Skip to content

fix(core): prevent endless authentication loops #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marceljk merged 4 commits into from
Dec 17, 2025
Merged

fix(core): prevent endless authentication loops #160

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4695d29
fix: prevent endless authentication loops
marceljk Dec 12, 2025
e12a0a7
bump VERSION file
marceljk Dec 12, 2025
f834336
add unit tests for authenticate
marceljk Dec 15, 2025
d793323
bump services
marceljk Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
add unit tests for authenticate
  • Loading branch information
@marceljk
marceljk committed Dec 17, 2025
commit f83433678fcf69fdad0537c7ac8c44936544a413
94 changes: 92 additions & 2 deletions core/src/test/java/cloud/stackit/sdk/core/KeyFlowAuthenticatorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,7 @@
import java.security.spec.InvalidKeySpecException;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import okhttp3.HttpUrl;
import okhttp3.OkHttpClient;
import okhttp3.*;
import okhttp3.mockwebserver.MockResponse;
import okhttp3.mockwebserver.MockWebServer;
import org.junit.jupiter.api.AfterEach;
Expand Down Expand Up @@ -62,6 +61,9 @@ class KeyFlowAuthenticatorTest {
+ "h/9afEtu5aUE/m+1vGBoH8z1\n"
+ "-----END PRIVATE KEY-----\n";

private static final Request mockRequest =
new Request.Builder().url("https://stackit.com").get().build();

private ServiceAccountKey createDummyServiceAccount() {
ServiceAccountCredentials credentials =
new ServiceAccountCredentials("aud", "iss", "kid", PRIVATE_KEY, "sub");
Expand Down Expand Up @@ -270,4 +272,92 @@ void createAccessTokenWithRefreshTokenResponse200WithEmptyBodyThrowsException()
assertThrows(
JsonSyntaxException.class, keyFlowAuthenticator::createAccessTokenWithRefreshToken);
}

@Test
@DisplayName("authenticator sets Authorization header")
void authenticatorSetsAuthorizationHeaderIfNotAuthenticated()
throws NoSuchAlgorithmException, InvalidKeySpecException, IOException {
// Setup mockServer
final String authorizationHeader = "Authorization";
KeyFlowAuthenticator.KeyFlowTokenResponse mockResponse = mockResponseBody(false);
// mock response for KeyFlow authentication with mocked access token
MockResponse mockedResponse =
new MockResponse()
.setResponseCode(200)
.setBody(new Gson().toJson(mockResponse))
.addHeader("Content-type", "application/json");
mockWebServer.enqueue(mockedResponse);
HttpUrl url = mockWebServer.url(MOCK_WEBSERVER_PATH);

// Set unauthorized request
Response unauthorizedRequest =
new Response.Builder()
.request(mockRequest)
.code(401)
.message("Unauthorized")
.protocol(Protocol.HTTP_2)
.build();

// Config
CoreConfiguration cfg =
new CoreConfiguration().tokenCustomUrl(url.toString()); // Use mockWebServer

// Check if "Authorization" header is unset
assertNull(unauthorizedRequest.request().header(authorizationHeader));

// Prepare keyFlowAuthenticator
KeyFlowAuthenticator keyFlowAuthenticator =
new KeyFlowAuthenticator(httpClient, cfg, createDummyServiceAccount());
// authenticator creates new access token and sets it the Authorization header
Request newRequest = keyFlowAuthenticator.authenticate(null, unauthorizedRequest);

// Check if new request is not null
assertNotNull(newRequest);
// Check if the "Authorization" Header is set
assertNotNull(newRequest.header(authorizationHeader));
}

@Test
@DisplayName("Authenticator returns null when already authenticated")
void authenticatorReturnsNullWhenAlreadyAuthenticated()
throws NoSuchAlgorithmException, InvalidKeySpecException, IOException {
// Setup mockServer
final String authorizationHeader = "Authorization";
KeyFlowAuthenticator.KeyFlowTokenResponse mockResponse = mockResponseBody(false);
// mock response for KeyFlow authentication with mocked access token
MockResponse mockedResponse =
new MockResponse()
.setResponseCode(200)
.setBody(new Gson().toJson(mockResponse))
.addHeader("Content-type", "application/json");
mockWebServer.enqueue(mockedResponse);
HttpUrl url = mockWebServer.url(MOCK_WEBSERVER_PATH);

// Set unauthorized request
Response unauthorizedRequest =
new Response.Builder()
.request(
mockRequest
.newBuilder()
.addHeader(authorizationHeader, "<my-access-token>")
.build())
.code(401)
.message("Unauthorized")
.protocol(Protocol.HTTP_2)
.build(); // Unauthorized request

// Config
CoreConfiguration cfg =
new CoreConfiguration().tokenCustomUrl(url.toString()); // Use mockWebServer

// Check if "Authorization" header is set
assertNotNull(unauthorizedRequest.request().header(authorizationHeader));

// Prepare keyFlowAuthenticator
KeyFlowAuthenticator keyFlowAuthenticator =
new KeyFlowAuthenticator(httpClient, cfg, createDummyServiceAccount());

// Authenticator returns no new request, because "Authorization" header was already set
assertNull(keyFlowAuthenticator.authenticate(null, unauthorizedRequest));
}
}