test: pin /api/me contract and AuthorityInterceptor authority-source behavior

dhis-2/dhis-test-web-api/src/test/java/org/hisp/dhis/webapi/controller/MeControllerTest.java

@@ -37,6 +37,7 @@
 import static org.hisp.dhis.security.apikey.ApiKeyTokenGenerator.generatePersonalAccessToken;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -136,6 +137,54 @@ void testHasAuthority() {
     assertFalse(GET("/me/authorities/missing").content(HttpStatus.OK).booleanValue());
   }
 
+  /**
+   * Contract pins for the {@code /api/me} response shape. These assert the CURRENT contract that
+   * clients rely on; changing any of them must be a deliberate, reviewed decision.
+   */
+  @Test
+  void testGetCurrentUser_ContractShape() {
+    JsonObject me = GET("/me").content(HttpStatus.OK);
+
+    assertEquals("userA", me.getString("username").string());
+    // PIN: "name" is the display name (first name + surname), NOT the username
+    assertEquals(userA.getFirstName() + " " + userA.getSurname(), me.getString("name").string());
+    assertNotEquals(me.getString("username").string(), me.getString("name").string());
+    assertTrue(me.getArray("authorities").stringValues().contains("ALL"));
+    assertTrue(me.getObject("settings").exists());
+    // impersonation fields only appear while impersonating / when the feature is enabled
+    assertFalse(me.get("impersonation").exists());
+    assertFalse(me.get("canImpersonate").exists());
+  }
+
+  @Test
+  void testGetAuthorities_ExactSetForLimitedUser() {
+    switchToNewUser("contract", "F_PERFORM_MAINTENANCE");
+    assertEquals(
+        singletonList("F_PERFORM_MAINTENANCE"),
+        GET("/me/authorities").content(HttpStatus.OK).stringValues());
+    assertEquals(
+        singletonList("F_PERFORM_MAINTENANCE"),
+        GET("/me?fields=authorities")
+            .content(HttpStatus.OK)
+            .getArray("authorities")
+            .stringValues());
+  }
+
+  @Test
+  void testHasAuthority_NonSuperuserExactMatch() {
+    switchToNewUser("contract", "F_PERFORM_MAINTENANCE");
+    assertTrue(
+        GET("/me/authorization/F_PERFORM_MAINTENANCE").content(HttpStatus.OK).booleanValue());
+    assertFalse(GET("/me/authorization/F_DOES_NOT_EXIST").content(HttpStatus.OK).booleanValue());
+  }
+
+  @Test
+  void testHasAuthority_SuperuserImplicitlyHasAnyAuthority() {
+    // PIN: userA holds ALL; isAuthorized() implicitly grants ANY authority for superusers
+    assertTrue(
+        GET("/me/authorization/F_PERFORM_MAINTENANCE").content(HttpStatus.OK).booleanValue());
+  }
+
   @Test
   void testGetEmailVerifiedProperty() {
     assertFalse(GET("/me").content().as(JsonMeDto.class).getEmailVerified());

dhis-2/dhis-test-web-api/src/test/java/org/hisp/dhis/webapi/controller/security/ImpersonateUserControllerTest.java

@@ -30,11 +30,15 @@
 package org.hisp.dhis.webapi.controller.security;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.util.Properties;
 import org.hisp.dhis.external.conf.ConfigurationKey;
 import org.hisp.dhis.external.conf.DhisConfigurationProvider;
 import org.hisp.dhis.http.HttpStatus;
+import org.hisp.dhis.jsontree.JsonObject;
 import org.hisp.dhis.test.config.H2DhisConfigurationProvider;
 import org.hisp.dhis.test.webapi.H2ControllerIntegrationTestBase;
 import org.hisp.dhis.test.webapi.json.domain.JsonImpersonateUserResponse;
@@ -209,4 +213,51 @@ void testImpersonateWithAuthorityNotAllowedToBecomeSuperuser() {
     assertEquals("Forbidden", response.getHttpStatus());
     assertEquals("ERROR", response.getStatus());
   }
+
+  /**
+   * PIN: the {@code /api/me} {@code impersonation} field carries the impersonator USERNAME (from
+   * {@code Authentication#getName()}), never the display name. Frontends match it against the
+   * username; PR #24124 accidentally changed it to first+surname which this test would catch.
+   */
+  @Test
+  void testMeImpersonationFieldsDuringAndAfterImpersonation() {
+    User impersonator = createUserWithAuth("impuser", "F_IMPERSONATE_USER");
+    createUserWithAuth("target", "NONE");
+    injectSecurityContextUser(impersonator);
+
+    POST("/auth/impersonate?username=target").content(HttpStatus.OK);
+
+    JsonObject during =
+        GET("/me?fields=username,impersonation,canImpersonate").content(HttpStatus.OK);
+    assertEquals("target", during.getString("username").string());
+    assertEquals("impuser", during.getString("impersonation").string());
+    assertNotEquals(impersonator.getName(), during.getString("impersonation").string());
+    // the impersonated user itself holds no impersonation authority
+    assertFalse(during.get("canImpersonate").exists());
+
+    POST("/auth/impersonateExit").content(HttpStatus.OK);
+
+    JsonObject after =
+        GET("/me?fields=username,impersonation,canImpersonate").content(HttpStatus.OK);
+    assertEquals("impuser", after.getString("username").string());
+    assertFalse(after.get("impersonation").exists());
+    assertTrue(after.getBoolean("canImpersonate").booleanValue());
+  }
+
+  @Test
+  void testMeCanImpersonateForAdminWhenFeatureEnabled() {
+    JsonObject me = GET("/me?fields=canImpersonate,impersonation").content(HttpStatus.OK);
+    assertTrue(me.getBoolean("canImpersonate").booleanValue());
+    assertFalse(me.get("impersonation").exists());
+  }
+
+  @Test
+  void testMeCanImpersonateAbsentWithoutAuthority() {
+    User guest = createUserWithAuth("guestimp", "NONE");
+    injectSecurityContextUser(guest);
+
+    JsonObject me = GET("/me?fields=canImpersonate,impersonation").content(HttpStatus.OK);
+    assertFalse(me.get("canImpersonate").exists());
+    assertFalse(me.get("impersonation").exists());
+  }
 }