Skip to content

Commit 2e44a57

Browse files
ruromeroruromero
authored
Merge pull request #220 from ruromero/empty-provider
feat: add unauthenticated response for oss-index
2 parents fa9afd7 + c17db36 commit 2e44a57

23 files changed

+791
-752
lines changed

‎src/main/java/com/redhat/exhort/integration/VulnerabilityProvider.java‎

Lines changed: 0 additions & 141 deletions
This file was deleted.

‎src/main/java/com/redhat/exhort/integration/backend/ExhortIntegration.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@
3535
import com.fasterxml.jackson.databind.ObjectMapper;
3636
import com.redhat.exhort.analytics.AnalyticsService;
3737
import com.redhat.exhort.integration.Constants;
38-
import com.redhat.exhort.integration.VulnerabilityProvider;
3938
import com.redhat.exhort.integration.backend.sbom.SbomParserFactory;
4039
import com.redhat.exhort.integration.providers.ProviderAggregationStrategy;
40+
import com.redhat.exhort.integration.providers.VulnerabilityProvider;
4141
import com.redhat.exhort.monitoring.MonitoringProcessor;
4242

4343
import io.micrometer.core.instrument.MeterRegistry;

‎src/main/java/com/redhat/exhort/integration/providers/ProviderResponseHandler.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,16 @@ protected DependencyReport toDependencyReport(PackageRef ref, List<Issue> issues
8787
.collect(Collectors.toList()));
8888
}
8989

90+
public ProviderReport unauthenticatedResponse(Exchange exchange) {
91+
return new ProviderReport()
92+
.status(
93+
new ProviderStatus()
94+
.name(getProviderName())
95+
.ok(Boolean.FALSE)
96+
.message("Missing mandatory credentials")
97+
.code(Response.Status.UNAUTHORIZED.getStatusCode()));
98+
}
99+
90100
public void processResponseError(Exchange exchange) {
91101
ProviderStatus status = new ProviderStatus().ok(false).name(getProviderName());
92102
Exception exception = (Exception) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);

‎src/main/java/com/redhat/exhort/integration/providers/VulnerabilityProvider.java‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ public List<String> getProvidersFromQueryParam(@Headers Map<String, String> head
8989
var props = URISupport.parseQuery(query);
9090
var providers = getProviders(props);
9191
if (providers == null || providers.isEmpty()) {
92-
return getEnabled().stream().filter(p -> filterByAuthHeaders(p, headers)).toList();
92+
return getEnabled();
9393
}
9494
var missing =
9595
providers.stream()
@@ -128,15 +128,4 @@ public void addProviderPrivateData(Exchange exchange, String provider) {
128128
exchange.setProperty(
129129
Constants.PROVIDER_PRIVATE_DATA_PROPERTY, Collections.unmodifiableList(current));
130130
}
131-
132-
private boolean filterByAuthHeaders(String provider, Map<String, String> headers) {
133-
if (headers == null || headers.isEmpty()) {
134-
return true;
135-
}
136-
return switch (provider) {
137-
case Constants.OSS_INDEX_PROVIDER -> headers.containsKey(Constants.OSS_INDEX_USER_HEADER)
138-
&& headers.containsKey(Constants.OSS_INDEX_TOKEN_HEADER);
139-
default -> true;
140-
};
141-
}
142131
}

‎src/main/java/com/redhat/exhort/integration/providers/ossindex/OssIndexIntegration.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
import org.eclipse.microprofile.config.inject.ConfigProperty;
2929

3030
import com.redhat.exhort.integration.Constants;
31-
import com.redhat.exhort.integration.VulnerabilityProvider;
31+
import com.redhat.exhort.integration.providers.VulnerabilityProvider;
3232
import com.redhat.exhort.model.DependencyTree;
3333
import com.redhat.exhort.monitoring.MonitoringProcessor;
3434

