the operation in the executor and return sync response "REQUEST_QUOTED" immediately.
#Service
public class MessageOperation implements Operation {
private final MessageLogService messageLogService;
public MessageOperation(MessageLogService messageLogService) {
this.messageLogService = messageLogService;
}
#Transactional
#Override
public void process(String guid, MessageRequest messageRequest) throws MessageLogDoesNotExistException {
MessageLog messageLog = messageLogService.getOne(guid);
if (messageLog == null)
throw new MessageLogDoesNotExistException();
try {
Message message = createMessage(messageRequest);
messageLog.setStatus("SUCCESS");
messageLog.setMessage(message);
} catch (MessageCreationException e) {
messageLog.setStatus("FAIL");
messageLog.setErrorCode(e.getCode());
}
messageLogService.save(messageLog);
}
private Message createMessage(MessageRequest messageRequest) throws MessageCreationException {
//logic
return null;
}
}
Into operation I create the message and bind it with messageLog. If I create and bind success - I set status 'SUCCESS' or 'FAIL' if not. And just save messageLog.
How can I create Unit test for operation's method process? It is void.
1) I get a request from the client
2) delegate the request to the new thread for the async process
3) return sync response.
And I don't understand how can I create a unit test for public void process(String guid, MessageRequest messageRequest)

In this case for MessageOperation I recommend using Mockito https://www.baeldung.com/mockito-annotations library for mocking the class attribute
#Mock
private final MessageLogService messageLogService;
Then in your unit test you use the verify()method to check that expected behaviour has happened. (save is called correctly for example).
I would also mock the response of getOne to fit your need
MessageLog messageLog = messageLogService.getOne(guid);
for example
MessageLog messageLog = new MessageLog();
when(messageLogService.getOne(eq("THE GUID YOU GIVE IN THE METHDO CALL"))).thenReturn(messageLog);
That way since you have the object reference to MessageLogyou can check for the status in the test code:
assertEquals("SUCCESS", messageLog.getStatus());
And use verify to check that the save method is called correctly:
verify(messageLogService).save(same(messageLog));
About the matchers I used https://www.baeldung.com/mockito-argument-matchers

How do I pass list of objects to Rest API POST Method?

I'm creating a Spring boot REST API which should take 2 Lists of custom objects. I'm not able to correctly pass a POST body to the API I've created. Any idea what might be going wrong ?
Below is my code :
Controller Class Method :
// Main controller Class which is called from the REST API. Just the POST method for now.
#RequestMapping(value = "/question1/solution/", method = RequestMethod.POST)
public List<Plan> returnSolution(#RequestBody List<Plan> inputPlans, #RequestBody List<Feature> inputFeatures) {
logger.info("Plans received from user are : " + inputPlans.toString());
return planService.findBestPlan(inputPlans, inputFeatures);
}
Plan Class , this will contain the Feature class objects in an array:
public class Plan {
public Plan(String planName, double planCost, Feature[] features) {
this.planName = planName;
this.planCost = planCost;
this.features = features;
}
public Plan() {
}
private String planName;
private double planCost;
Feature[] features;
public String getPlanName() {
return planName;
}
// getters & setters
}
Feature POJO Class :
// Feature will contain features like - email , archive etc.
public class Feature implements Comparable<Feature> {
public Feature(String featureName) {
this.featureName = featureName;
}
public Feature() {
}
private String featureName;
// Getters / Setters
#Override
public int compareTo(Feature inputFeature) {
return this.featureName.compareTo(inputFeature.getFeatureName());
}
}

You cannot use #RequestBody twice!
You should create a class that holds the two lists and use that class with #RequestBody

You should create json like this:
{
"inputPlans":[],
"inputFeatures":[]
}
and create Class like this:
public class SolutionRequestBody {
private List<Plan> inputPlans;
private List<Feature> inputFeatures;
//setters and getters
}
POST mapping like this:
#RequestMapping(value = "/question1/solution/", method = RequestMethod.POST)
public List<Plan> returnSolution(#RequestBody SolutionRequestBody solution) {
logger.info("Plans received from user are : " + solution.getInputPlans().toString());
return planService.findBestPlan(solution);
}

