Skip to content

Commit 2e6d860

Browse files
adamdickmeissadamdickmeiss
committed
Return 403 in for /broker if no item(s) match
1 parent 3eb8432 commit 2e6d860

File tree

3 files changed

+92
-41
lines changed

3 files changed

+92
-41
lines changed

‎broker/api/api-handler.go‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -75,15 +75,21 @@ func (a *ApiHandler) GetEvents(w http.ResponseWriter, r *http.Request, params oa
7575
if err == nil && a.TenantFilter(&tran, params.XOkapiTenant, params.RequesterSymbol) {
7676
eventList, err = a.eventRepo.GetIllTransactionEvents(ctx, tran.ID)
7777
}
78-
} else if a.tenantToSymbol == "" && params.IllTransactionId != nil {
79-
eventList, err = a.eventRepo.GetIllTransactionEvents(ctx, *params.IllTransactionId)
8078
} else if a.tenantToSymbol == "" {
81-
eventList, err = a.eventRepo.ListEvents(ctx)
79+
if params.IllTransactionId != nil {
80+
eventList, err = a.eventRepo.GetIllTransactionEvents(ctx, *params.IllTransactionId)
81+
} else {
82+
eventList, err = a.eventRepo.ListEvents(ctx)
83+
}
8284
}
8385
if err != nil && !errors.Is(err, pgx.ErrNoRows) {
8486
addInternalError(ctx, w, err)
8587
return
8688
}
89+
if len(eventList) == 0 && a.tenantToSymbol != "" {
90+
addForbiddenError(ctx, w)
91+
return
92+
}
8793
resp := []oapi.Event{}
8894
for _, event := range eventList {
8995
resp = append(resp, toApiEvent(event))
@@ -108,7 +114,7 @@ func (a *ApiHandler) GetIllTransactions(w http.ResponseWriter, r *http.Request,
108114
if a.TenantFilter(&tran, params.XOkapiTenant, params.RequesterSymbol) {
109115
resp = append(resp, toApiIllTransaction(r, tran))
110116
}
111-
} else {
117+
} else if a.tenantToSymbol == "" {
112118
trans, err := a.illRepo.ListIllTransactions(ctx)
113119
if err != nil {
114120
addInternalError(ctx, w, err)
@@ -120,6 +126,10 @@ func (a *ApiHandler) GetIllTransactions(w http.ResponseWriter, r *http.Request,
120126
}
121127
}
122128
}
129+
if len(resp) == 0 && a.tenantToSymbol != "" {
130+
addForbiddenError(ctx, w)
131+
return
132+
}
123133
writeJsonResponse(w, resp)
124134
}
125135

@@ -128,18 +138,16 @@ func (a *ApiHandler) GetIllTransactionsId(w http.ResponseWriter, r *http.Request
128138
Other: map[string]string{"method": "GetIllTransactionsId", "id": id},
129139
})
130140
trans, err := a.illRepo.GetIllTransactionById(ctx, id)
131-
if err != nil {
132-
if errors.Is(err, pgx.ErrNoRows) {
133-
addNotFoundError(w)
134-
return
135-
} else {
136-
addInternalError(ctx, w, err)
141+
if err != nil && !errors.Is(err, pgx.ErrNoRows) {
142+
addInternalError(ctx, w, err)
143+
return
144+
}
145+
if err != nil || !a.TenantFilter(&trans, params.XOkapiTenant, params.RequesterSymbol) {
146+
if a.tenantToSymbol != "" {
147+
addForbiddenError(ctx, w)
137148
return
138149
}
139-
}
140-
if !a.TenantFilter(&trans, params.XOkapiTenant, params.RequesterSymbol) {
141150
addNotFoundError(w)
142-
return
143151
}
144152
writeJsonResponse(w, toApiIllTransaction(r, trans))
145153
}
@@ -496,15 +504,21 @@ func (a *ApiHandler) GetLocatedSuppliers(w http.ResponseWriter, r *http.Request,
496504
if err == nil && a.TenantFilter(&tran, params.XOkapiTenant, params.RequesterSymbol) {
497505
supList, err = a.illRepo.GetLocatedSupplierByIllTransition(ctx, tran.ID)
498506
}
499-
} else if a.tenantToSymbol == "" && params.IllTransactionId != nil {
500-
supList, err = a.illRepo.GetLocatedSupplierByIllTransition(ctx, *params.IllTransactionId)
501507
} else if a.tenantToSymbol == "" {
502-
supList, err = a.illRepo.ListLocatedSuppliers(ctx)
508+
if params.IllTransactionId != nil {
509+
supList, err = a.illRepo.GetLocatedSupplierByIllTransition(ctx, *params.IllTransactionId)
510+
} else {
511+
supList, err = a.illRepo.ListLocatedSuppliers(ctx)
512+
}
503513
}
504514
if err != nil && !errors.Is(err, pgx.ErrNoRows) {
505515
addInternalError(ctx, w, err)
506516
return
507517
}
518+
if len(supList) == 0 && a.tenantToSymbol != "" {
519+
addForbiddenError(ctx, w)
520+
return
521+
}
508522
resp := []oapi.LocatedSupplier{}
509523
for _, supplier := range supList {
510524
resp = append(resp, toApiLocatedSupplier(r, supplier))
@@ -544,6 +558,16 @@ func addInternalError(ctx extctx.ExtendedContext, w http.ResponseWriter, err err
544558
_ = json.NewEncoder(w).Encode(resp)
545559
}
546560

