Instance type filter polishing and tests

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java

@@ -68,17 +68,5 @@ public class FineractProperties {
         public boolean isBatchOnlyMode() {
             return !readEnabled && !writeEnabled && batchEnabled;
         }
-
-        public boolean isReadInstance() {
-            return isReadOnlyMode() || readEnabled;
-        }
-
-        public boolean isWriteInstance() {
-            return isWriteOnlyMode() || writeEnabled;
-        }
-
-        public boolean isBatchInstance() {
-            return isBatchOnlyMode() || batchEnabled;
-        }
     }
 }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java

@@ -19,7 +19,7 @@
 
 package org.apache.fineract.infrastructure.core.config;
 
-import org.apache.fineract.infrastructure.security.filter.FineractInstanceModeApiFilter;
+import org.apache.fineract.infrastructure.instancemode.filter.FineractInstanceModeApiFilter;
 import org.apache.fineract.infrastructure.security.filter.TenantAwareBasicAuthenticationFilter;
 import org.apache.fineract.infrastructure.security.filter.TwoFactorAuthenticationFilter;
 import org.apache.fineract.infrastructure.security.service.TenantAwareJpaPlatformUserDetailsService;
@@ -65,7 +65,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
     protected void configure(HttpSecurity http) throws Exception {
-
         http //
                 .csrf().disable() // NOSONAR only creating a service that is used by non-browser clients
                 .antMatcher("/api/**").authorizeRequests() //
@@ -75,6 +74,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
                 .antMatchers(HttpMethod.POST, "/api/*/self/authentication").permitAll() //
                 .antMatchers(HttpMethod.POST, "/api/*/self/registration").permitAll() //
                 .antMatchers(HttpMethod.POST, "/api/*/self/registration/user").permitAll() //
+                .antMatchers(HttpMethod.PUT, "/api/*/instance-mode").permitAll() //
                 .antMatchers(HttpMethod.POST, "/api/*/twofactor/validate").fullyAuthenticated() //
                 .antMatchers("/api/*/twofactor").fullyAuthenticated() //
                 .antMatchers("/api/**").access("isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')").and() //

fineract-provider/src/main/java/org/apache/fineract/infrastructure/instancemode/api/InstanceModeApiResource.java

@@ -0,0 +1,77 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.instancemode.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.config.FineractProperties;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+@Profile("test")
+@Component
+@Path("/instance-mode")
+@Tag(name = "Instance Mode", description = "Instance mode changing API")
+@RequiredArgsConstructor
+@Slf4j
+public class InstanceModeApiResource implements InitializingBean {
+
+    private final FineractProperties fineractProperties;
+
+    @Override
+    public void afterPropertiesSet() throws Exception {
+        log.warn("------------------------------------------------------------");
+        log.warn("                                                            ");
+        log.warn("DO NOT USE THIS IN PRODUCTION!");
+        log.warn("Instance type changing feature is enabled");
+        log.warn("DO NOT USE THIS IN PRODUCTION!");
+        log.warn("                                                            ");
+        log.warn("------------------------------------------------------------");
+    }
+
+    @PUT
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Changes the Fineract instance mode", description = "")
+    @RequestBody(required = true, content = @Content(schema = @Schema(implementation = InstanceModeApiResourceSwagger.ChangeInstanceModeRequest.class)))
+    @ApiResponses({ @ApiResponse(responseCode = "200", description = "OK") })
+    public Response changeMode(InstanceModeApiResourceSwagger.ChangeInstanceModeRequest request) {
+        log.warn("------------------------------------------------------------");
+        log.warn("                                                            ");
+        log.warn("Changing instance mode according to the request parameters {}", request);
+        log.warn("                                                            ");
+        log.warn("------------------------------------------------------------");
+        fineractProperties.getMode().setReadEnabled(request.isReadEnabled());
+        fineractProperties.getMode().setWriteEnabled(request.isWriteEnabled());
+        fineractProperties.getMode().setBatchEnabled(request.isBatchEnabled());
+        return Response.ok().build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/instancemode/api/InstanceModeApiResourceSwagger.java