Mockito mocking a function call in an if statement

I am trying to mock a function call to an external api that lives in an if statement. I am not able to return the value I have in .thenReturn, and I am not sure why. I have looked for answers to this on SO, but I can't seem to find anything that answers my question. Thanks a bunch for your time!
Here is my class I am testing:
#Service
public class TwilioVerifyService {
public String requestCode(String phoneNumber, String countryCode, String via) throws AuthyException
{
AuthyApiClient authyApiClient = new AuthyApiClient("<apiClient>");
Params params = new Params();
params.setAttribute("code_length", "6");
Verification verification = authyApiClient
.getPhoneVerification()
.start(phoneNumber, countryCode, via, params);
if (verification.isOk())
{
return "{ \"success\": \"Successfully sent verification code.\" }";
}
return "{ \"error\": \"Error sending code.\" }";
}
}
And here is my test:
#RunWith(MockitoJUnitRunner.class)
public class TwilioVerifyServiceTests {
#InjectMocks
TwilioVerifyService twilioVerifyService;
#Mock
Verification verification;
#Test
public void requestCodeTest_success() throws AuthyException
{
String phoneNumber = "1111111111";
String countryCode = "1";
String via = "1";
when(verification.isOk()).thenReturn(true);
String result = twilioVerifyService.requestCode(phoneNumber, countryCode, via);
System.out.println(result);
}
}
I believe I'm (or want to be) mocking out verification.isOk() to return true regardless of the inputs, but it seems to return false providing "{ "error": "Error sending code." }" instead of "{ \"success\": \"Successfully sent verification code.\" }".
Thanks again for your time!

Verification is generated from a call to methods in AuthyApiClient.
Ideally AuthyApiClient should not be instantiated in your service, but rather injected into it by the caller.
private AuthyApiClient authyApiClient;
#Autowired
public TwilioVerifyService(AuthyApiClient authyApiClient) {
this.authyApiClient = authyApiClient;
}
Then you can mock authyApiClient and pass it in to the class being tested:
TwilioVerifyService twilioVerifyService = new TwilioVerifyService(mockAuthyApiClient);
That gives you more control over the class being tested and removes the dependency it currently has on the AuthyApiClient constructor.

Jax RS Authorization

I have an existing code at a class which is extended from javax.ws.rs.core.Application
...
Context childContext = component.getContext().createChildContext();
JaxRsApplication application = new JaxRsApplication(childContext);
application.add(this);
application.setStatusService(new ErrorStatusService());
childContext.getAttributes().put("My Server", this);
...
ChallengeAuthenticator challengeGuard = new ChallengeAuthenticator(null, ChallengeScheme.HTTP_BASIC, "REST API Realm");
//Create in-memory users with roles
MemoryRealm realm = new MemoryRealm();
User user = new User("user", "user");
realm.getUsers().add(user);
realm.map(user, Role.get(null, "user"));
User owner = new User("admin", "admin");
realm.getUsers().add(owner);
realm.map(owner, Role.get(null, "admin"));
//Attach verifier to check authentication and enroler to determine roles
challengeGuard.setVerifier(realm.getVerifier());
challengeGuard.setEnroler(realm.getEnroler());
challengeGuard.setNext(application);
// Attach the application with HTTP basic authentication security
component.getDefaultHost().attach(challengeGuard);
I don't have a web.xml at my code. I would like to add authorization to my code. This: https://restlet.com/technical-resources/restlet-framework/guide/2.3/core/security/authorization does not apply to me since I don't have restlet resources.
How can I implement jax rs authorization into my code?
EDIT 1: Existing code uses restlet JAX-RS extension: https://restlet.com/technical-resources/restlet-framework/guide/2.2/extensions/jaxrs
I've tried that at my jax-rs resource class:
#GET
#Path("/")
public String getStatus() {
if (!securityContext.isUserInRole("admin")) {
throw new WebApplicationException(Response.Status.FORBIDDEN);
}
...
}
However, it throws 403 even I log in with admin user.
EDIT 2:
When I check here: https://restlet.com/technical-resources/restlet-framework/guide/2.2/extensions/jaxrs There is a piece of code:
this.setRoleChecker(...); // if needed
This may solve my issue but I don't know how to set a role checker.
PS: I use jersey 1.9 and restlet 2.2.3.

