Zimin A.N.
4747d85d15
JwtTestSupport: embedded HTTP server отдаёт JWK Set, генерирует RSA keypair,
подписывает test-JWT с произвольными realm-ролями. Spring Security настраивается
на этот JWKS endpoint через @DynamicPropertySource.
AuthE2ETest (6 тестов):
- anonymousRequest_returns401 — auth.required=true → anonymous = 401
- invalidJwt_returns401 — гарбидж в Authorization header → 401
- publicUser_canListDictionaries — JWT с ordinis:client:public → 200
- internalUser_canSeeInternalRecord — JWT с ordinis:client:internal видит INTERNAL запись
- unrecognizedRole_fallsBackToPublic — admin/viewer роли → PUBLIC scope (default)
❗ publicUser_cannotSeeInternalRecords — НАЙДЕН security gap:
Writer endpoint /api/v1/dictionaries/{name}/records/{key} НЕ фильтрует по
scope JWT юзера → public-юзер может прочитать INTERNAL запись.
Тест документирует текущее поведение (assertThat 200 OK + TODO comment).
Read-api (отдельный модуль) фильтрует корректно — issue только в writer.
Spawned task для security review:
"Add scope filter to writer GET endpoints".
pom.xml: + nimbus-jose-jwt 9.37.3 (test scope) для JWT signing.
Все 12 e2e тестов зелёные: smoke + 4 bitemporal + outbox-kafka + 6 auth.
Total ~18 sec со Spring boot.
138 lines
4.6 KiB
XML
138 lines
4.6 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<parent>
|
|
<groupId>cloud.nstart.terravault.ordinis</groupId>
|
|
<artifactId>ordinis-parent</artifactId>
|
|
<version>0.1.0-SNAPSHOT</version>
|
|
</parent>
|
|
|
|
<artifactId>ordinis-app</artifactId>
|
|
<name>Ordinis :: App (writer)</name>
|
|
<description>Spring Boot main для writer side: REST admin + outbox publisher + ЦУОД bundle.</description>
|
|
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>cloud.nstart.terravault.ordinis</groupId>
|
|
<artifactId>ordinis-rest-api</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>cloud.nstart.terravault.ordinis</groupId>
|
|
<artifactId>ordinis-cuod-bundle</artifactId>
|
|
</dependency>
|
|
|
|
<!-- Cross-cutting -->
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-actuator</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>io.micrometer</groupId>
|
|
<artifactId>micrometer-registry-prometheus</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>net.logstash.logback</groupId>
|
|
<artifactId>logstash-logback-encoder</artifactId>
|
|
</dependency>
|
|
|
|
<!-- Observability — OpenTelemetry -->
|
|
<dependency>
|
|
<groupId>io.opentelemetry.instrumentation</groupId>
|
|
<artifactId>opentelemetry-spring-boot-starter</artifactId>
|
|
</dependency>
|
|
|
|
<!-- Config + Vault -->
|
|
<dependency>
|
|
<groupId>org.springframework.cloud</groupId>
|
|
<artifactId>spring-cloud-starter-config</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.cloud</groupId>
|
|
<artifactId>spring-cloud-starter-vault-config</artifactId>
|
|
</dependency>
|
|
|
|
<!-- Migrations module — нужен на classpath для миграций при тесте,
|
|
в проде Liquibase запускается отдельным Job в k8s. -->
|
|
<dependency>
|
|
<groupId>cloud.nstart.terravault.ordinis</groupId>
|
|
<artifactId>ordinis-migrations</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<!-- Test -->
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-test</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.kafka</groupId>
|
|
<artifactId>spring-kafka-test</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>1.21.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>postgresql</artifactId>
|
|
<version>1.21.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>kafka</artifactId>
|
|
<version>1.21.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.awaitility</groupId>
|
|
<artifactId>awaitility</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.nimbusds</groupId>
|
|
<artifactId>nimbus-jose-jwt</artifactId>
|
|
<version>9.37.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.liquibase</groupId>
|
|
<artifactId>liquibase-core</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-maven-plugin</artifactId>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<configuration>
|
|
<!-- Testcontainers требует DOCKER_HOST. На macOS Docker Desktop
|
|
socket в ~/.docker/run, не /var/run. ENV не наследуется в
|
|
forked surefire процесс по умолчанию — пробрасываем явно. -->
|
|
<environmentVariables>
|
|
<DOCKER_HOST>${env.DOCKER_HOST}</DOCKER_HOST>
|
|
<DOCKER_API_VERSION>1.45</DOCKER_API_VERSION>
|
|
<TESTCONTAINERS_RYUK_DISABLED>true</TESTCONTAINERS_RYUK_DISABLED>
|
|
</environmentVariables>
|
|
<systemPropertyVariables>
|
|
<api.version>1.45</api.version>
|
|
</systemPropertyVariables>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</project>
|