MERGE: API SERVER

pom.xml

@@ -317,8 +317,12 @@
  </goals>
  <configuration>
  <excludes>
- <!-- TO FILL LATER -->
- <!-- <exclude>com/java/FileServerApplication*</exclude> -->
+ <exclude>com/java/api/exception/*</exclude>
+ <exclude>com/java/api/model/**</exclude>
+ <exclude>com/java/api/*API.*</exclude>
+ <exclude>com.java.api.ApiExceptionHandler</exclude>
+ <exclude>com/java/configuration/*.*</exclude>
+ <exclude>com/java/MonidormApplication*</exclude>
  </excludes>
  </configuration>
  </execution>

src/main/java/com/java/api/ApiExceptionHandler.java

@@ -0,0 +1,7 @@
+package com.java.api;
+
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+
+@RestControllerAdvice
+public class ApiExceptionHandler {
+}

src/main/java/com/java/api/exception/MissingOrIncorrectAuthorizationHeaderException.java

@@ -0,0 +1,4 @@
+package com.java.api.exception;
+
+public class MissingOrIncorrectAuthorizationHeaderException extends RuntimeException {
+}

src/main/java/com/java/api/filter/AuthorizationFilter.java

@@ -0,0 +1,41 @@
+package com.java.api.filter;
+
+import com.java.api.exception.MissingOrIncorrectAuthorizationHeaderException;
+import com.java.configuration.ApplicationConfiguration;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.validation.constraints.NotNull;
+import java.io.IOException;
+import org.springframework.http.HttpStatus;
+
+public class AuthorizationFilter implements Filter {
+ private final String apiToken;
+
+ public AuthorizationFilter(@NotNull ApplicationConfiguration configuration) {
+ this.apiToken = configuration.apiToken();
+ }
+
+ @Override
+ public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
+ throws IOException, ServletException {
+ HttpServletRequest request = (HttpServletRequest) servletRequest;
+ HttpServletResponse response = (HttpServletResponse) servletResponse;
+
+ var token = request.getHeader("Authorization");
+
+ try {
+ if (token == null || !token.equals(apiToken)) {
+ throw new MissingOrIncorrectAuthorizationHeaderException();
+ }
+
+ filterChain.doFilter(servletRequest, servletResponse);
+ } catch (MissingOrIncorrectAuthorizationHeaderException exception) {
+ response.sendError(HttpStatus.FORBIDDEN.value());
+ }
+ }
+}

src/main/java/com/java/configuration/FilterConfiguration.java

@@ -0,0 +1,24 @@
+package com.java.configuration;
+
+import com.java.api.filter.AuthorizationFilter;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration(proxyBeanMethods = false)
+@RequiredArgsConstructor
+public class FilterConfiguration {
+ private final ApplicationConfiguration configuration;
+
+ @Bean
+ public FilterRegistrationBean<AuthorizationFilter> authorizationFilter() {
+ FilterRegistrationBean<AuthorizationFilter> registrationBean = new FilterRegistrationBean<>();
+
+ registrationBean.setFilter(new AuthorizationFilter(configuration));
+ registrationBean.addUrlPatterns("/api/*");
+ registrationBean.setOrder(1);
+
+ return registrationBean;
+ }
+}

src/test/java/com/java/api/filter/AuthorizationFilterTest.java

@@ -0,0 +1,72 @@
+package com.java.api.filter;
+
+import com.java.api.exception.MissingOrIncorrectAuthorizationHeaderException;
+import com.java.configuration.ApplicationConfiguration;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatNoException;
+
+@ExtendWith(MockitoExtension.class)
+public class AuthorizationFilterTest {
+ private static final String HEADER_NAME = "Authorization";
+ private static final String API_TOKEN = "TOKEN";
+ private static ServletRequest request;
+ private static ServletResponse response;
+ private static FilterChain chain;
+ private static Filter authorizationFilter;
+
+ @BeforeAll
+ static void tearUp() throws ServletException, IOException {
+ ApplicationConfiguration configuration = Mockito.mock(ApplicationConfiguration.class);
+ Mockito.when(configuration.apiToken()).thenReturn(API_TOKEN);
+
+ authorizationFilter = new AuthorizationFilter(configuration);
+
+ request = Mockito.mock(ServletRequest.class, Mockito.withSettings().extraInterfaces(HttpServletRequest.class));
+ response =
+ Mockito.mock(ServletResponse.class, Mockito.withSettings().extraInterfaces(HttpServletResponse.class));
+
+ chain = Mockito.mock(FilterChain.class);
+ Mockito.doNothing().when(chain).doFilter(request, response);
+ }
+
+ @Test
+ void givenNoActualToken_whenFiltering_thenExceptionIsThrown() throws IOException {
+ Mockito.when(((HttpServletRequest) request).getHeader(HEADER_NAME)).thenReturn(null);
+ Mockito.doThrow(new MissingOrIncorrectAuthorizationHeaderException()).when((HttpServletResponse) response)
+ .sendError(HttpStatus.FORBIDDEN.value());
+
+ assertThatExceptionOfType(MissingOrIncorrectAuthorizationHeaderException.class)
+ .isThrownBy(() -> authorizationFilter.doFilter(request, response, chain));
+ }
+
+ @Test
+ void givenIncorrectToken_whenFiltering_thenExceptionIsThrown() throws IOException {
+ Mockito.when(((HttpServletRequest) request).getHeader(HEADER_NAME)).thenReturn("INCORRECT_TOKEN");
+ Mockito.doThrow(new MissingOrIncorrectAuthorizationHeaderException()).when((HttpServletResponse) response)
+ .sendError(HttpStatus.FORBIDDEN.value());
+
+ assertThatExceptionOfType(MissingOrIncorrectAuthorizationHeaderException.class)
+ .isThrownBy(() -> authorizationFilter.doFilter(request, response, chain));
+ }
+
+ @Test
+ void givenActualToken_whenFiltering_thenNothingIsThrown() {
+ Mockito.when(((HttpServletRequest) request).getHeader(HEADER_NAME)).thenReturn(API_TOKEN);
+
+ assertThatNoException().isThrownBy(() -> authorizationFilter.doFilter(request, response, chain));
+ }
+}