CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 37 Packages Projects Releases Wiki Activity

[FINERACT-1678] LoanCOBApiFIlter throws NPE when user is not authenticated

Browse Source
This commit is contained in:
taskain7
2022-11-08 15:55:09 +01:00
committed by Arnold Gálovics
parent 3951e69ad7
commit 48bbc9b266
2 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/filter/LoanCOBApiFilter.java
+14 -8
View File
@@ -40,6 +40,7 @@ import org.apache.fineract.infrastructure.security.service.PlatformSecurityConte
import org.apache.fineract.portfolio.loanaccount.domain.GLIMAccountInfoRepository;
import org.apache.fineract.portfolio.loanaccount.domain.GroupLoanIndividualMonitoringAccount;
import org.apache.fineract.portfolio.loanaccount.domain.Loan;
import org.apache.fineract.useradministration.exception.UnAuthenticatedUserException;
import org.apache.http.HttpStatus;
import org.springframework.http.HttpMethod;
import org.springframework.stereotype.Component;
@@ -64,7 +65,7 @@ public class LoanCOBApiFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
if (!isOnApiList(request) || isBypassUser()) {
if (!isOnApiList(request) || isBypassUser(response)) {
proceed(filterChain, request, response);
} else {
Iterable<String> split = Splitter.on('/').split(request.getPathInfo());
@@ -73,7 +74,7 @@ public class LoanCOBApiFilter extends OncePerRequestFilter {
Long loanIdFromRequest = getLoanId(isGlim, streamSupplier);
List<Long> loanIds = isGlim ? getGlimChildLoanIds(loanIdFromRequest) : Collections.singletonList(loanIdFromRequest);
if (isLoanHardLocked(loanIds)) {
reject(loanIdFromRequest, response);
reject(loanIdFromRequest, response, HttpStatus.SC_CONFLICT);
} else if (isLoanSoftLocked(loanIds)) {
executeInlineCob(loanIds);
proceed(filterChain, request, response);
@@ -87,6 +88,15 @@ public class LoanCOBApiFilter extends OncePerRequestFilter {
inlineLoanCOBExecutorService.execute(loanIds, JOB_NAME);
}
private boolean isBypassUser(HttpServletResponse response) throws IOException {
try {
return context.authenticatedUser().isBypassUser();
} catch (UnAuthenticatedUserException e) {
reject(null, response, HttpStatus.SC_UNAUTHORIZED);
}
return false;
}
private List<Long> getGlimChildLoanIds(Long loanIdFromRequest) {
GroupLoanIndividualMonitoringAccount glimAccount = glimAccountInfoRepository.findOneByIsAcceptingChildAndApplicationId(true,
BigDecimal.valueOf(loanIdFromRequest));
@@ -105,10 +115,6 @@ public class LoanCOBApiFilter extends OncePerRequestFilter {
return isLoanLocked(loanIds, true);
}
private boolean isBypassUser() {
return context.getAuthenticatedUserIfPresent().isBypassUser();
}
private boolean isLoanLocked(List<Long> loanIds, boolean isHardLock) {
return isHardLock ? loanIds.stream().anyMatch(loanAccountLockService::isLoanHardLocked)
: loanIds.stream().anyMatch(loanAccountLockService::isLoanSoftLocked);
@@ -119,8 +125,8 @@ public class LoanCOBApiFilter extends OncePerRequestFilter {
filterChain.doFilter(request, response);
}
private void reject(Long loanId, HttpServletResponse response) throws IOException {
response.setStatus(HttpStatus.SC_CONFLICT);
private void reject(Long loanId, HttpServletResponse response, int status) throws IOException {
response.setStatus(status);
ApiGlobalErrorResponse errorResponse = ApiGlobalErrorResponse.loanIsLocked(loanId);
response.getWriter().write(errorResponse.toJson());
}
fineract-provider/src/test/java/org/apache/fineract/infrastructure/jobs/filter/LoanCOBApiFilterTest.java
+5 -5
View File
@@ -85,7 +85,7 @@ class LoanCOBApiFilterTest {
given(request.getPathInfo()).willReturn("/jobs/2/inline");
given(request.getMethod()).willReturn(HTTPMethods.POST.value());
given(context.getAuthenticatedUserIfPresent()).willReturn(appUser);
given(context.authenticatedUser()).willReturn(appUser);
given(appUser.isBypassUser()).willReturn(true);
testObj.doFilterInternal(request, response, filterChain);
@@ -103,7 +103,7 @@ class LoanCOBApiFilterTest {
given(request.getMethod()).willReturn(HTTPMethods.POST.value());
given(loanAccountLockService.isLoanHardLocked(2L)).willReturn(false);
given(loanAccountLockService.isLoanSoftLocked(2L)).willReturn(false);
given(context.getAuthenticatedUserIfPresent()).willReturn(appUser);
given(context.authenticatedUser()).willReturn(appUser);
testObj.doFilterInternal(request, response, filterChain);
verify(filterChain, times(1)).doFilter(request, response);
@@ -120,7 +120,7 @@ class LoanCOBApiFilterTest {
given(request.getMethod()).willReturn(HTTPMethods.POST.value());
given(loanAccountLockService.isLoanHardLocked(2L)).willReturn(false);
given(loanAccountLockService.isLoanSoftLocked(2L)).willReturn(true);
given(context.getAuthenticatedUserIfPresent()).willReturn(appUser);
given(context.authenticatedUser()).willReturn(appUser);
testObj.doFilterInternal(request, response, filterChain);
verify(inlineLoanCOBExecutorService, times(1)).execute(Collections.singletonList(2L), "INLINE_LOAN_COB");
@@ -139,7 +139,7 @@ class LoanCOBApiFilterTest {
given(request.getMethod()).willReturn(HTTPMethods.POST.value());
given(loanAccountLockService.isLoanHardLocked(2L)).willReturn(true);
given(response.getWriter()).willReturn(writer);
given(context.getAuthenticatedUserIfPresent()).willReturn(appUser);
given(context.authenticatedUser()).willReturn(appUser);
testObj.doFilterInternal(request, response, filterChain);
verify(response, times(1)).setStatus(HttpStatus.SC_CONFLICT);
@@ -163,7 +163,7 @@ class LoanCOBApiFilterTest {
given(loan.getId()).willReturn(loanId);
given(loanAccountLockService.isLoanHardLocked(loanId)).willReturn(true);
given(response.getWriter()).willReturn(writer);
given(context.getAuthenticatedUserIfPresent()).willReturn(appUser);
given(context.authenticatedUser()).willReturn(appUser);
testObj.doFilterInternal(request, response, filterChain);
verify(response, times(1)).setStatus(HttpStatus.SC_CONFLICT);