fix: Current permissions -> PAK with no-auth mode #6074

45 passed, 1 failed and 0 skipped

Report	Passed	Failed	Time
backend/security/build/test-results/test/TEST-io.tolgee.security.authentication.AuthenticationDisabledFilterTest.xml	3✅		136ms
backend/security/build/test-results/test/TEST-io.tolgee.security.authentication.AuthenticationFilterTest.xml	10✅	1❌	181ms
backend/security/build/test-results/test/TEST-io.tolgee.security.authentication.AuthenticationInterceptorTest.xml	3✅		111ms
backend/security/build/test-results/test/TEST-io.tolgee.security.authorization.OrganizationAuthorizationInterceptorTest.xml	5✅		155ms
backend/security/build/test-results/test/TEST-io.tolgee.security.authorization.ProjectAuthorizationInterceptorTest.xml	10✅		211ms
backend/security/build/test-results/test/TEST-io.tolgee.security.ratelimit.GlobalIpRateLimitFilterTest.xml	3✅		12ms
backend/security/build/test-results/test/TEST-io.tolgee.security.ratelimit.GlobalUserRateLimitFilterTest.xml	3✅		7ms
backend/security/build/test-results/test/TEST-io.tolgee.security.ratelimit.RateLimitInterceptorTest.xml	8✅		171ms

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.authentication.AuthenticationDisabledFilterTest.xml

3 tests were completed in 136ms with 3 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.authentication.AuthenticationDisabledFilterTest	3✅			136ms

✅ io.tolgee.security.authentication.AuthenticationDisabledFilterTest

✅ it does not filter when request is OPTIONS()
✅ it does not require authentication to go through()
✅ it does not authenticate when authentication is enabled()

❌ backend/security/build/test-results/test/TEST-io.tolgee.security.authentication.AuthenticationFilterTest.xml

11 tests were completed in 181ms with 10 passed, 1 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.authentication.AuthenticationFilterTest	10✅	1❌		181ms

❌ io.tolgee.security.authentication.AuthenticationFilterTest

✅ it does not allow request to go through with invalid JWT tokens()
✅ it does not filter when request is OPTIONS()
✅ it applies a rate limit on authentication attempts()
✅ it allows request to go through when using invalid PAK()
✅ it allows request to go through when using invalid PAT()
✅ it allows request to go through with valid JWT token()
❌ it does not filter when auth is disabled()
	org.opentest4j.AssertionFailedError: Unexpected exception thrown: java.lang.NullPointerException: Parameter specified as non-null is null: method io.tolgee.dtos.cacheable.UserAccountDto.<init>, parameter name
✅ it allows request to go through when using expired PAK()
✅ it allows request to go through when using expired PAT()
✅ it allows request to go through when using valid PAK()
✅ it allows request to go through when using valid PAT()

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.authentication.AuthenticationInterceptorTest.xml

3 tests were completed in 111ms with 3 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.authentication.AuthenticationInterceptorTest	3✅			111ms

✅ io.tolgee.security.authentication.AuthenticationInterceptorTest

✅ it doesn't allow API key authentication by default()
✅ it enforces the super JWT requirement()
✅ it doesn't interfere with basic endpoints()

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.authorization.OrganizationAuthorizationInterceptorTest.xml

5 tests were completed in 155ms with 5 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.authorization.OrganizationAuthorizationInterceptorTest	5✅			155ms

✅ io.tolgee.security.authorization.OrganizationAuthorizationInterceptorTest

✅ rejects access if the user does not have a sufficiently high role()
✅ it hides the organization if the user cannot see it()
✅ it has no effect on endpoints not specific to a single organization()
✅ it requires an annotation to be present on the handler()
✅ it does not allow both annotations to be present()

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.authorization.ProjectAuthorizationInterceptorTest.xml

10 tests were completed in 211ms with 10 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.authorization.ProjectAuthorizationInterceptorTest	10✅			211ms

✅ io.tolgee.security.authorization.ProjectAuthorizationInterceptorTest

✅ it hides the organization if the user cannot see it()
✅ permissions work as intended when using implicit project id()
✅ it does not let scopes on the key work if the authenticated user does not have them()
✅ it has no effect on endpoints not specific to a single project()
✅ ensures API key works only for the project it is bound to()
✅ rejects access if the user does not have the required scope (single scope)()
✅ it restricts scopes to the ones set to the API key()
✅ it requires an annotation to be present on the handler()
✅ it does not allow both annotations to be present()
✅ rejects access if the user does not have the required scope (multiple scopes)()

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.ratelimit.GlobalIpRateLimitFilterTest.xml

3 tests were completed in 12ms with 3 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.ratelimit.GlobalIpRateLimitFilterTest	3✅			12ms

✅ io.tolgee.security.ratelimit.GlobalIpRateLimitFilterTest

✅ it lets requests through()
✅ it does not let rate limited requests through()
✅ it does rate limit if request is OPTIONS()

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.ratelimit.GlobalUserRateLimitFilterTest.xml

3 tests were completed in 7ms with 3 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.ratelimit.GlobalUserRateLimitFilterTest	3✅			7ms

✅ io.tolgee.security.ratelimit.GlobalUserRateLimitFilterTest

✅ it lets requests through()
✅ it does not let rate limited requests through()
✅ it does rate limit if request is OPTIONS()

✅ backend/security/build/test-results/test/TEST-io.tolgee.security.ratelimit.RateLimitInterceptorTest.xml

8 tests were completed in 171ms with 8 passed, 0 failed and 0 skipped.

Test suite	Passed	Failed	Skipped	Time
io.tolgee.security.ratelimit.RateLimitInterceptorTest	8✅			171ms

✅ io.tolgee.security.ratelimit.RateLimitInterceptorTest

✅ it rate limits requests according to the specified policy()
✅ endpoint rate limit policy is correctly extracted from annotations()
✅ endpoint rate limit bucket correctly discriminates against major path variables()
✅ endpoint rate limit uses the correct user or ip discrimination method()
✅ it uses different buckets for different paths()
✅ it does not rate limit when limits are disabled()
✅ it does not rate limit when there are no annotations()
✅ it uses the same buckets for paths with a shared bucket()

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Current permissions -> PAK with no-auth mode #6074

Backend Tests