FINERACT-2081: Handle unauthenticated requests in LoanCOBApiFilter

fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/filter/LoanCOBApiFilter.java

@@ -32,6 +32,7 @@ import org.apache.fineract.infrastructure.jobs.exception.LoanIdsHardLockedExcept
 import org.apache.fineract.useradministration.exception.UnAuthenticatedUserException;
 import org.apache.http.HttpStatus;
 import org.springframework.context.annotation.Conditional;
+import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 @RequiredArgsConstructor
@@ -84,7 +85,7 @@ public class LoanCOBApiFilter extends OncePerRequestFilter {
                     }
                 }
             } catch (UnAuthenticatedUserException e) {
-                Reject.reject(null, HttpStatus.SC_UNAUTHORIZED).toServletResponse(response);
+                throw new AuthenticationCredentialsNotFoundException("Not Authenticated", e);
             }
         }
     }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/service/SpringSecurityPlatformSecurityContext.java

@@ -63,7 +63,10 @@ public class SpringSecurityPlatformSecurityContext implements PlatformSecurityCo
         if (context != null) {
             final Authentication auth = context.getAuthentication();
             if (auth != null) {
-                currentUser = (AppUser) auth.getPrincipal();
+                Object principal = auth.getPrincipal();
+                if (principal instanceof AppUser appUser) {
+                    currentUser = appUser;
+                }
             }
         }
 

fineract-provider/src/test/java/org/apache/fineract/infrastructure/jobs/filter/LoanCOBApiFilterTest.java

@@ -20,18 +20,24 @@ package org.apache.fineract.infrastructure.jobs.filter;
 
 import static org.apache.fineract.infrastructure.jobs.filter.LoanCOBFilterHelper.LOAN_GLIMACCOUNT_PATH_PATTERN;
 import static org.apache.fineract.infrastructure.jobs.filter.LoanCOBFilterHelper.LOAN_PATH_PATTERN;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyList;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 import com.sun.research.ws.wadl.HTTPMethods;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -58,6 +64,7 @@ import org.apache.fineract.portfolio.loanaccount.domain.Loan;
 import org.apache.fineract.portfolio.loanaccount.domain.LoanRepository;
 import org.apache.fineract.portfolio.loanaccount.rescheduleloan.domain.LoanRescheduleRequestRepository;
 import org.apache.fineract.useradministration.domain.AppUser;
+import org.apache.fineract.useradministration.exception.UnAuthenticatedUserException;
 import org.apache.http.HttpStatus;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
@@ -71,6 +78,7 @@ import org.mockito.junit.jupiter.MockitoSettings;
 import org.mockito.quality.Strictness;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
 
 @ExtendWith(MockitoExtension.class)
 @MockitoSettings(strictness = Strictness.LENIENT)
@@ -445,4 +453,41 @@ class LoanCOBApiFilterTest {
         testObj.doFilterInternal(request, response, filterChain);
         verify(response, times(1)).setStatus(HttpStatus.SC_CONFLICT);
     }
+
+    @Test
+    void shouldThrowAuthenticationCredentialsNotFoundException_WhenUnAuthenticatedUserExceptionIsThrown() throws IOException {
+        LoanCOBFilterHelper spyHelper = spy(helper);
+        testObj = new LoanCOBApiFilter(spyHelper);
+        MockHttpServletRequest request = mock(MockHttpServletRequest.class);
+        MockHttpServletResponse response = mock(MockHttpServletResponse.class);
+        FilterChain filterChain = mock(FilterChain.class);
+
+        final byte[] cachedBody = new byte[0];
+        given(request.getInputStream())
+                .willReturn(new BodyCachingHttpServletRequestWrapper.CachedBodyServletInputStream(new ByteArrayInputStream(cachedBody)));
+        doReturn(true).when(spyHelper).isOnApiList(any(BodyCachingHttpServletRequestWrapper.class));
+        doThrow(new UnAuthenticatedUserException()).when(spyHelper).isBypassUser();
+
+        assertThrows(AuthenticationCredentialsNotFoundException.class, () -> testObj.doFilterInternal(request, response, filterChain));
+        verifyNoInteractions(filterChain);
+    }
+
+    @Test
+    void shouldProceed_WhenAuthenticatedUser() throws Exception {
+        LoanCOBFilterHelper spyHelper = spy(helper);
+        testObj = new LoanCOBApiFilter(spyHelper);
+        MockHttpServletRequest request = mock(MockHttpServletRequest.class);
+        MockHttpServletResponse response = mock(MockHttpServletResponse.class);
+        FilterChain filterChain = mock(FilterChain.class);
+
+        final byte[] cachedBody = new byte[0];
+        given(request.getInputStream())
+                .willReturn(new BodyCachingHttpServletRequestWrapper.CachedBodyServletInputStream(new ByteArrayInputStream(cachedBody)));
+        doReturn(true).when(spyHelper).isOnApiList(any(BodyCachingHttpServletRequestWrapper.class));
+        doReturn(true).when(spyHelper).isBypassUser();
+
+        testObj.doFilterInternal(request, response, filterChain);
+
+        verify(filterChain, times(1)).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
+    }
 }

