aswi2022code-of-duty-gitlab/backend/src/test/java/cz/zcu/kiv/backendapi/user/UserServiceImplTest.java @ 217cf731

package cz.zcu.kiv.backendapi.user;

import cz.zcu.kiv.backendapi.exception.ApiRequestException;
import cz.zcu.kiv.backendapi.user.password.PasswordDto;
import cz.zcu.kiv.backendapi.user.permission.PermissionDto;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.mockito.ArgumentCaptor;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoExtension;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import java.util.Collections;
import java.util.List;
import java.util.Optional;

import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.*;

@ExtendWith(MockitoExtension.class)
class UserServiceImplTest {

    @Mock
    private UserRepository userRepository;

    @Mock
    private BCryptPasswordEncoder bCryptPasswordEncoder;

    private UserServiceImpl underTest;

    @BeforeEach
    void setUp() {
        underTest = new UserServiceImpl(userRepository, bCryptPasswordEncoder);
    }

    @Test
    void testCanLoadUserByUsername() {
        // given
        String email = "[e-mail]";
        UserEntity userEntity = new UserEntity("John Doe", email, "password", (byte) 1, false);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        UserEntity user = (UserEntity) underTest.loadUserByUsername(email);

        // then
        verify(userRepository).findByEmail(email);
        assertThat(user).isEqualTo(userEntity);
    }

    @Test
    void testCanNotLoadUserByUsername() {
        String email = "[e-mail]";

        // when
        // then
        assertThatThrownBy(() -> underTest.loadUserByUsername(email))
                .isInstanceOf(UsernameNotFoundException.class)
                .hasMessageContaining("User with username " + email + " not found");

        verify(userRepository).findByEmail(email);
    }

    @Test
    void testCanGetUserByName() {
        // given
        String email = "[e-mail]";
        UserEntity userEntity = new UserEntity("John Doe", email, "password", (byte) 1, false);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        UserEntity user = underTest.getUserByName(email);

        // then
        verify(userRepository).findByEmail(email);
        assertThat(user).isEqualTo(userEntity);
    }

    @Test
    void testCanNotGetUserByName() {
        String email = "[e-mail]";

        // when
        // then
        assertThatThrownBy(() -> underTest.getUserByName(email))
                .isInstanceOf(UsernameNotFoundException.class)
                .hasMessageContaining("User with username " + email + " not found");

        verify(userRepository).findByEmail(email);
    }

    @Test
    void canRegisterNewUser() {
        // given
        String email = "[e-mail]";
        String password = "password";
        UserDto userDto = new UserDto("John Doe", email, new PermissionDto(), new PasswordDto(password, password));
        UserEntity userEntity = new UserEntity(userDto.getName(), userDto.getEmail(), bCryptPasswordEncoder.encode(password), (byte) 0, false);
        // when
        underTest.registerNewUser(userDto);

        // then
        ArgumentCaptor<UserEntity> argumentCaptor = ArgumentCaptor.forClass(UserEntity.class);

        verify(userRepository).save(argumentCaptor.capture());

        UserEntity capturedUser = argumentCaptor.getValue();

        assertThat(capturedUser).isEqualTo(userEntity);
    }

    @Test
    void canNotRegisterNewUser() {
        // given
        String email = "[e-mail]";
        String password = "password";
        UserDto userDto = new UserDto("John Doe", email, new PermissionDto(), new PasswordDto(password, password));


        given(userRepository.findByEmail(anyString())).willReturn(Optional.of(new UserEntity()));

        // when
        // then
        assertThatThrownBy(() -> underTest.registerNewUser(userDto))
                .isInstanceOf(ApiRequestException.class)
                .hasMessageContaining("User with username " + email + " already exists");

        verify(userRepository, never()).save(any());
    }

    @Test
    void testCanUpdatePermissions() {
        // given
        String email = "[e-mail]";
        String password = "password";
        UserEntity userEntity = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(password), (byte) 0, false);
        UserEntity userEntityWithChangedPermissions = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(password), (byte) 7, false);
        PermissionDto permissionDto = new PermissionDto(true, true, true);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        underTest.updatePermissions(email, permissionDto);

        // then
        ArgumentCaptor<UserEntity> argumentCaptor = ArgumentCaptor.forClass(UserEntity.class);

        verify(userRepository).save(argumentCaptor.capture());

