### Question:
QueryFilter extends AbstractAuthenticationProcessingFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { if (!request.getMethod().equals(httpMethod.name())) { throw new AuthMethodNotSupportedException(request.getMethod()); } if (protectedByCertificate && (SecurityContextHolder.getContext().getAuthentication() == null || !(SecurityContextHolder.getContext().getAuthentication().getCredentials() instanceof X509Certificate) || !SecurityContextHolder.getContext().getAuthentication().isAuthenticated())) { throw new InvalidCertificateException("Invalid certificate."); } String token = authenticationService.getJwtTokenFromRequest(request) .orElseThrow(() -> new TokenNotProvidedException("Authorization token not provided.")); Authentication result = this.getAuthenticationManager().authenticate(new TokenAuthentication(token)); if (result.isAuthenticated()) { return result; } else { throw new TokenNotValidException("JWT Token is not authenticated"); } } QueryFilter(
        String authEndpoint,
        AuthenticationSuccessHandler successHandler,
        AuthenticationFailureHandler failureHandler,
        AuthenticationService authenticationService,
        HttpMethod httpMethod,
        boolean protectedByCertificate,
        AuthenticationManager authenticationManager); @Override Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response);  }### Answer:
@Test void shouldCallAuthenticationManagerAuthenticate() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.GET.name()); httpServletResponse = new MockHttpServletResponse(); queryFilter.setAuthenticationManager(authenticationManager); when(authenticationService.getJwtTokenFromRequest(any())).thenReturn( Optional.of(VALID_TOKEN) ); TokenAuthentication valid = new TokenAuthentication(VALID_TOKEN); valid.setAuthenticated(true); when(authenticationManager.authenticate(new TokenAuthentication(VALID_TOKEN))).thenReturn(valid); queryFilter.attemptAuthentication(httpServletRequest, httpServletResponse); verify(authenticationManager).authenticate(any()); }
@Test void shouldRejectHttpMethods() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.POST.name()); httpServletResponse = new MockHttpServletResponse(); assertThrows(AuthMethodNotSupportedException.class, () -> queryFilter.attemptAuthentication(httpServletRequest, httpServletResponse), "Expected exception is not AuthMethodNotSupportedException"); }
@Test void shouldRejectIfTokenIsNotPresent() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.GET.name()); httpServletResponse = new MockHttpServletResponse(); assertThrows(TokenNotProvidedException.class, () -> queryFilter.attemptAuthentication(httpServletRequest, httpServletResponse), "Expected exception is not TokenNotProvidedException"); }
@Test void shouldRejectIfNotAuthenticatedByCertficate() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.GET.name()); httpServletResponse = new MockHttpServletResponse(); TokenAuthentication authentication = new TokenAuthentication("token"); authentication.setAuthenticated(true); SecurityContextHolder.setContext(new SecurityContextImpl(authentication)); QueryFilter protectedQueryFilter = new QueryFilter("TEST_ENDPOINT", authenticationSuccessHandler, authenticationFailureHandler, authenticationService, HttpMethod.GET, true, authenticationManager); assertThrows(InvalidCertificateException.class, () -> protectedQueryFilter.attemptAuthentication(httpServletRequest, httpServletResponse), "Expected exception is not InvalidCertificateException"); }
@Test void givenInvalidToken_whenQueryIsCalled_thenThrowTokenNotValidException() { httpServletRequest = new MockHttpServletRequest(); httpServletRequest.setMethod(HttpMethod.GET.name()); httpServletResponse = new MockHttpServletResponse(); queryFilter.setAuthenticationManager(authenticationManager); when(authenticationService.getJwtTokenFromRequest(any())).thenReturn( Optional.of(VALID_TOKEN) ); TokenAuthentication invalid = new TokenAuthentication(VALID_TOKEN); invalid.setAuthenticated(false); when(authenticationManager.authenticate(new TokenAuthentication(VALID_TOKEN))).thenReturn(invalid); assertThrows(TokenNotValidException.class, () -> { queryFilter.attemptAuthentication(httpServletRequest, httpServletResponse); }); }