yakworks · basejump · Apr 29, 2025 · Mar 3, 2025 · Mar 4, 2025 · Mar 4, 2025
diff --git a/examples/rally-api/grails-app/init/yakworks/rally/api/BootStrap.groovy b/examples/rally-api/grails-app/init/yakworks/rally/api/BootStrap.groovy
@@ -20,7 +20,7 @@ class BootStrap {
         AppUser.withTransaction {
             AppUser.repo.flush()
             AppUser admin = new AppUser([
-                id: (Long)6, username: "[email protected]", email: "[email protected]", orgId: 2
+                id: 6L, username: "[email protected]", email: "[email protected]", orgId: 2
             ]).persist()
             admin.addRole('ADMIN', true)
             admin.addRole('MANAGER', true)

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/SmokeRestApiSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/SmokeRestApiSpec.groovy
@@ -14,9 +14,9 @@ class SmokeRestApiSpec extends Specification implements OkHttpRestTrait {
 
     String path = "/api/rally"
 
-    // def setup(){
-    //     login()
-    // }
+     void setup(){
+         login()
+     }
 
     // @Value('${local.server.port}')
     // protected Integer serverPort;

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/BulkControllerSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/BulkControllerSpec.groovy
@@ -4,6 +4,7 @@ package yakworks.rest
 import yakworks.rest.gorm.controller.CrudApiController
 import grails.testing.mixin.integration.Integration
 import org.apache.commons.lang3.StringUtils
+import yakworks.testing.gorm.integration.SecuritySpecHelper
 import yakworks.testing.rest.RestIntTest
 import yakworks.rally.job.SyncJob
 import yakworks.rally.orgs.model.Org
@@ -12,7 +13,7 @@ import static org.springframework.http.HttpStatus.MULTI_STATUS
 
 // @Rollback
 @Integration
-class BulkControllerSpec extends RestIntTest {
+class BulkControllerSpec extends RestIntTest implements SecuritySpecHelper {
 
     CrudApiController<Org> controller
 

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/BulkCsvSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/BulkCsvSpec.groovy
@@ -1,5 +1,6 @@
 package yakworks.rest
 
+import yakworks.testing.gorm.integration.SecuritySpecHelper
 
 import java.nio.file.Path
 
@@ -18,7 +19,7 @@ import yakworks.testing.rest.RestIntTest
 
 @Rollback
 @Integration
-class BulkCsvSpec  extends RestIntTest {
+class BulkCsvSpec  extends RestIntTest implements SecuritySpecHelper {
 
     CrudApiController<Contact> controller
     AttachmentRepo attachmentRepo

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/CacheListApiSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/CacheListApiSpec.groovy
@@ -35,9 +35,9 @@ class CacheListApiSpec extends Specification implements OkHttpRestTrait, WithTrx
         Map body = bodyToMap(resp)
 
         then:
+        body
         body.status == 429
         resp.code() == HttpStatus.TOO_MANY_REQUESTS.value()
-
     }
 
 }
diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/ContactControllerTests.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/ContactControllerTests.groovy
@@ -5,12 +5,13 @@ import yakworks.rest.gorm.controller.CrudApiController
 import grails.gorm.transactions.Rollback
 import grails.testing.mixin.integration.Integration
 import yakworks.commons.map.Maps
+import yakworks.testing.gorm.integration.SecuritySpecHelper
 import yakworks.testing.rest.RestIntTest
 import yakworks.rally.orgs.model.Contact
 
 @Rollback
 @Integration
-class ContactControllerTests extends RestIntTest {
+class ContactControllerTests extends RestIntTest implements SecuritySpecHelper {
 
     CrudApiController<Contact> controller
     // String controllerName = 'ContactController'

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/OrgControllerTests.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/OrgControllerTests.groovy
@@ -1,21 +1,19 @@
 package yakworks.rest
 
 import org.springframework.http.HttpStatus
-
-
 import yakworks.rally.orgs.model.ContactFlex
-import yakworks.rally.orgs.model.OrgFlex
 import yakworks.rest.gorm.controller.CrudApiController
 import grails.gorm.transactions.Rollback
 import grails.testing.mixin.integration.Integration
 import yakworks.commons.map.Maps
+import yakworks.testing.gorm.integration.SecuritySpecHelper
 import yakworks.testing.rest.RestIntTest
 import yakworks.rally.orgs.model.Org
 import yakworks.rally.tag.model.Tag
 
 @Rollback
 @Integration
-class OrgControllerTests extends RestIntTest {
+class OrgControllerTests extends RestIntTest implements SecuritySpecHelper {
 
     CrudApiController<Org> controller
 

diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/OrgRestApiSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/OrgRestApiSpec.groovy
@@ -7,6 +7,7 @@ import okhttp3.RequestBody
 import org.apache.poi.xssf.usermodel.XSSFWorkbook
 import org.springframework.http.HttpStatus
 import spock.lang.IgnoreRest
+import yakworks.rest.client.OkAuth
 import yakworks.rest.client.OkHttpRestTrait
 import grails.testing.mixin.integration.Integration
 import okhttp3.HttpUrl
@@ -415,4 +416,25 @@ class OrgRestApiSpec extends Specification implements OkHttpRestTrait, WithTrx {
         body.detail.contains "expecting '}'"
     }
 