        UserEntity capturedUser = argumentCaptor.getValue();

        assertThat(capturedUser).isEqualTo(userEntityWithChangedPermissions);
    }

    @Test
    void testCanNotUpdatePermissions() {
        // given
        String email = "[e-mail]";
        PermissionDto permissionDto = new PermissionDto();
        given(userRepository.findByEmail(anyString())).willReturn(Optional.empty());

        // when
        // then
        assertThatThrownBy(() -> underTest.updatePermissions(email, permissionDto))
                .isInstanceOf(UsernameNotFoundException.class)
                .hasMessageContaining("User with username " + email + " not found");

        verify(userRepository, never()).save(any());
    }

    @Test
    void testCanNotUpdatePermissionsAdmin() {
        // given
        String email = "[e-mail]";
        UserEntity userEntity = new UserEntity("John Doe", email, "", (byte) 0, true);
        PermissionDto permissionDto = new PermissionDto();
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        assertThatThrownBy(() -> underTest.updatePermissions(email, permissionDto))
                .isInstanceOf(ApiRequestException.class)
                .hasMessageContaining("Permissions for user with ADMIN rights can not be changed");

        // then
        verify(userRepository, never()).delete(any());
    }

    @Test
    void testCanResetPassword() {
        // given
        String email = "[e-mail]";
        String password = "password";
        String newPassword = "password123";
        UserEntity userEntity = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(password), (byte) 0, false);
        UserEntity userEntityWithChangedPassword = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(newPassword), (byte) 0, false);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        underTest.resetPassword(email, newPassword);

        // then
        ArgumentCaptor<UserEntity> argumentCaptor = ArgumentCaptor.forClass(UserEntity.class);

        verify(userRepository).save(argumentCaptor.capture());

        UserEntity capturedUser = argumentCaptor.getValue();

        assertThat(capturedUser).isEqualTo(userEntityWithChangedPassword);
    }

    @Test
    void testCanNotResetPassword() {
        // given
        String email = "[e-mail]";
        String newPassword = "password123";
        given(userRepository.findByEmail(anyString())).willReturn(Optional.empty());

        // when
        // then
        assertThatThrownBy(() -> underTest.resetPassword(email, newPassword))
                .isInstanceOf(UsernameNotFoundException.class)
                .hasMessageContaining("User with username " + email + " not found");

        verify(userRepository, never()).save(any());
    }

    @Test
    void testCanNotResetSuperAdminPassword() {
        // given
        String email = "[e-mail]";
        String newPassword = "password123";

        // when
        // then
        assertThatThrownBy(() -> underTest.resetPassword(email, newPassword))
                .isInstanceOf(ApiRequestException.class)
                .hasMessageContaining("Password for SUPER ADMIN can not be changed");

        verify(userRepository, never()).save(any());
        verify(userRepository, never()).findByEmail(any());
    }

    @Test
    void testCanDeleteUser() {
        // given
        String email = "[e-mail]";
        UserEntity userEntity = new UserEntity("John Doe", email, "", (byte) 0, false);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        underTest.deleteUser(email);

        // then
        verify(userRepository).delete(userEntity);
    }

    @Test
    void testCanNotDeleteUser() {
        // given
        String email = "[e-mail]";
        given(userRepository.findByEmail(email)).willReturn(Optional.empty());

        // when
        assertThatThrownBy(() -> underTest.deleteUser(email))
                .isInstanceOf(UsernameNotFoundException.class)
                .hasMessageContaining("User with username " + email + " not found");

        // then
        verify(userRepository, never()).delete(any());
    }

    @Test
    void testCanNotDeleteUserAdmin() {
        // given
        String email = "[e-mail]";
        UserEntity userEntity = new UserEntity("John Doe", email, "", (byte) 0, true);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        assertThatThrownBy(() -> underTest.deleteUser(email))
                .isInstanceOf(ApiRequestException.class)
                .hasMessageContaining("User with ADMIN rights can not be deleted");

        // then
        verify(userRepository, never()).delete(any());
    }

    @Test
    void getAllUsers() {
        // given
        UserEntity userEntity1 = new UserEntity("first", "[e-mail]", "password", (byte) 0, false);
        UserEntity userEntity2 = new UserEntity("second", "[e-mail]", "password2", (byte) 1, false);
        UserEntity userEntity3 = new UserEntity("third", "[e-mail]", "password3", (byte) 7, true);
        UserEntity userEntity4 = new UserEntity("SuperAdmin", "[e-mail]", "password3", (byte) 7, true);

