### Question:
CEKRequestExtensionIdVerifier implements CEKRequestVerifier { @Override public void verify(HttpServletRequest request, CEKRequestMessage requestMessage, String requestJson, SystemContext system) throws SecurityException { if (this.applicationIds == null || this.applicationIds.isEmpty()) { return; } String applicationId = system.getApplication().getApplicationId(); if (StringUtils.isBlank(applicationId)) { throw new SecurityException("applicationId is missing."); } if (!this.applicationIds.contains(applicationId)) { throw new SecurityException(String.format("[%s] is not expected applicationId.", applicationId)); } } CEKRequestExtensionIdVerifier(Collection<String> applicationIds); @Override void verify(HttpServletRequest request, CEKRequestMessage requestMessage, String requestJson,
                       SystemContext system);  }### Answer:
@Test public void test_noApplicationId() throws Throwable { doCallRealMethod().when(advice).handle(captor.capture()); mvc.perform(post("/cek/v1") .content(CEKRequestGenerator.requestBodyBuilder() .intent("CEKRequestExtensionIdVerifierTest") .remove("$.context.System.application.applicationId") .build()) .contentType(MediaType.APPLICATION_JSON)) .andDo(print()) .andExpect(status().isBadRequest()); verify(handler, never()).handleExtensionIdVerifierTest(); assertThat(captor.getValue()).isExactlyInstanceOf(SecurityException.class) .hasMessage("applicationId is missing."); }
@Test public void test_hasApplicationId_wrongApplicationId() throws Throwable { doCallRealMethod().when(advice).handle(captor.capture()); String applicationId = UUID.randomUUID().toString(); mvc.perform(post("/cek/v1") .header(CLOVA_SIGNATURE_REQUEST_HEADER, RandomStringUtils.randomAlphabetic(10)) .content(CEKRequestGenerator.requestBodyBuilder() .intent("CEKRequestExtensionIdVerifierTest") .placeholder("applicationId", applicationId) .build()) .contentType(MediaType.APPLICATION_JSON)) .andDo(print()) .andExpect(status().isBadRequest()); verify(handler, never()).handleExtensionIdVerifierTest(); assertThat(captor.getValue()).isExactlyInstanceOf(SecurityException.class) .hasMessage(String.format("[%s] is not expected applicationId.", applicationId)); }
@Test public void test_hasApplicationId_correctApplicationId() throws Throwable { String signature = StreamUtils.copyToString(new ClassPathResource("data/signature").getInputStream(), StandardCharsets.UTF_8).trim(); mvc.perform(post("/cek/v1") .header(CLOVA_SIGNATURE_REQUEST_HEADER, signature) .content(CEKRequestGenerator.requestBodyBuilder() .intent("CEKRequestExtensionIdVerifierTest") .placeholder("applicationId", "bbb") .build()) .contentType(MediaType.APPLICATION_JSON)) .andDo(print()) .andExpect(status().isOk()); verify(handler).handleExtensionIdVerifierTest(); }