@@ -0,0 +1,39 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.instancemode.api;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import lombok.Getter;
+import lombok.ToString;
+
+public class InstanceModeApiResourceSwagger {
+
+    @ToString
+    @Schema(description = "ChangeInstanceModeRequest")
+    @Getter
+    public static final class ChangeInstanceModeRequest {
+
+        @Schema(required = true, example = "true")
+        public boolean readEnabled;
+        @Schema(required = true, example = "true")
+        public boolean writeEnabled;
+        @Schema(required = true, example = "true")
+        public boolean batchEnabled;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/instancemode/filter/FineractInstanceModeApiFilter.java

@@ -0,0 +1,121 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.instancemode.filter;
+
+import static org.apache.commons.lang3.StringUtils.isBlank;
+import static org.apache.fineract.infrastructure.instancemode.filter.FineractInstanceModeApiFilter.ExceptionListItem.item;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.function.Function;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.HttpMethod;
+import javax.ws.rs.ext.Provider;
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.config.FineractProperties;
+import org.apache.fineract.infrastructure.core.data.ApiGlobalErrorResponse;
+import org.apache.http.HttpStatus;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+@Provider
+@Component
+@RequiredArgsConstructor
+public class FineractInstanceModeApiFilter extends OncePerRequestFilter {
+
+    private static final List<ExceptionListItem> EXCEPTION_LIST = List.of(
+            item(FineractProperties.FineractModeProperties::isBatchEnabled, pi -> pi.startsWith("/jobs")),
+            item(p -> true, pi -> pi.startsWith("/instance-mode")));
+
+    private final FineractProperties fineractProperties;
+
+    @Override
+    protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain)
+            throws ServletException, IOException {
+        if (isOnExceptionList(request) || isActuatorApi(request)) {
+            proceed(filterChain, request, response);
+        } else {
+            if (isPathOnExceptionList(request)) {
+                reject(request, response);
+            } else {
+                if (fineractProperties.getMode().isReadEnabled() && isReadMethod(request)) {
+                    proceed(filterChain, request, response);
+                } else if (fineractProperties.getMode().isWriteEnabled()) {
+                    proceed(filterChain, request, response);
+                } else {
+                    reject(request, response);
+                }
+            }
+        }
+    }
+
+    private boolean isActuatorApi(HttpServletRequest request) {
+        if (isBlank(request.getServletPath())) {
+            return false;
+        }
+        return request.getServletPath().startsWith("/actuator");
+    }
+
+    private void proceed(FilterChain filterChain, HttpServletRequest request, HttpServletResponse response)
+            throws IOException, ServletException {
+        filterChain.doFilter(request, response);
+    }
+
+    private void reject(HttpServletRequest request, HttpServletResponse response) throws IOException {
+        response.setStatus(HttpStatus.SC_METHOD_NOT_ALLOWED);
+        ApiGlobalErrorResponse errorResponse = ApiGlobalErrorResponse.invalidInstanceTypeMethod(request.getMethod());
+        response.getWriter().write(errorResponse.toJson());
+    }
+
+    private boolean isPathOnExceptionList(HttpServletRequest request) {
+        if (isBlank(request.getPathInfo())) {
+            return false;
+        }
+        return EXCEPTION_LIST.stream().anyMatch(item -> item.getPathFunction().apply(request.getPathInfo()));
+    }
+
+    private boolean isOnExceptionList(HttpServletRequest request) {
+        if (isBlank(request.getPathInfo())) {
+            return false;
+        }
+        return EXCEPTION_LIST.stream().anyMatch(
+                item -> item.getModeFunction().apply(fineractProperties.getMode()) && item.getPathFunction().apply(request.getPathInfo()));
+    }
+
+    private boolean isReadMethod(HttpServletRequest request) {
+        return HttpMethod.GET.equals(request.getMethod());
+    }
+
+    @RequiredArgsConstructor
+    @Getter
+    static class ExceptionListItem {
+
+        private final Function<FineractProperties.FineractModeProperties, Boolean> modeFunction;
+        private final Function<String, Boolean> pathFunction;
+
+        public static ExceptionListItem item(Function<FineractProperties.FineractModeProperties, Boolean> modeFunction,
+                Function<String, Boolean> pathFunction) {
+            return new ExceptionListItem(modeFunction, pathFunction);
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/api/SchedulerJobApiResource.java