        UserDto userDto1 = new UserDto("first", "[e-mail]", new PermissionDto(), null);
        UserDto userDto2 = new UserDto("second", "[e-mail]", new PermissionDto(true, false, false), null);
        UserDto userDto3 = new UserDto("third", "[e-mail]", new PermissionDto(true, true, true), null);

        given(userRepository.findAll()).willReturn(List.of(userEntity1, userEntity2, userEntity3, userEntity4));

        // when
        List<UserDto> allUsers = underTest.getAllUsers();

        // then
        assertThat(allUsers.size()).isEqualTo(3);
        assertTrue(allUsers.contains(userDto1));
        assertTrue(allUsers.contains(userDto2));
        assertTrue(allUsers.contains(userDto3));


        verify(userRepository).findAll();
    }

    @Test
    void testCanChangePassword() {
        // given
        String email = "[e-mail]";
        String oldPassword = "password";
        String newPassword = "password123";
        given(bCryptPasswordEncoder.encode(oldPassword)).willReturn("encodedOldPassword");
        given(bCryptPasswordEncoder.encode(newPassword)).willReturn("encodedNewPassword");
        UserEntity userEntity = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(oldPassword), (byte) 0, false);
        UserEntity userEntityWithChangedPassword = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(newPassword), (byte) 0, false);
        given(bCryptPasswordEncoder.matches(any(), any())).willReturn(true);
        SecurityContext securityContext = mock(SecurityContext.class);
        Authentication authentication = mock(Authentication.class);
        given(securityContext.getAuthentication()).willReturn(authentication);
        SecurityContextHolder.setContext(securityContext);
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(email, null, Collections.emptySet());
        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        given(SecurityContextHolder.getContext().getAuthentication().getPrincipal()).willReturn(email);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));
        // when
        underTest.changePassword(oldPassword, newPassword);

        // then
        ArgumentCaptor<UserEntity> argumentCaptor = ArgumentCaptor.forClass(UserEntity.class);

        verify(userRepository).save(argumentCaptor.capture());

        UserEntity capturedUser = argumentCaptor.getValue();

        assertThat(capturedUser).isEqualTo(userEntityWithChangedPassword);
    }

    @Test
    void testCanNotChangePassword() {
        // given
        String email = "[e-mail]";
        String oldPassword = "password";
        String newPassword = "password123";
        UserEntity userEntity = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(oldPassword), (byte) 0, false);
        given(bCryptPasswordEncoder.matches(any(), any())).willReturn(false);
        SecurityContext securityContext = mock(SecurityContext.class);
        Authentication authentication = mock(Authentication.class);
        given(securityContext.getAuthentication()).willReturn(authentication);
        SecurityContextHolder.setContext(securityContext);
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(email, null, Collections.emptySet());
        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        given(SecurityContextHolder.getContext().getAuthentication().getPrincipal()).willReturn(email);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        // then
        assertThatThrownBy(() -> underTest.changePassword(oldPassword, newPassword))
                .isInstanceOf(ApiRequestException.class)
                .hasMessageContaining("Old password does not match");

        verify(userRepository, never()).save(any());
    }

    @Test
    void testCanNotChangePasswordSuperAdmin() {
        // given
        String email = "[e-mail]";
        String oldPassword = "password";
        String newPassword = "password123";
        UserEntity userEntity = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(oldPassword), (byte) 7, true);
        SecurityContext securityContext = mock(SecurityContext.class);
        Authentication authentication = mock(Authentication.class);
        given(securityContext.getAuthentication()).willReturn(authentication);
        SecurityContextHolder.setContext(securityContext);
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(email, null, Collections.emptySet());
        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        given(SecurityContextHolder.getContext().getAuthentication().getPrincipal()).willReturn(email);
        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));

        // when
        // then
        assertThatThrownBy(() -> underTest.changePassword(oldPassword, newPassword))
                .isInstanceOf(ApiRequestException.class)
                .hasMessageContaining("Can not change password for SUPER ADMIN");

        verify(userRepository, never()).save(any());
    }
}