@@ -58,6 +58,8 @@ public void configure() {
5858
.routeId("ossIndexScan")
5959
.transform(method(OssIndexRequestBuilder.class, "split"))
6060
.choice()
61+
.when(method(OssIndexRequestBuilder.class, "missingAuthHeaders"))
62+
.setBody(method(OssIndexResponseHandler.class, "unauthenticatedResponse"))
6163
.when(method(OssIndexRequestBuilder.class, "isEmpty"))
6264
.setBody(method(OssIndexResponseHandler.class, "emptyResponse"))
6365
.transform().method(OssIndexResponseHandler.class, "buildReport")

‎src/main/java/com/redhat/exhort/integration/providers/ossindex/OssIndexRequestBuilder.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@
2323
import java.util.Objects;
2424

2525
import org.apache.camel.Body;
26+
import org.apache.camel.Header;
2627

2728
import com.fasterxml.jackson.core.JsonProcessingException;
2829
import com.fasterxml.jackson.databind.ObjectMapper;
2930
import com.redhat.exhort.api.PackageRef;
3031
import com.redhat.exhort.config.ObjectMapperProducer;
32+
import com.redhat.exhort.integration.Constants;
3133
import com.redhat.exhort.model.DependencyTree;
3234

3335
import io.quarkus.runtime.annotations.RegisterForReflection;
@@ -61,6 +63,12 @@ public boolean isEmpty(@Body List<List<PackageRef>> body) {
6163
return body == null || body.isEmpty();
6264
}
6365

66+
public boolean missingAuthHeaders(
67+
@Header(Constants.OSS_INDEX_USER_HEADER) String user,
68+
@Header(Constants.OSS_INDEX_TOKEN_HEADER) String token) {
69+
return user == null || token == null;
70+
}
71+
6472
public String buildRequest(List<PackageRef> packages) throws JsonProcessingException {
6573
var coordinates = mapper.createArrayNode();
6674
packages.stream()

‎src/main/resources/freemarker/templates/generated/main.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/main/resources/freemarker/templates/generated/vendor.css‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/main/resources/freemarker/templates/generated/vendor.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/test/java/com/redhat/exhort/integration/AnalysisTest.java‎

Lines changed: 36 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,9 @@ public void testWithInvalidPkgManagers(String sbom) {
9999
.body()
100100
.as(AnalysisReport.class);
101101

102-
assertEquals(1, report.getProviders().size());
102+
assertEquals(2, report.getProviders().size());
103+
assertEquals(
104+
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
103105
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
104106
assertEquals(422, status.getCode());
105107
assertEquals("Unsupported package types received: [foo]", status.getMessage());
@@ -125,7 +127,9 @@ public void testWithMixedPkgManagers(String sbom) {
125127
.body()
126128
.as(AnalysisReport.class);
127129

128-
assertEquals(1, report.getProviders().size());
130+
assertEquals(2, report.getProviders().size());
131+
assertEquals(
132+
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
129133
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
130134
assertEquals(422, status.getCode());
131135
assertEquals(
@@ -139,14 +143,14 @@ public void testWithMixedPkgManagers(String sbom) {
139143

140144
@ParameterizedTest
141145
@MethodSource("emptySbomArguments")
142-
public void testEmptySbom(List<String> providers, Map<String, String> authHeaders) {
146+
public void testEmptySbom(Map<String, Integer> providers, Map<String, String> authHeaders) {
143147
stubAllProviders();
144148

145149
var report =
146150
given()
147151
.header(CONTENT_TYPE, CycloneDxMediaType.APPLICATION_CYCLONEDX_JSON)
148152
.headers(authHeaders)
149-
.queryParam(Constants.PROVIDERS_PARAM, providers)
153+
.queryParam(Constants.PROVIDERS_PARAM, providers.keySet())
150154
.body(loadFileAsString(String.format("%s/empty-sbom.json", CYCLONEDX)))
151155
.when()
152156
.post("/api/v4/analysis")
@@ -157,55 +161,48 @@ public void testEmptySbom(List<String> providers, Map<String, String> authHeader
157161
.body()
158162
.as(AnalysisReport.class);
159163