@@ -133,7 +133,7 @@ public class SchedulerJobApiResource {
             @QueryParam(SchedulerJobApiConstants.COMMAND) @Parameter(description = "command") final String commandParam) {
         // check the logged in user have permissions to execute scheduler jobs
         Response response;
-        if (fineractProperties.getMode().isBatchInstance()) {
+        if (fineractProperties.getMode().isBatchEnabled()) {
             final boolean hasNotPermission = this.context.authenticatedUser().hasNotPermissionForAnyOf("ALL_FUNCTIONS",
                     "EXECUTEJOB_SCHEDULER");
             if (hasNotPermission) {

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/filter/FineractInstanceModeApiFilter.java

@@ -1,62 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.fineract.infrastructure.security.filter;
-
-import java.io.IOException;
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.ext.Provider;
-import lombok.RequiredArgsConstructor;
-import org.apache.fineract.infrastructure.core.config.FineractProperties;
-import org.apache.fineract.infrastructure.core.data.ApiGlobalErrorResponse;
-import org.apache.http.HttpStatus;
-import org.springframework.stereotype.Component;
-import org.springframework.web.filter.OncePerRequestFilter;
-
-@Provider
-@Component
-@RequiredArgsConstructor
-public class FineractInstanceModeApiFilter extends OncePerRequestFilter {
-
-    private final FineractProperties fineractProperties;
-
-    @Override
-    protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain)
-            throws ServletException, IOException {
-
-        if (fineractProperties.getMode().isReadInstance() && isReadMethod(request)) {
-            filterChain.doFilter(request, response);
-        } else if (fineractProperties.getMode().isWriteInstance()) {
-            filterChain.doFilter(request, response);
-        } else if (fineractProperties.getMode().isBatchInstance() && request.getPathInfo().startsWith("/jobs")) {
-            filterChain.doFilter(request, response);
-        } else {
-            response.setStatus(HttpStatus.SC_METHOD_NOT_ALLOWED);
-            ApiGlobalErrorResponse errorResponse = ApiGlobalErrorResponse.invalidInstanceTypeMethod(request.getMethod());
-            response.getWriter().write(errorResponse.toJson());
-        }
-    }
-
-    private boolean isReadMethod(HttpServletRequest request) {
-        return HttpMethod.GET.equals(request.getMethod());
-    }
-}

fineract-provider/src/test/java/org/apache/fineract/infrastructure/instancemode/filter/FineractInstanceModeApiFilterTest.java

