Skip to content

Commit 4b55c8b

Browse files
wouterpotwouterpot
committed
CGDMF-73: Fix tests
1 parent d15d57b commit 4b55c8b

4 files changed

Lines changed: 19 additions & 34 deletions

File tree

‎.bruno/CG-DMF/Admin/list-storage-repositories-forbidden.bru‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ meta {
55
}
66

77
get {
8-
url: {{baseUrl}}/admin/storage-repositories
8+
url: {{baseUrl}}/settings/storage-repositories
99
body: none
1010
auth: none
1111
}

‎docker-compose.integration-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ services:
6565
BLOB_STORAGE_ACCESS_KEY2: minioadmin
6666
BLOB_STORAGE_SECRET_KEY2: minioadmin
6767
BLOB_STORAGE_BUCKET2: documenten-archive
68-
OIDC_ISSUER: ${OIDC_ISSUER:-gzac}
68+
OIDC_ISSUER: ${OIDC_ISSUER:-https://auth.gzac.baseflow.com/realms/valtimo}
6969
OPENZAAK_CLIENT_SECRET: ${OPENZAAK_CLIENT_SECRET:-}
7070
BESTANDSDELEN_TRIGGER_SIZE: ${BESTANDSDELEN_TRIGGER_SIZE:-100000}
7171
BESTANDSDELEN_CHUNK_SIZE: ${BESTANDSDELEN_CHUNK_SIZE:-100000}

‎src/main/kotlin/config/AuthenticationConfig.kt‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,6 @@ internal object AuthenticationConfig : Config() {
1313

1414
val issuer: String = envOrSystem("OIDC_ISSUER", "http://localhost:8081/realms/cg-dmf")
1515

16-
/**
17-
* Optional HS256 secret for verifying custom `auth-jwt` tokens.
18-
*
19-
* When set via `OIDC_JWT_SECRET`, the service verifies tokens that were signed
20-
* with HMAC-SHA256 using this shared secret.
21-
*
22-
* This is not a fallback for Keycloak-issued OIDC access tokens. Those tokens are
23-
* RS256-signed and must be verified with the JWK/JWKS public key published by the issuer.
24-
*
25-
* When null (default), RS256 verification via the JWK endpoint is used — the production default.
26-
*/
27-
val jwtSecret: String? = envOrSystem("OIDC_JWT_SECRET", "").ifBlank { null }
28-
2916
/** Comma-separated list of client_id values allowed for ZGW-style JWT auth. */
3017
val zgwAllowedClientIds: List<String> = envOrSystem("ZGW_ALLOWED_CLIENT_IDS", "gzac")
3118
.split(",").map { it.trim() }.filter { it.isNotEmpty() }
@@ -59,7 +46,6 @@ internal object AuthenticationConfig : Config() {
5946

6047
override fun printConfig() {
6148
logger.info("AuthenticationConfig: issuer={}", issuer)
62-
logger.info("AuthenticationConfig: jwtSecret={}", jwtSecret?.let { "set" } ?: "not set")
6349
logger.info("AuthenticationConfig: zgwAllowedClientIds={}", zgwAllowedClientIds)
6450
logger.info("AuthenticationConfig: zgwClientSecrets configured for clients={}", zgwClientSecrets.keys)
6551
logger.info("AuthenticationConfig: adminRole={}", adminRole)

src/test/kotlin/api/admin/AdminRoleCheckTest.kt renamed to src/test/kotlin/api/settings/AdminRoleCheckTest.kt

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
// SPDX-License-Identifier: EUPL-1.2
22
// Copyright (C) 2026 Gemeente Utrecht
3-
package com.baseflow.api.admin
3+
package com.baseflow.api.settings
44

55
import com.auth0.jwt.JWT
66
import com.auth0.jwt.algorithms.Algorithm
77
import com.baseflow.api.apiJsonConfig
88
import com.baseflow.api.documenten.routes.TestBase
9+
import com.baseflow.api.middleware.AuditContext
10+
import com.baseflow.api.settings.settingsModule
911
import com.baseflow.api.wopi.wopi.WopiDocumentService
1012
import com.baseflow.config.ApplicationConfig
1113
import com.baseflow.config.BestandsDeelConfig
@@ -19,7 +21,6 @@ import com.baseflow.services.NotificationService
1921
import com.baseflow.services.ObjectInformatieObjectService
2022
import com.baseflow.services.StorageService
2123
import com.baseflow.services.WopiSlatService
22-
import com.baseflow.api.middleware.AuditContext
2324
import io.ktor.client.request.*
2425
import io.ktor.client.statement.*
2526
import io.ktor.http.*
@@ -45,7 +46,7 @@ import kotlin.test.Test
4546
import kotlin.test.assertEquals
4647

4748
/**
48-
* Tests the admin role-check plugin in `AdminRoutes.kt`.
49+
* Tests the settings role-check plugin in `SettingsRoutes.kt`.
4950
*
5051
* The role-check runs on the [AuthenticationChecked] hook and verifies that the
5152
* authenticated principal carries the required role (`dmf-admin` by default).
@@ -153,7 +154,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
153154
}
154155
}
155156

156-
adminModule(useAuthentication = true)
157+
settingsModule(useAuthentication = true)
157158
}
158159