561+
func addForbiddenError(ctx extctx.ExtendedContext, w http.ResponseWriter) {
562+
resp := ErrorMessage{
563+
Error: "forbidden",
564+
}
565+
ctx.Logger().Error("error serving api request", "error", "forbidden")
566+
w.Header().Set("Content-Type", "application/json")
567+
w.WriteHeader(http.StatusForbidden)
568+
_ = json.NewEncoder(w).Encode(resp)
569+
}
570+
547571
func addBadRequestError(ctx extctx.ExtendedContext, w http.ResponseWriter, err error) {
548572
resp := ErrorMessage{
549573
Error: err.Error(),

‎broker/oapi/open-api.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,16 @@ paths:
272272
error:
273273
type: string
274274
description: Error message
275+
'403': # Example error response
276+
description: Forbidden. Invalid tenant.
277+
content:
278+
application/json:
279+
schema:
280+
type: object
281+
properties:
282+
error:
283+
type: string
284+
description: Error message
275285
'500': # Example error response
276286
description: Internal Server Error
277287
content:
@@ -311,6 +321,16 @@ paths:
311321
error:
312322
type: string
313323
description: Error message
324+
'403': # Example error response
325+
description: Forbidden. Invalid tenant.
326+
content:
327+
application/json:
328+
schema:
329+
type: object
330+
properties:
331+
error:
332+
type: string
333+
description: Error message
314334
'500': # Example error response
315335
description: Internal Server Error
316336
content:
@@ -363,6 +383,16 @@ paths:
363383
error:
364384
type: string
365385
description: Error message
386+
'403': # Example error response
387+
description: Forbidden. Invalid tenant.
388+
content:
389+
application/json:
390+
schema:
391+
type: object
392+
properties:
393+
error:
394+
type: string
395+
description: Error message
366396
'500': # Example error response
367397
description: Internal Server Error
368398
content:
@@ -495,6 +525,16 @@ paths:
495525
error:
496526
type: string
497527
description: Error message
528+
'403': # Example error response
529+
description: Forbidden. Invalid tenant.
530+
content:
531+
application/json:
532+
schema:
533+
type: object
534+
properties:
535+
error:
536+
type: string
537+
description: Error message
498538
'500':
499539
description: Internal Server Error
500540
content:

‎broker/test/api/api-handler_test.go‎

Lines changed: 12 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -225,29 +225,28 @@ func TestBrokerCRUD(t *testing.T) {
225225
assert.NoError(t, err)
226226
assert.Equal(t, illId, tran.ID)
227227

228-
httpGetWithTenant(t, "/broker/ill_transactions/"+illId+"?requester_symbol="+url.QueryEscape("ISIL:DK-DIKU"), "ruc", http.StatusNotFound)
228+
httpGetWithTenant(t, "/broker/ill_transactions/"+illId+"?requester_symbol="+url.QueryEscape("ISIL:DK-DIKU"), "ruc", http.StatusForbidden)
229229

230-
httpGetWithTenant(t, "/broker/ill_transactions/"+illId, "ruc", http.StatusNotFound)
230+
httpGetWithTenant(t, "/broker/ill_transactions/"+illId, "ruc", http.StatusForbidden)
231231