It's not really clear (at least to me :-) ) what you are trying to achieve.
If you have a class which is a subclass of javax.ws.rs.core.Application, you should be able to simply add #RolesAllowed("user") as an annotation to your resource classes, as shown in https://jersey.java.net/documentation/latest/security.html
#Path("/")
#PermitAll
public class Resource {
#RolesAllowed("user")
#GET
public String get() { return "GET"; }
#RolesAllowed("admin")
#POST
public String post(String content) { return content; }
#Path("sub")
public SubResource getSubResource() {
return new SubResource();
}
}
Accessing that resource should prompt you for your credentials. If that doesn't work, then you need to provide a small code sample, which compiles and doesn't do what you want it to do. Then it's easier to see where the problem is and what needs to be done to make it work

I could make it work like that:
Application class:
...
application.setRoles(getRoles(application));
...
public static List<Role> getRoles(JaxRsApplication application) {
List<Role> roles = new ArrayList<>();
for (AuthorizationRoleEnum authorizationRole : AuthorizationRoleEnum.values()) {
roles.add(new Role(application, authorizationRole.toString()));
}
return roles;
}
...
Authorization enum:
public enum AuthorizationRoleEnum {
USER("user"),
ADMIN("admin");
private final String value;
AuthorizationRoleEnum(String value) {
this.value = value;
}
#Override
public String toString() {
return value;
}
}
At my resource classes:
...
#Context
SecurityContext securityContext;
...
allowOnlyAdmin(securityContext);
...
public void allowOnlyAdmin(SecurityContext securityContext) {
if (securityContext.getAuthenticationScheme() != null
&& !securityContext.isUserInRole(AuthorizationRoleEnum.ADMIN.toString())) {
throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
.entity("User does not have required " + AuthorizationRoleEnum.ADMIN + " role!").build());
}
}
...

You need to implement your RoleChecker using this interface.
As the doc says:
Because the Restlet API does not support its own mechanism for role checks (as e.g. the Servlet API), you must use this inteface if you need role checks in a JAX-RS application.
This interface is used to check, if a user is in a role. Implementations must be thread save.
so as an example of implementation you can do smth like this:
public class MyRoleChecker implements RoleChecker {
public boolean isInRole(Principal principal, String role) {
return principal.getRole().equals(role);
}
}
Edited:
On the other hand as you use the new API, you need to implement SecurityContext and inject it using #Context in your resource methods.
Then you fetch roles list from the storage by username. The storage implementation is up to you. Please refer to this example
#Priority(Priorities.AUTHENTICATION)
public class AuthFilterWithCustomSecurityContext implements ContainerRequestFilter {
#Context
UriInfo uriInfo;
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
String authHeaderVal = requestContext.getHeaderString("Auth-Token");
String subject = validateToken(authHeaderVal); //execute custom authentication
if (subject!=null) {
final SecurityContext securityContext = requestContext.getSecurityContext();
requestContext.setSecurityContext(new SecurityContext() {
#Override
public Principal getUserPrincipal() {
return new Principal() {
#Override
public String getName() {
return subject;
}
};
}
#Override
public boolean isUserInRole(String role) {
List<Role> roles = findUserRoles(subject);
return roles.contains(role);
}
#Override
public boolean isSecure() {
return uriInfo.getAbsolutePath().toString().startsWith("https");
}
#Override
public String getAuthenticationScheme() {
return "Token-Based-Auth-Scheme";
}
});
}
}
}