159160
// ── No / invalid auth ─────────────────────────────────────────────────────
@@ -162,8 +163,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
162163
fun `request without Authorization header returns 401`() = testApplication {
163164
application { setupWithAuth() }
164165

165-
// No principal → role-check skips → auth challenge fires → 401.
166-
val response = client.get("/admin/storage-repositories")
166+
val response = client.get("/settings/storage-repositories")
167167

168168
assertEquals(HttpStatusCode.Unauthorized, response.status)
169169
}
@@ -172,8 +172,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
172172
fun `request with an invalid token returns 401`() = testApplication {
173173
application { setupWithAuth() }
174174

175-
// Invalid token → JWT validator returns null → auth challenge fires → 401.
176-
val response = client.get("/admin/storage-repositories") {
175+
val response = client.get("/settings/storage-repositories") {
177176
header(HttpHeaders.Authorization, "Bearer this.is.not.valid")
178177
}
179178

@@ -186,7 +185,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
186185
fun `valid token with no role claims returns 403`() = testApplication {
187186
application { setupWithAuth() }
188187

189-
val response = client.get("/admin/storage-repositories") {
188+
val response = client.get("/settings/storage-repositories") {
190189
header(HttpHeaders.Authorization, "Bearer ${tokenWithNoRoles()}")
191190
}
192191

@@ -197,7 +196,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
197196
fun `valid token with a different realm_access role returns 403`() = testApplication {
198197
application { setupWithAuth() }
199198

200-
val response = client.get("/admin/storage-repositories") {
199+
val response = client.get("/settings/storage-repositories") {
201200
header(HttpHeaders.Authorization, "Bearer ${tokenWithKeycloakRoles(OTHER_ROLE)}")
202201
}
203202

@@ -208,7 +207,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
208207
fun `valid token with a different top-level role returns 403`() = testApplication {
209208
application { setupWithAuth() }
210209

211-
val response = client.get("/admin/storage-repositories") {
210+
val response = client.get("/settings/storage-repositories") {
212211
header(HttpHeaders.Authorization, "Bearer ${tokenWithZgwRoles(OTHER_ROLE)}")
213212
}
214213

@@ -219,7 +218,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
219218
fun `403 response body is a problem detail with status 403`() = testApplication {
220219
application { setupWithAuth() }
221220

222-
val response = client.get("/admin/storage-repositories") {
221+
val response = client.get("/settings/storage-repositories") {
223222
header(HttpHeaders.Authorization, "Bearer ${tokenWithNoRoles()}")
224223
}
225224

@@ -234,7 +233,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
234233
fun `token with admin role in realm_access returns 200`() = testApplication {
235234
application { setupWithAuth() }
236235

237-
val response = client.get("/admin/storage-repositories") {
236+
val response = client.get("/settings/storage-repositories") {
238237
header(HttpHeaders.Authorization, "Bearer ${tokenWithKeycloakRoles(ADMIN_ROLE)}")
239238
}
240239

@@ -245,7 +244,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
245244
fun `token with admin role alongside other roles in realm_access returns 200`() = testApplication {
246245
application { setupWithAuth() }
247246

248-
val response = client.get("/admin/storage-repositories") {
247+
val response = client.get("/settings/storage-repositories") {
249248
header(HttpHeaders.Authorization, "Bearer ${tokenWithKeycloakRoles(OTHER_ROLE, ADMIN_ROLE, "yet-another")}")
250249
}
251250

@@ -258,7 +257,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
258257
fun `token with admin role in top-level roles claim returns 200`() = testApplication {
259258
application { setupWithAuth() }
260259

261-
val response = client.get("/admin/storage-repositories") {
260+
val response = client.get("/settings/storage-repositories") {
262261
header(HttpHeaders.Authorization, "Bearer ${tokenWithZgwRoles(ADMIN_ROLE)}")
263262
}
264263

@@ -269,7 +268,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
269268
fun `token with admin role alongside other roles in top-level roles returns 200`() = testApplication {
270269
application { setupWithAuth() }
271270

272-
val response = client.get("/admin/storage-repositories") {
271+
val response = client.get("/settings/storage-repositories") {
273272
header(HttpHeaders.Authorization, "Bearer ${tokenWithZgwRoles(OTHER_ROLE, ADMIN_ROLE)}")
274273
}
275274

@@ -282,7 +281,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
282281
fun `role check applies to POST sub-route`() = testApplication {
283282
application { setupWithAuth() }
284283

285-
val response = client.post("/admin/storage-repositories") {
284+
val response = client.post("/settings/storage-repositories") {
286285
header(HttpHeaders.Authorization, "Bearer ${tokenWithNoRoles()}")
287286
contentType(ContentType.Application.Json)
288287
setBody("{}")
@@ -296,7 +295,7 @@ class AdminRoleCheckTest : TestBase("admin_role_check") {
296295
fun `role check applies to nested PUT sub-route`() = testApplication {
297296
application { setupWithAuth() }
298297

299-
val response = client.put("/admin/storage-repositories/default") {
298+
val response = client.put("/settings/storage-repositories/default") {
300299
header(HttpHeaders.Authorization, "Bearer ${tokenWithNoRoles()}")
301300
contentType(ContentType.Application.Json)
302301
setBody("{}")

0 commit comments

Comments
 (0)