160-
providers.forEach(
161-
p -> {
162-
var provider =
163-
report.getProviders().values().stream()
164-
.filter(s -> s.getStatus().getName().equals(p))
165-
.findFirst();
166-
assertEquals(Response.Status.OK.getStatusCode(), provider.get().getStatus().getCode());
167-
assertTrue(provider.get().getStatus().getOk());
168-
assertEquals(
169-
Response.Status.OK.getReasonPhrase(), provider.get().getStatus().getMessage());
170-
assertTrue(provider.get().getSources().isEmpty());
171-
});
172-
173-
verifyProviders(providers, authHeaders, true);
164+
providers
165+
.entrySet()
166+
.forEach(
167+
p -> {
168+
var provider =
169+
report.getProviders().values().stream()
170+
.filter(s -> s.getStatus().getName().equals(p.getKey()))
171+
.findFirst();
172+
assertEquals(p.getValue(), provider.get().getStatus().getCode());
173+
assertEquals(p.getValue().equals(200), provider.get().getStatus().getOk());
174+
assertTrue(provider.get().getSources().isEmpty());
175+
});
176+
177+
verifyProviders(providers.keySet(), authHeaders, true);
174178
}
175179

176180
private static Stream<Arguments> emptySbomArguments() {
177181
return Stream.of(
182+
Arguments.of(Map.of(Constants.SNYK_PROVIDER, 200), Collections.emptyMap()),
183+
Arguments.of(Map.of(Constants.OSS_INDEX_PROVIDER, 401), Collections.emptyMap()),
178184
Arguments.of(
179-
List.of(Constants.SNYK_PROVIDER), Collections.emptyMap(), Constants.MAVEN_PKG_MANAGER),
180-
Arguments.of(List.of(Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
185+
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 401),
186+
Collections.emptyMap()),
181187
Arguments.of(
182-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
188+
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 401),
183189
Map.of(Constants.SNYK_TOKEN_HEADER, OK_TOKEN)),
184190
Arguments.of(
185-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
191+
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 200),
186192
Map.of(
187193
Constants.OSS_INDEX_USER_HEADER,
188194
OK_USER,
189195
Constants.OSS_INDEX_TOKEN_HEADER,
190196
OK_TOKEN)),
191197
Arguments.of(
192-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
198+
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 200),
193199
Map.of(
194200
Constants.SNYK_TOKEN_HEADER,
195201
OK_TOKEN,
196202
Constants.OSS_INDEX_USER_HEADER,
197203
OK_USER,
198204
Constants.OSS_INDEX_TOKEN_HEADER,
199-
OK_TOKEN)),
200-
Arguments.of(
201-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
202-
Arguments.of(
203-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
204-
Arguments.of(
205-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
206-
Arguments.of(
207-
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
208-
Collections.emptyMap()));
205+
OK_TOKEN)));
209206
}
210207

211208
@Test
@@ -279,7 +276,9 @@ public void testUnauthorizedRequest() {
279276
.body()
280277
.as(AnalysisReport.class);
281278

282-
assertEquals(1, report.getProviders().size());
279+
assertEquals(2, report.getProviders().size());
280+
assertEquals(
281+
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
283282
assertTrue(report.getProviders().get(Constants.SNYK_PROVIDER).getSources().isEmpty());
284283
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
285284
assertFalse(status.getOk());
@@ -309,7 +308,9 @@ public void testForbiddenRequest() {
309308
.body()
310309
.as(AnalysisReport.class);
311310

312-
assertEquals(1, report.getProviders().size());
311+
assertEquals(2, report.getProviders().size());
312+
assertEquals(
313+
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
313314
assertTrue(report.getProviders().get(Constants.SNYK_PROVIDER).getSources().isEmpty());
314315
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
315316
assertFalse(status.getOk());

0 commit comments

Comments
 (0)