Skip to content

Commit 3a45fe7

Browse files
Brutus5000Brutus5000
committed
Restrict /data API to logged-in users
Ongoing DDoS attacks can't be repelled completely and there are very expensive endpoints to call.
1 parent fbb8a15 commit 3a45fe7

14 files changed

Lines changed: 38 additions & 7 deletions

‎src/inttest/java/com/faforever/api/data/AvatarAssignmentElideTest.java‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ public class AvatarAssignmentElideTest extends AbstractIntegrationTest {
3030

3131
@Test
3232
public void getUnusedAvatar() throws Exception {
33-
mockMvc.perform(get("/data/avatar/3"))
33+
mockMvc.perform(get("/data/avatar/3")
34+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
3435
.andExpect(status().isOk())
3536
.andExpect(jsonPath("$.data.id", is("3")))
3637
.andExpect(jsonPath("$.data.type", is("avatar")))
@@ -41,7 +42,8 @@ public void getUnusedAvatar() throws Exception {
4142

4243
@Test
4344
public void getAvatarWithPlayer() throws Exception {
44-
mockMvc.perform(get("/data/avatar/2"))
45+
mockMvc.perform(get("/data/avatar/2")
46+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
4547
.andExpect(status().isOk())
4648
.andExpect(jsonPath("$.data.id", is("2")))
4749
.andExpect(jsonPath("$.data.type", is("avatar")))
@@ -52,7 +54,8 @@ public void getAvatarWithPlayer() throws Exception {
5254

5355
@Test
5456
public void getAvatarURLEncoded() throws Exception {
55-
mockMvc.perform(get("/data/avatar/4"))
57+
mockMvc.perform(get("/data/avatar/4")
58+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
5659
.andExpect(status().isOk())
5760
.andExpect(jsonPath("$.data.id", is("4")))
5861
.andExpect(jsonPath("$.data.type", is("avatar")))
@@ -148,7 +151,8 @@ public void canUpdateAvatarAssignmentExpirationWithScopeAndRole() throws Excepti
148151
.content(createJsonApiContent(avatarAssignment)))
149152
.andExpect(status().isNoContent());
150153
mockMvc.perform(
151-
get("/data/avatarAssignment/{assignmentId}", 1))
154+
get("/data/avatarAssignment/{assignmentId}", 1)
155+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
152156
.andExpect(status().isOk())
153157
.andExpect(jsonPath("$.data.attributes.expiresAt", is(OFFSET_DATE_TIME_FORMATTER.format(now))));
154158
}

‎src/inttest/java/com/faforever/api/data/ClanElideTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,8 @@ public void cannotDeleteAsMember() throws Exception {
9898

9999
@Test
100100
public void getFilteredPlayerForClanInvite() throws Exception {
101-
mockMvc.perform(get("/data/player?filter=login==*MEMBER*&sort=login"))
101+
mockMvc.perform(get("/data/player?filter=login==*MEMBER*&sort=login")
102+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
102103
.andExpect(status().isOk())
103104
.andExpect(jsonPath("$.data", hasSize(2)))
104105
.andExpect(jsonPath("$.data[0].attributes.login", is("CLAN_MEMBER")))

‎src/inttest/java/com/faforever/api/data/GameElideTest.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ public void filterExistingGameByVictoryCondition() throws Exception {
2424
mockMvc.perform(
2525
get("/data/game")
2626
.queryParam("filter", "victoryCondition==DEMORALIZATION")
27+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2728
)
2829
.andExpect(status().isOk())
2930
.andExpect(jsonPath("$.data[*]", hasSize(1)))
@@ -37,6 +38,7 @@ public void filterNonExistingGameByVictoryCondition() throws Exception {
3738
mockMvc.perform(
3839
get("/data/game")
3940
.queryParam("filter", "victoryCondition==SANDBOX")
41+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
4042
)
4143
.andExpect(status().isOk())
4244
.andExpect(jsonPath("$.data[*]", hasSize(0)));
@@ -48,6 +50,7 @@ public void filterExistingGameReviewsSummaryAverageScore() throws Exception {
4850
mockMvc.perform(
4951
get("/data/game")
5052
.queryParam("filter", "reviewsSummary.averageScore=gt=3.333")
53+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
5154
)
5255
.andExpect(status().isOk())
5356
.andExpect(jsonPath("$.data[*]", hasSize(1)));
@@ -59,6 +62,7 @@ public void filterNonExistingGameReviewsSummaryAverageScore() throws Exception {
5962
mockMvc.perform(
6063
get("/data/game")
6164
.queryParam("filter", "reviewsSummary.averageScore=gt=3.334")
65+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
6266
)
6367
.andExpect(status().isOk())
6468
.andExpect(jsonPath("$.data[*]", hasSize(0)));