232-
httpGetWithTenant(t, "/broker/ill_transactions/"+illId, "", http.StatusNotFound)
232+
httpGetWithTenant(t, "/broker/ill_transactions/"+illId, "", http.StatusForbidden)
233233

234234
body = httpGetWithTenant(t, "/broker/ill_transactions/"+illId+"?requester_symbol="+url.QueryEscape("ISIL:DK-DIKU"), "", http.StatusOK)
235235
err = json.Unmarshal(body, &tran)
236236
assert.NoError(t, err)
237237
assert.Equal(t, illId, tran.ID)
238238

239-
body = httpGetWithTenant(t, "/broker/ill_transactions", "diku", http.StatusOK)
239+
httpGetWithTenant(t, "/broker/ill_transactions", "diku", http.StatusForbidden)
240+
241+
httpGetWithTenant(t, "/broker/ill_transactions", "ruc", http.StatusForbidden)
242+
243+
body = httpGetWithTenant(t, "/broker/ill_transactions?requester_req_id="+url.QueryEscape(reqReqId), "diku", http.StatusOK)
240244
var trans []oapi.IllTransaction
241245
err = json.Unmarshal(body, &trans)
242246
assert.NoError(t, err)
243247
assert.Len(t, trans, 1)
244248
assert.Equal(t, illId, trans[0].ID)
245249

246-
body = httpGetWithTenant(t, "/broker/ill_transactions", "ruc", http.StatusOK)
247-
err = json.Unmarshal(body, &trans)
248-
assert.NoError(t, err)
249-
assert.Len(t, trans, 0)
250-
251250
peer := test.CreatePeer(t, illRepo, "ISIL:LOC_OTHER", "")
252251
locSup := test.CreateLocatedSupplier(t, illRepo, illId, peer.ID, "ISIL:LOC_OTHER", string(iso18626.TypeStatusLoaned))
253252

@@ -258,15 +257,9 @@ func TestBrokerCRUD(t *testing.T) {
258257
assert.Len(t, supps, 1)
259258
assert.Equal(t, locSup.ID, supps[0].ID)
260259

261-
body = httpGetWithTenant(t, "/broker/located_suppliers?requester_req_id="+url.QueryEscape(reqReqId), "ruc", http.StatusOK)
262-
err = json.Unmarshal(body, &supps)
263-
assert.NoError(t, err)
264-
assert.Len(t, supps, 0)
260+
httpGetWithTenant(t, "/broker/located_suppliers?requester_req_id="+url.QueryEscape(reqReqId), "ruc", http.StatusForbidden)
265261

266-
body = httpGetWithTenant(t, "/broker/located_suppliers?requester_req_id="+url.QueryEscape(uuid.NewString()), "diku", http.StatusOK)
267-
err = json.Unmarshal(body, &supps)
268-
assert.NoError(t, err)
269-
assert.Len(t, supps, 0)
262+
httpGetWithTenant(t, "/broker/located_suppliers?requester_req_id="+url.QueryEscape(uuid.NewString()), "diku", http.StatusForbidden)
270263

271264
eventId := test.GetEventId(t, eventRepo, illId, events.EventTypeNotice, events.EventStatusSuccess, events.EventNameMessageRequester)
272265

@@ -283,15 +276,9 @@ func TestBrokerCRUD(t *testing.T) {
283276
assert.Len(t, events, 1)
284277
assert.Equal(t, eventId, events[0].ID)
285278

286-
body = httpGetWithTenant(t, "/broker/events?requester_req_id="+url.QueryEscape(reqReqId), "ruc", http.StatusOK)
287-
err = json.Unmarshal(body, &events)
288-
assert.NoError(t, err)
289-
assert.Len(t, events, 0)
279+
httpGetWithTenant(t, "/broker/events?requester_req_id="+url.QueryEscape(reqReqId), "ruc", http.StatusForbidden)
290280

291-
body = httpGetWithTenant(t, "/broker/events?requester_req_id="+url.QueryEscape(uuid.NewString()), "diku", http.StatusOK)
292-
err = json.Unmarshal(body, &events)
293-
assert.NoError(t, err)
294-
assert.Len(t, events, 0)
281+
httpGetWithTenant(t, "/broker/events?requester_req_id="+url.QueryEscape(uuid.NewString()), "diku", http.StatusForbidden)
295282
}
296283

297284
func TestPeersCRUD(t *testing.T) {

0 commit comments

Comments
 (0)