Feature enable cors (#854)

* enabled cors in security configuration, added corresponding properties
* added test for cors validation
* formatting
* added mariadb test dependency and refactored test
* added database listeners to the test
* Remove dependency duplicate

Signed-off-by: Bogdan Bondar <Bogdan.Bondar@bosch-si.com>
Signed-off-by: Stefan Behl <stefan.behl@bosch-si.com>

hawkbit-runtime/hawkbit-update-server/src/main/resources/application.properties

@@ -33,3 +33,7 @@ spring.rabbitmq.port=5672
 #hawkbit.server.im.users[0].firstname=Eclipse
 #hawkbit.server.im.users[0].lastname=HawkBit
 #hawkbit.server.im.users[0].permissions=ALL
+
+# Enable CORS and specify the allowed origins:
+#hawkbit.server.security.cors.enabled=true
+#hawkbit.server.security.cors.allowedOrigins=http://localhost

hawkbit-runtime/hawkbit-update-server/src/test/java/org/eclipse/hawkbit/app/CorsTest.java

@@ -0,0 +1,88 @@
+/**
+ * Copyright (c) 2019 Bosch Software Innovations GmbH and others.
+ *
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ */
+package org.eclipse.hawkbit.app;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.options;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.eclipse.hawkbit.mgmt.rest.api.MgmtRestConstants;
+import org.eclipse.hawkbit.repository.test.util.MsSqlTestDatabase;
+import org.eclipse.hawkbit.repository.test.util.MySqlTestDatabase;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.security.test.context.support.WithUserDetails;
+import org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers;
+import org.springframework.test.context.TestExecutionListeners;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.ResultActions;
+import org.springframework.test.web.servlet.setup.DefaultMockMvcBuilder;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.WebApplicationContext;
+import org.springframework.test.context.TestExecutionListeners.MergeMode;
+
+import io.qameta.allure.Description;
+import io.qameta.allure.Feature;
+import io.qameta.allure.Story;
+
+@RunWith(SpringRunner.class)
+@SpringBootTest(properties = {"hawkbit.dmf.rabbitmq.enabled=false", "hawkbit.server.security.cors.enabled=true",
+        "hawkbit.server.security.cors.allowedOrigins=" + CorsTest.ALLOWED_ORIGIN_FIRST + "," + CorsTest.ALLOWED_ORIGIN_SECOND})
+@TestExecutionListeners(listeners = { MySqlTestDatabase.class, MsSqlTestDatabase.class }, 
+        mergeMode = MergeMode.MERGE_WITH_DEFAULTS)
+@Feature("Integration Test - Security")
+@Story("CORS")
+public class CorsTest {
+
+    final static String ALLOWED_ORIGIN_FIRST = "http://test.first.origin";
+    final static String ALLOWED_ORIGIN_SECOND = "http://test.second.origin";
+    
+    private final static String INVALID_ORIGIN = "http://test.invalid.origin";
+    private final static String INVALID_CORS_REQUEST = "Invalid CORS request";
+
+    @Autowired
+    private WebApplicationContext context;
+
+    private MockMvc mvc;
+
+    @Before
+    public void setup() {
+        final DefaultMockMvcBuilder builder = MockMvcBuilders.webAppContextSetup(context)
+                .apply(SecurityMockMvcConfigurers.springSecurity()).dispatchOptions(true);
+        mvc = builder.build();
+    }
+
+    @WithUserDetails("admin")
+    @Test
+    @Description("Ensures that Cors is working.")
+    public void validateCorsRequest() throws Exception {
+        performOptionsRequestToRestWithOrigin(ALLOWED_ORIGIN_FIRST).andExpect(status().isOk());
+        performOptionsRequestToRestWithOrigin(ALLOWED_ORIGIN_SECOND).andExpect(status().isOk());
+
+        final String invalidOriginResponseBody = performOptionsRequestToRestWithOrigin(INVALID_ORIGIN)
+                .andExpect(status().isForbidden()).andReturn().getResponse().getContentAsString();
+        assertThat(invalidOriginResponseBody).isEqualTo(INVALID_CORS_REQUEST);
+
+        final String invalidCorsUrlResponseBody = performOptionsRequestToUrlWithOrigin(MgmtRestConstants.BASE_SYSTEM_MAPPING, ALLOWED_ORIGIN_FIRST)
+                .andExpect(status().isForbidden()).andReturn().getResponse().getContentAsString();
+        assertThat(invalidCorsUrlResponseBody).isEqualTo(INVALID_CORS_REQUEST);
+    }
+
+    private ResultActions performOptionsRequestToRestWithOrigin(final String origin) throws Exception {
+        return performOptionsRequestToUrlWithOrigin(MgmtRestConstants.BASE_V1_REQUEST_MAPPING, origin);
+    }
+    
+    private ResultActions performOptionsRequestToUrlWithOrigin(final String url, final String origin) throws Exception {
+        return mvc.perform(options(url).header("Access-Control-Request-Method", "GET").header("Origin", origin));
+    }
+}