### Question:
JwtAudienceValidator implements Validator<Token> { @Override public ValidationResult validate(Token token) { Set<String> allowedAudiences = extractAudiencesFromToken(token); if (validateDefault(allowedAudiences) || validateAudienceOfXsuaaBrokerClone(allowedAudiences)) { return ValidationResults.createValid(); } return ValidationResults.createInvalid( "Jwt token with audience {} is not issued for these clientIds: {}.", token.getAudiences(), trustedClientIds); } JwtAudienceValidator(String clientId); @Override ValidationResult validate(Token token); Set<String> getTrustedClientIds();  }### Answer:
@Test public void validate_tokenAudienceMatchesClientId() { ValidationResult result = new JwtAudienceValidator("client") .validate(token); assertThat(result.isValid()).isTrue(); }
@Test public void validate_clientIdMatchesTokenAudienceWithoutDot() { Mockito.when(token.getAudiences()) .thenReturn(Sets.newLinkedHashSet("client", "sb-test4!t1.data.x")); ValidationResult result = new JwtAudienceValidator("sb-test4!t1") .validate(token); assertThat(result.isValid()).isTrue(); }
@Test public void validate_tokenClientIdMatchesTrustedClientId() { Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet()); ValidationResult result = new JwtAudienceValidator("client") .validate(token); assertThat(result.isValid()).isTrue(); }
@Test public void validate_tokenClientIdMatchesTrustedBrokerClientId() { Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet()); Mockito.when(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID)) .thenReturn("sb-clone-app-id!b123|" + XSUAA_BROKER_XSAPPNAME); ValidationResult result = new JwtAudienceValidator(XSUAA_BROKER_XSAPPNAME) .validate(token); assertThat(result.isValid()).isTrue(); }
@Test public void validate_tokenClientIdDoesNotMatchTrustedBrokerClientId() { Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet()); Mockito.when(token.getClaimAsString(TokenClaims.XSUAA.CLIENT_ID)) .thenReturn("sb-clone-app-id!b123|xxx" + XSUAA_BROKER_XSAPPNAME); ValidationResult result = new JwtAudienceValidator(XSUAA_BROKER_XSAPPNAME) .validate(token); assertThat(result.isValid()).isFalse(); }
@Test public void validationShouldFilterEmptyAudiences() { Mockito.when(token.getAudiences()).thenReturn(Sets.newLinkedHashSet(".", "test.", " .test2")); ValidationResult result = new JwtAudienceValidator("any") .validate(token); assertThat(result.isErroneous()).isTrue(); assertThat(result.getErrorDescription()) .isEqualTo("Jwt token with audience [., test., .test2] is not issued for these clientIds: [any]."); }
@Test public void validationFails_when_TokenAudiencesAreEmpty() { Mockito.when(token.getAudiences()).thenReturn(Collections.emptySet()); ValidationResult result = new JwtAudienceValidator("any") .validate(token); assertThat(result.isErroneous()).isTrue(); assertThat(result.getErrorDescription()) .isEqualTo("Jwt token with audience [] is not issued for these clientIds: [any]."); }