@@ -0,0 +1,254 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.instancemode.filter;
+
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.apache.fineract.infrastructure.core.config.FineractProperties;
+import org.apache.hc.core5.http.HttpStatus;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+import org.springframework.http.HttpMethod;
+
+@ExtendWith(MockitoExtension.class)
+@MockitoSettings(strictness = Strictness.LENIENT)
+class FineractInstanceModeApiFilterTest {
+
+    @Mock
+    private FineractProperties fineractProperties;
+
+    @Mock
+    private HttpServletRequest request;
+
+    @Mock
+    private HttpServletResponse response;
+
+    @Mock
+    private FilterChain filterChain;
+
+    @Mock
+    private PrintWriter outputWriter;
+
+    @InjectMocks
+    private FineractInstanceModeApiFilter underTest;
+
+    @BeforeEach
+    void setUp() throws IOException {
+        given(response.getWriter()).willReturn(outputWriter);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetReadApisThrough_WhenFineractIsInAllModeAndIsGetApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(true, true, true);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getPathInfo()).willReturn("/loans");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetReadApisThrough_WhenFineractIsInReadOnlyModeAndIsGetApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(true, false, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getPathInfo()).willReturn("/loans");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetActuatorApisThrough_WhenFineractIsInReadOnlyModeAndIsHealthApi()
+            throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(true, false, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getServletPath()).willReturn("/actuator/health");
+        given(request.getPathInfo()).willReturn(null);
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldNotLetWriteApisThrough_WhenFineractIsInReadOnlyModeAndIsPostApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(true, false, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.POST.name());
+        given(request.getPathInfo()).willReturn("/loans");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verifyNoInteractions(filterChain);
+        verify(response).setStatus(HttpStatus.SC_METHOD_NOT_ALLOWED);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldNotLetBatchApisThrough_WhenFineractIsInReadOnlyModeAndIsJobsApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(true, false, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.POST.name());
+        given(request.getPathInfo()).willReturn("/jobs/1");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verifyNoInteractions(filterChain);
+        verify(response).setStatus(HttpStatus.SC_METHOD_NOT_ALLOWED);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetReadApisThrough_WhenFineractIsInWriteModeAndIsGetApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, true, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getPathInfo()).willReturn("/loans");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetWriteApisThrough_WhenFineractIsInWriteModeAndIsPostApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, true, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.POST.name());
+        given(request.getPathInfo()).willReturn("/loans");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetWriteApisThrough_WhenFineractIsInWriteModeAndIsPutApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, true, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.PUT.name());
+        given(request.getPathInfo()).willReturn("/loans/1");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetActuatorApisThrough_WhenFineractIsInWriteModeAndIsHelathApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, true, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getServletPath()).willReturn("/actuator/health");
+        given(request.getPathInfo()).willReturn(null);
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldNotLetBatchApisThrough_WhenFineractIsInWriteModeAndIsJobsApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, true, false);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.POST.name());
+        given(request.getPathInfo()).willReturn("/jobs/1");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verifyNoInteractions(filterChain);
+        verify(response).setStatus(HttpStatus.SC_METHOD_NOT_ALLOWED);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetBatchApisThrough_WhenFineractIsInBatchModeAndIsJobsApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, false, true);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.POST.name());
+        given(request.getPathInfo()).willReturn("/jobs/1");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetBatchApisThrough_WhenFineractIsInBatchModeAndIsListingJobsApi()
+            throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, false, true);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getPathInfo()).willReturn("/jobs");
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void testDoFilterInternal_ShouldLetActuatorApisThrough_WhenFineractIsInBatchModeAndIsHealthApi() throws ServletException, IOException {
+        // given
+        FineractProperties.FineractModeProperties modeProperties = createModeProps(false, false, true);
+        given(fineractProperties.getMode()).willReturn(modeProperties);
+        given(request.getMethod()).willReturn(HttpMethod.GET.name());
+        given(request.getServletPath()).willReturn("/actuator/health");
+        given(request.getPathInfo()).willReturn(null);
+        // when
+        underTest.doFilterInternal(request, response, filterChain);
+        // then
+        verify(filterChain).doFilter(request, response);
+    }
+
+    private FineractProperties.FineractModeProperties createModeProps(boolean readEnabled, boolean writeEnabled, boolean batchEnabled) {
+        FineractProperties.FineractModeProperties modeProperties = new FineractProperties.FineractModeProperties();
+        modeProperties.setReadEnabled(readEnabled);
+        modeProperties.setWriteEnabled(writeEnabled);
+        modeProperties.setBatchEnabled(batchEnabled);
+        return modeProperties;
+    }
+}