fineract-provider/src/test/java/org/apache/fineract/infrastructure/security/service/SpringSecurityPlatformSecurityContextTest.java

@@ -0,0 +1,114 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.service;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.when;
+
+import org.apache.fineract.infrastructure.configuration.domain.ConfigurationDomainService;
+import org.apache.fineract.infrastructure.security.exception.ResetPasswordException;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.apache.fineract.useradministration.exception.UnAuthenticatedUserException;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+@ExtendWith(MockitoExtension.class)
+class SpringSecurityPlatformSecurityContextTest {
+
+    @Mock
+    private SecurityContext securityContext;
+
+    @Mock
+    private Authentication authentication;
+
+    @Mock
+    private AppUser appUser;
+
+    @Mock
+    private ConfigurationDomainService configurationDomainService;
+
+    @InjectMocks
+    private SpringSecurityPlatformSecurityContext securityContextProvider;
+
+    @BeforeEach
+    void setUp() {
+        SecurityContextHolder.setContext(securityContext);
+    }
+
+    @AfterEach
+    void tearDown() {
+        SecurityContextHolder.clearContext();
+    }
+
+    @Test
+    void shouldReturnAppUserWhenPrincipalIsAppUser() {
+        when(securityContext.getAuthentication()).thenReturn(authentication);
+        when(authentication.getPrincipal()).thenReturn(appUser);
+        when(configurationDomainService.isPasswordForcedResetEnable()).thenReturn(false);
+
+        AppUser result = securityContextProvider.authenticatedUser();
+
+        assertEquals(appUser, result, "authenticatedUser() should return AppUser");
+    }
+
+    @Test
+    void shouldThrowUnAuthenticatedUserExceptionWhenPrincipalIsNotAppUser() {
+        when(securityContext.getAuthentication()).thenReturn(authentication);
+        when(authentication.getPrincipal()).thenReturn("anonymousUser");
+
+        assertThrows(UnAuthenticatedUserException.class,
+                     () -> securityContextProvider.authenticatedUser(),
+                     "authenticatedUser() should throw UnAuthenticatedUserException when "
+                             + "Principal is not AppUser");
+    }
+
+    @Test
+    void shouldThrowUnAuthenticatedUserExceptionWhenAuthenticationIsNull() {
+        when(securityContext.getAuthentication()).thenReturn(null);
+
+        assertThrows(UnAuthenticatedUserException.class,
+                     () -> securityContextProvider.authenticatedUser(),
+                     "authenticatedUser() should throw UnAuthenticatedUserException when "
+                             + "Authentication is null");
+    }
+
+    @Test
+    void shouldThrowResetPasswordExceptionWhenPasswordMustBeReset() {
+        when(securityContext.getAuthentication()).thenReturn(authentication);
+        when(authentication.getPrincipal()).thenReturn(appUser);
+        SpringSecurityPlatformSecurityContext spyContextProvider = spy(securityContextProvider);
+        doReturn(true).when(spyContextProvider).doesPasswordHasToBeRenewed(appUser);
+
+        assertThrows(ResetPasswordException.class,
+                     spyContextProvider::authenticatedUser,
+                     "authenticatedUser() should throw ResetPasswordException when password needs"
+                             + " to be reset");
+    }
+}