content: /*
   * Licensed to the Apache Software Foundation (ASF) under one or more
   * contributor license agreements. See the NOTICE file distributed with
   * this work for additional information regarding copyright ownership.
   * The ASF licenses this file to You under the Apache License, Version 2.0
   * (the "License"); you may not use this file except in compliance with
   * the License. You may obtain a copy of the License at
   *
   *    http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  package org.apache.kafka.connect.integration;
  
  import org.apache.kafka.connect.runtime.distributed.ConnectProtocolCompatibility;
  import org.apache.kafka.connect.storage.StringConverter;
  import org.apache.kafka.connect.util.clusters.EmbeddedConnectCluster;
  
  import org.junit.jupiter.api.AfterEach;
  import org.junit.jupiter.api.BeforeEach;
  import org.junit.jupiter.api.Tag;
  import org.junit.jupiter.api.Test;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import java.util.HashMap;
  import java.util.Map;
  import java.util.concurrent.TimeUnit;
  
  import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
  import static jakarta.ws.rs.core.Response.Status.FORBIDDEN;
  import static org.apache.kafka.connect.runtime.ConnectorConfig.CONNECTOR_CLASS_CONFIG;
  import static org.apache.kafka.connect.runtime.ConnectorConfig.KEY_CONVERTER_CLASS_CONFIG;
  import static org.apache.kafka.connect.runtime.ConnectorConfig.TASKS_MAX_CONFIG;
  import static org.apache.kafka.connect.runtime.ConnectorConfig.VALUE_CONVERTER_CLASS_CONFIG;
  import static org.apache.kafka.connect.runtime.SinkConnectorConfig.TOPICS_CONFIG;
  import static org.apache.kafka.connect.runtime.distributed.DistributedConfig.CONNECT_PROTOCOL_CONFIG;
  import static org.apache.kafka.connect.runtime.rest.InternalRequestSignature.SIGNATURE_ALGORITHM_HEADER;
  import static org.apache.kafka.connect.runtime.rest.InternalRequestSignature.SIGNATURE_HEADER;
  import static org.junit.jupiter.api.Assertions.assertEquals;
  
  /**
   * A simple integration test to ensure that internal request validation becomes enabled with the
   * "sessioned" protocol.
   */
  @Tag("integration")
  public class SessionedProtocolIntegrationTest {
  
      private static final Logger log = LoggerFactory.getLogger(SessionedProtocolIntegrationTest.class);
  
      private static final String CONNECTOR_NAME = "connector";
      private static final long CONNECTOR_SETUP_DURATION_MS = 60000;
  
      private EmbeddedConnectCluster connect;
      private ConnectorHandle connectorHandle;
  
      @BeforeEach
      public void setup() {
          // setup Connect worker properties
          Map<String, String> workerProps = new HashMap<>();
          workerProps.put(CONNECT_PROTOCOL_CONFIG, ConnectProtocolCompatibility.SESSIONED.protocol());
  
          // build a Connect cluster backed by a Kafka KRaft cluster
          connect = new EmbeddedConnectCluster.Builder()
              .name("connect-cluster")
              .numWorkers(2)
              .numBrokers(1)
              .workerProps(workerProps)
              .build();
  
          // start the clusters
          connect.start();
  
          // get a handle to the connector
          connectorHandle = RuntimeHandles.get().connectorHandle(CONNECTOR_NAME);
      }
  
      @AfterEach
      public void close() {
          // stop the Connect cluster and its backing Kafka cluster.
          connect.stop();
      }
  
      @Test
      public void ensureInternalEndpointIsSecured() throws Throwable {
          final String connectorTasksEndpoint = connect.endpointForResource(String.format(
              "connectors/%s/tasks",
              CONNECTOR_NAME
          ));
          final Map<String, String> emptyHeaders = new HashMap<>();
          final Map<String, String> invalidSignatureHeaders = new HashMap<>();
          invalidSignatureHeaders.put(SIGNATURE_HEADER, "S2Fma2Flc3F1ZQ==");
          invalidSignatureHeaders.put(SIGNATURE_ALGORITHM_HEADER, "HmacSHA256");
  
          // We haven't created the connector yet, but this should still return a 400 instead of a 404
          // if the endpoint is secured
          log.info(
              "Making a POST request to the {} endpoint with no connector started and no signature header; " 
                  + "expecting 400 error response",
              connectorTasksEndpoint
          );
          assertEquals(
              BAD_REQUEST.getStatusCode(),
              connect.requestPost(connectorTasksEndpoint, "[]", emptyHeaders).getStatus()
          );
  
          // Try again, but with an invalid signature
          log.info(
              "Making a POST request to the {} endpoint with no connector started and an invalid signature header; "
                  + "expecting 403 error response",
              connectorTasksEndpoint
          );
          assertEquals(
                  FORBIDDEN.getStatusCode(),
                  connect.requestPost(connectorTasksEndpoint, "[]", invalidSignatureHeaders).getStatus()
          );
  
          // Create the connector now
          // setup up props for the sink connector
          Map<String, String> connectorProps = new HashMap<>();
          connectorProps.put(CONNECTOR_CLASS_CONFIG, TestableSinkConnector.class.getSimpleName());
          connectorProps.put(TASKS_MAX_CONFIG, String.valueOf(1));
          connectorProps.put(TOPICS_CONFIG, "test-topic");
          connectorProps.put(KEY_CONVERTER_CLASS_CONFIG, StringConverter.class.getName());
          connectorProps.put(VALUE_CONVERTER_CLASS_CONFIG, StringConverter.class.getName());
  
          // start a sink connector
          log.info("Starting the {} connector", CONNECTOR_NAME);
          StartAndStopLatch startLatch = connectorHandle.expectedStarts(1);
          connect.configureConnector(CONNECTOR_NAME, connectorProps);
          startLatch.await(CONNECTOR_SETUP_DURATION_MS, TimeUnit.MILLISECONDS);
  
  
          // Verify the exact same behavior, after starting the connector
  
          // We haven't created the connector yet, but this should still return a 400 instead of a 404
          // if the endpoint is secured
          log.info(
              "Making a POST request to the {} endpoint with the connector started and no signature header; "
                  + "expecting 400 error response",
              connectorTasksEndpoint
          );
          assertEquals(
              BAD_REQUEST.getStatusCode(),
              connect.requestPost(connectorTasksEndpoint, "[]", emptyHeaders).getStatus()
          );
  
          // Try again, but with an invalid signature
          log.info(
              "Making a POST request to the {} endpoint with the connector started and an invalid signature header; "
                  + "expecting 403 error response",
              connectorTasksEndpoint
          );
          assertEquals(
              FORBIDDEN.getStatusCode(),
              connect.requestPost(connectorTasksEndpoint, "[]", invalidSignatureHeaders).getStatus()
          );
      }
  }
  