‎src/inttest/java/com/faforever/api/data/MapPoolElideTest.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ public class MapPoolElideTest extends AbstractIntegrationTest {
4848

4949
@Test
5050
public void getMapPoolAssignmentWithMapVersion() throws Exception {
51-
mockMvc.perform(get("/data/mapPoolAssignment/1"))
51+
mockMvc.perform(get("/data/mapPoolAssignment/1")
52+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
5253
.andExpect(status().isOk())
5354
.andExpect(jsonPath("$.data.id", is("1")))
5455
.andExpect(jsonPath("$.data.type", is("mapPoolAssignment")))
@@ -60,7 +61,8 @@ public void getMapPoolAssignmentWithMapVersion() throws Exception {
6061

6162
@Test
6263
public void getMapPoolAssignmentWithMapParams() throws Exception {
63-
mockMvc.perform(get("/data/mapPoolAssignment/2"))
64+
mockMvc.perform(get("/data/mapPoolAssignment/2")
65+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
6466
.andExpect(status().isOk())
6567
.andExpect(jsonPath("$.data.id", is("2")))
6668
.andExpect(jsonPath("$.data.type", is("mapPoolAssignment")))

‎src/inttest/java/com/faforever/api/league/LeaderboardElideTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ class LeaderboardElideTest extends AbstractIntegrationTest {
2626
void anyOneCanReadAllLeaderboard() throws Exception {
2727
mockMvc.perform(
2828
get("/data/leagueLeaderboard")
29+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2930
)
3031
.andExpect(status().isOk())
3132
.andExpect(jsonPath("$.data[*]", hasSize(5)));
@@ -35,6 +36,7 @@ void anyOneCanReadAllLeaderboard() throws Exception {
3536
void anyOneCanReadSpecificLeaderboard() throws Exception {
3637
mockMvc.perform(
3738
get("/data/leagueLeaderboard/1")
39+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
3840
)
3941
.andExpect(status().isOk())
4042
.andExpect(jsonPath("$.data.attributes.technicalName", is("global")));

‎src/inttest/java/com/faforever/api/league/LeagueElideTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ class LeagueElideTest extends AbstractIntegrationTest {
2626
void anyOneCanReadAllLeague() throws Exception {
2727
mockMvc.perform(
2828
get("/data/league")
29+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2930
)
3031
.andExpect(status().isOk())
3132
.andExpect(jsonPath("$.data[*]", hasSize(2)));
@@ -35,6 +36,7 @@ void anyOneCanReadAllLeague() throws Exception {
3536
void anyOneCanReadSpecificLeague() throws Exception {
3637
mockMvc.perform(
3738
get("/data/league/1")
39+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
3840
)
3941
.andExpect(status().isOk())
4042
.andExpect(jsonPath("$.data.attributes.technicalName", is("league1")))