+    void "test readonly operation"() {
+        setup:
+        OkAuth.TOKEN = null
+        login("readonly", "123")
+
+        when:
+        String q = '{name: "Org20"}'
+        def resp = post(path,  [num:"C1", name:"C1", type: 'Customer'])
+        Map body = bodyToMap(resp)
+
+        then:
+        resp.code() == HttpStatus.UNAUTHORIZED.value()
+        body
+        !body.ok
+        body.code == "error.unauthorized"
+        body.title == 'Unauthorized'
+        body.detail == 'Access Denied'
+
+        cleanup:
+        OkAuth.TOKEN = null
+    }
 }
diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/rest/ReadonlyRestApiSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/rest/ReadonlyRestApiSpec.groovy
@@ -0,0 +1,84 @@
+package yakworks.rest
+
+import grails.testing.mixin.integration.Integration
+import okhttp3.Response
+import org.springframework.http.HttpStatus
+import spock.lang.Specification
+import yakworks.rest.client.OkAuth
+import yakworks.rest.client.OkHttpRestTrait
+
+@Integration
+class ReadonlyRestApiSpec extends Specification implements OkHttpRestTrait {
+
+    String path = "/api/rally/contact"
+
+    void setupSpec() {
+        OkAuth.TOKEN = null
+    }
+
+    void cleanupSpec() {
+        OkAuth.TOKEN = null
+    }
+
+    def setup(){
+        login("readonly", "123")
+    }
+
+    void "create"() {
+        when:
+        def resp = post(path,  data)
+
+        then:
+        assertAccessDenied(resp)
+    }
+
+    void "update"() {
+        when:
+        def resp = put(path+"/1",  data)
+
+        then:
+        assertAccessDenied(resp)
+    }
+
+    void "upsert"() {
+        when:
+        def resp = post(path+"/upsert",  data)
+
+        then:
+        assertAccessDenied(resp)
+    }
+
+    void "remove"() {
+        when:
+        def resp = delete(path+"/1")
+
+        then:
+        assertAccessDenied(resp)
+    }
+
+    void "bulk"() {
+        when:
+        def resp = post(path+"/bulk?jobSource=Oracle&savePayload=false",  [data])
+
+        then:
+        assertAccessDenied(resp)
+    }
+
+    void assertAccessDenied(Response resp) {
+        assert resp
+        assert resp.code() == HttpStatus.UNAUTHORIZED.value()
+
+        Map body = bodyToMap(resp)
+
+        assert body
+        assert !body.ok
+        assert body.code == "error.unauthorized"
+        assert body.title == 'Unauthorized'
+        assert body.detail == 'Access Denied'
+    }
+
+    Map getData() {
+        return [name: "C1", firstName: "C1", orgId: 2,]
+        //return [num:"T1", name:"T1", type: OrgType.Customer.name()]
+    }
+}
diff --git a/examples/rally-api/src/integration-test/groovy/yakworks/security/OpaqueRestApiSpec.groovy b/examples/rally-api/src/integration-test/groovy/yakworks/security/OpaqueRestApiSpec.groovy
@@ -1,23 +1,21 @@
 package yakworks.security
 
 import java.time.Instant
-import java.time.LocalDate
 import java.time.LocalDateTime
 
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.http.HttpStatus
 import org.springframework.security.oauth2.core.OAuth2AccessToken
 
 import grails.testing.mixin.integration.Integration
-import spock.lang.Ignore
 import spock.lang.Specification
 
 import yakworks.rest.client.OkAuth
 import yakworks.rest.client.OkHttpRestTrait
-import yakworks.security.gorm.model.AppUserToken
 import yakworks.security.spring.token.store.TokenStore
 
-// @Ignore
+import java.time.ZoneId
+
 @Integration
 class OpaqueRestApiSpec extends Specification implements OkHttpRestTrait {
 
@@ -27,7 +25,10 @@ class OpaqueRestApiSpec extends Specification implements OkHttpRestTrait {
 
     def setup(){
         OkAuth.TOKEN = "opq_123"
-        //OkAuth.BEARER_TOKEN = "Bearer opq_123"
+    }
+
+    void cleanupSpec() {
+        OkAuth.TOKEN = null
     }
 
     OAuth2AccessToken createOAuthToken(String tokenValue, Instant nowTime, Instant expireAt){
@@ -42,13 +43,15 @@ class OpaqueRestApiSpec extends Specification implements OkHttpRestTrait {
 
     void "test get to make sure display false dont get returned"() {
         setup:
-        // AppUserToken.create([username: 'admin', tokenValue: 'opq_123', expiresAt: LocalDateTime.now().plusDays(2)], flush: true)
         //add token to the store.
-        def oat = createOAuthToken("opq_123", Instant.now(), Instant.now().plusSeconds(30))
+        LocalDateTime now = LocalDateTime.now()
+        Instant nowInstant = now.atZone(ZoneId.of("UTC")).toInstant()
+        def oat = createOAuthToken("opq_123", nowInstant, nowInstant.plusSeconds(20))
         tokenStore.storeToken('admin', oat)
 
         when:
         def resp = get("$endpoint/1")
+        assert resp.code() == 200
         Map body = bodyToMap(resp)
 
         then:
@@ -57,6 +60,9 @@ class OpaqueRestApiSpec extends Specification implements OkHttpRestTrait {
         //shoudl not have the display:false fields
         !body.containsKey('passwordHash')
         !body.containsKey('resetPasswordToken')
+
+        cleanup:
+        tokenStore.removeToken('opq_123')
     }
 
 }