### Question:
AuthCheckFilter implements Filter { @Override public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest)req; HttpServletResponse response = (HttpServletResponse)res; response.setHeader("X-Frame-Options", JiveGlobals.getProperty("adminConsole.frame-options", "same")); String loginPage = defaultLoginPage; if (loginPage == null) { loginPage = request.getContextPath() + (AuthFactory.isOneTimeAccessTokenEnabled() ? "/loginToken.jsp" : "/login.jsp" ); } String url = request.getRequestURI().substring(1); if (url.startsWith("plugins/")) { url = url.substring("plugins/".length()); } boolean doExclude = false; for (String exclude : excludes) { if (testURLPassesExclude(url, exclude)) { doExclude = true; break; } } if (!doExclude) { WebManager manager = new WebManager(); manager.init(request, response, request.getSession(), context); boolean haveOneTimeToken = manager.getAuthToken() instanceof AuthToken.OneTimeAuthToken; User loggedUser = manager.getUser(); boolean loggedAdmin = loggedUser == null ? false : adminManager.isUserAdmin(loggedUser.getUsername(), true); if (!haveOneTimeToken && !loggedAdmin && !authUserFromRequest(request)) { response.sendRedirect(getRedirectURL(request, loginPage, null)); return; } } chain.doFilter(req, res); } AuthCheckFilter();   AuthCheckFilter(final AdminManager adminManager, final LoginLimitManager loginLimitManager); static AuthCheckFilter getInstance(); static boolean isServletRequestAuthenticatorInstanceOf(Class<? extends ServletRequestAuthenticator> clazz); static void addExclude(String exclude); static void removeExclude(String exclude); static boolean testURLPassesExclude(String url, String exclude); @Override void init(FilterConfig config); @Override void doFilter(ServletRequest req, ServletResponse res, FilterChain chain); @Override void destroy(); static final SystemProperty<Class> SERVLET_REQUEST_AUTHENTICATOR; }### Answer:
@Test public void willNotRedirectARequestFromAnAdminUser() throws Exception { AuthCheckFilter.SERVLET_REQUEST_AUTHENTICATOR.setValue(AdminUserServletAuthenticatorClass.class); final AuthCheckFilter filter = new AuthCheckFilter(adminManager, loginLimitManager); filter.doFilter(request, response, filterChain); verify(response, never()).sendRedirect(anyString()); verify(loginLimitManager).recordSuccessfulAttempt(adminUser, remoteAddr); final ArgumentCaptor<AuthToken> argumentCaptor = ArgumentCaptor.forClass(AuthToken.class); verify(httpSession).setAttribute(eq("jive.admin.authToken"), argumentCaptor.capture()); final AuthToken authToken = argumentCaptor.getValue(); assertThat(authToken.getUsername(), is(adminUser)); }
@Test public void willRedirectARequestWithoutAServletRequestAuthenticator() throws Exception { final AuthCheckFilter filter = new AuthCheckFilter(adminManager, loginLimitManager); filter.doFilter(request, response, filterChain); verify(response).sendRedirect(anyString()); }
@Test public void willRedirectARequestWithABrokenServletRequestAuthenticator() throws Exception { AuthCheckFilter.SERVLET_REQUEST_AUTHENTICATOR.setValue(BrokenUserServletAuthenticatorClass.class); final AuthCheckFilter filter = new AuthCheckFilter(adminManager, loginLimitManager); filter.doFilter(request, response, filterChain); verify(response).sendRedirect(anyString()); }
@Test public void willRedirectARequestIfTheServletRequestAuthenticatorReturnsNoUser() throws Exception { AuthCheckFilter.SERVLET_REQUEST_AUTHENTICATOR.setValue(NoUserServletAuthenticatorClass.class); final AuthCheckFilter filter = new AuthCheckFilter(adminManager, loginLimitManager); filter.doFilter(request, response, filterChain); verify(response).sendRedirect(anyString()); }
@Test public void willRedirectARequestIfTheServletRequestAuthenticatorReturnsAnUnauthorisedUser() throws Exception { AuthCheckFilter.SERVLET_REQUEST_AUTHENTICATOR.setValue(NormalUserServletAuthenticatorClass.class); final AuthCheckFilter filter = new AuthCheckFilter(adminManager, loginLimitManager); filter.doFilter(request, response, filterChain); verify(response).sendRedirect(anyString()); }