‎src/inttest/java/com/faforever/api/league/LeagueScoreJournalElideTest.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ public class LeagueScoreJournalElideTest extends AbstractIntegrationTest {
2424
void anyOneCanReadAllLeagueScoreJournal() throws Exception {
2525
mockMvc.perform(
2626
get("/data/leagueScoreJournal")
27+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2728
)
2829
.andExpect(status().isOk())
2930
.andExpect(jsonPath("$.data[*]", hasSize(4)));
@@ -33,6 +34,7 @@ void anyOneCanReadAllLeagueScoreJournal() throws Exception {
3334
void anyOneCanReadPlayerAndSeasonLeagueScoreJournal() throws Exception {
3435
mockMvc.perform(
3536
get("/data/leagueScoreJournal?filter=loginId==1;leagueSeason.id==1")
37+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
3638
)
3739
.andExpect(status().isOk())
3840
.andExpect(jsonPath("$.data[*]", hasSize(2)));
@@ -42,6 +44,7 @@ void anyOneCanReadPlayerAndSeasonLeagueScoreJournal() throws Exception {
4244
void anyOneCanReadSpecificLeagueScoreJournal() throws Exception {
4345
mockMvc.perform(
4446
get("/data/leagueScoreJournal/1")
47+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
4548
)
4649
.andExpect(status().isOk());
4750
}

‎src/inttest/java/com/faforever/api/league/LeagueSeasonDivisionElideTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ class LeagueSeasonDivisionElideTest extends AbstractIntegrationTest {
2525
void anyOneCanReadAllLeagueSeasonDivision() throws Exception {
2626
mockMvc.perform(
2727
get("/data/leagueSeasonDivision")
28+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2829
)
2930
.andExpect(status().isOk())
3031
.andExpect(jsonPath("$.data[*]", hasSize(4)));
@@ -34,6 +35,7 @@ void anyOneCanReadAllLeagueSeasonDivision() throws Exception {
3435
void anyOneCanReadSpecificLeagueSeasonDivision() throws Exception {
3536
mockMvc.perform(
3637
get("/data/leagueSeasonDivision/1")
38+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
3739
)
3840
.andExpect(status().isOk());
3941
}

‎src/inttest/java/com/faforever/api/league/LeagueSeasonElideTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ class LeagueSeasonElideTest extends AbstractIntegrationTest {
2626
void anyOneCanReadAllLeagueSeason() throws Exception {
2727
mockMvc.perform(
2828
get("/data/leagueSeason")
29+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2930
)
3031
.andExpect(status().isOk())
3132
.andExpect(jsonPath("$.data[*]", hasSize(2)));
@@ -35,6 +36,7 @@ void anyOneCanReadAllLeagueSeason() throws Exception {
3536
void anyOneCanReadSpecificLeagueSeason() throws Exception {
3637
mockMvc.perform(
3738
get("/data/leagueSeason/1")
39+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
3840
)
3941
.andExpect(status().isOk())
4042
.andExpect(jsonPath("$.data.attributes.placementGames", is(10)))

‎src/inttest/java/com/faforever/api/league/LeagueSeasonScoreElideTest.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ class LeagueSeasonScoreElideTest extends AbstractIntegrationTest {
2626
void anyOneCanReadAllLeagueSeasonScore() throws Exception {
2727
mockMvc.perform(
2828
get("/data/leagueSeasonScore")
29+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
2930
)
3031
.andExpect(status().isOk())
3132
.andExpect(jsonPath("$.data[*]", hasSize(8)));
@@ -35,6 +36,7 @@ void anyOneCanReadAllLeagueSeasonScore() throws Exception {
3536
void anyOneCanReadPlayerAndSeasonLeagueSeasonScore() throws Exception {
3637
mockMvc.perform(
3738
get("/data/leagueSeasonScore?filter=loginId==1;leagueSeason.id==1")
39+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
3840
)
3941
.andExpect(status().isOk())
4042
.andExpect(jsonPath("$.data[*]", hasSize(1)));
@@ -44,6 +46,7 @@ void anyOneCanReadPlayerAndSeasonLeagueSeasonScore() throws Exception {
4446
void anyOneCanReadSpecificLeagueSeasonScore() throws Exception {
4547
mockMvc.perform(
4648
get("/data/leagueSeasonScore/1")
49+
.with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES))
4750
)
4851
.andExpect(status().isOk())
4952
.andExpect(jsonPath("$.data.attributes.loginId", is(1)))

0 commit comments

Comments
 (0)