[NC-2046] JWT authentication for JSON-RPC

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/dsl/condition/net/ExpectNetVersionPermissionException.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2018 ConsenSys AG.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package tech.pegasys.pantheon.tests.acceptance.dsl.condition.net;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.catchThrowable;
+
+import tech.pegasys.pantheon.tests.acceptance.dsl.condition.Condition;
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.Node;
+import tech.pegasys.pantheon.tests.acceptance.dsl.transaction.net.NetVersionTransaction;
+
+import org.web3j.protocol.exceptions.ClientConnectionException;
+
+public class ExpectNetVersionPermissionException implements Condition {
+
+  private final NetVersionTransaction transaction;
+  private final String expectedMessage;
+
+  public ExpectNetVersionPermissionException(
+      final NetVersionTransaction transaction, final String expectedMessage) {
+    this.transaction = transaction;
+    this.expectedMessage = expectedMessage;
+  }
+
+  @Override
+  public void verify(final Node node) {
+    final Throwable thrown = catchThrowable(() -> node.execute(transaction));
+    assertThat(thrown).isInstanceOf(RuntimeException.class);
+
+    final Throwable cause = thrown.getCause();
+    assertThat(cause).isInstanceOf(ClientConnectionException.class);
+    assertThat(cause.getMessage()).contains(expectedMessage);
+  }
+}

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/dsl/jsonrpc/Login.java

@@ -17,6 +17,7 @@
 import tech.pegasys.pantheon.tests.acceptance.dsl.condition.Condition;
 import tech.pegasys.pantheon.tests.acceptance.dsl.httptransaction.LoginTransaction;
 import tech.pegasys.pantheon.tests.acceptance.dsl.httptransaction.LoginUnauthorizedTransaction;
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.PantheonNode;
 
 public class Login {
 
@@ -32,4 +33,14 @@ public Condition loginFails(final String username, final String password) {
       n.executeHttpTransaction(new LoginUnauthorizedTransaction(username, password));
     };
   }
+
+  public Condition loginSucceedsAndSetsAuthenticationToken(
+      final String username, final String password) {
+
+    return (n) -> {
+      final String token = n.executeHttpTransaction(new LoginTransaction(username, password));
+      assertThat(token).isNotBlank();
+      ((PantheonNode) n).useAuthenticationTokenInHeaderForJsonRpc(token);
+    };
+  }
 }

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/dsl/jsonrpc/Net.java

@@ -18,6 +18,7 @@
 import tech.pegasys.pantheon.tests.acceptance.dsl.condition.net.ExpectNetVersionConnectionException;
 import tech.pegasys.pantheon.tests.acceptance.dsl.condition.net.ExpectNetVersionConnectionExceptionWithCause;
 import tech.pegasys.pantheon.tests.acceptance.dsl.condition.net.ExpectNetVersionIsNotBlank;
+import tech.pegasys.pantheon.tests.acceptance.dsl.condition.net.ExpectNetVersionPermissionException;
 import tech.pegasys.pantheon.tests.acceptance.dsl.transaction.net.NetTransactions;
 
 import java.math.BigInteger;
@@ -46,6 +47,10 @@ public Condition netVersionExceptional(final Class<? extends Throwable> cause) {
     return new ExpectNetVersionConnectionExceptionWithCause(transactions.netVersion(), cause);
   }
 
+  public Condition netVersionUnauthorizedExceptional(final String expectedMessage) {
+    return new ExpectNetVersionPermissionException(transactions.netVersion(), expectedMessage);
+  }
+
   public Condition awaitPeerCountExceptional() {
     return new AwaitNetPeerCountException(transactions.peerCount());
   }

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/dsl/node/NodeConfiguration.java

@@ -25,6 +25,8 @@ public interface NodeConfiguration {
 
   void useWebSocketsForJsonRpc();
 
+  void useAuthenticationTokenInHeaderForJsonRpc(String token);
+
   Optional<Integer> jsonRpcWebSocketPort();
 
   String hostName();

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/dsl/node/PantheonNode.java

@@ -90,6 +90,8 @@ public class PantheonNode implements Node, NodeConfiguration, RunnableNode, Auto
   private HttpRequestFactory httpRequestFactory;
   private Optional<EthNetworkConfig> ethNetworkConfig = Optional.empty();
   private boolean useWsForJsonRpc = false;
+  private boolean useAuthenticationTokenInHeaderForJsonRpc = false;
+  private String token = null;
 
   public PantheonNode(
       final String name,
@@ -201,6 +203,10 @@ private JsonRequestFactories jsonRequestFactories() {
               .map(url -> new HttpService(url))
               .orElse(new HttpService("http://" + LOCALHOST + ":" + port));
 
+      if (useAuthenticationTokenInHeaderForJsonRpc) {
+        ((HttpService) web3jService).addHeader("Bearer", token);
+      }
+
       jsonRequestFactories =
           new JsonRequestFactories(
               new JsonRpc2_0Web3j(web3jService, 2000, Async.defaultExecutorService()),
@@ -255,6 +261,22 @@ public void useWebSocketsForJsonRpc() {
     useWsForJsonRpc = true;
   }
 
+  /** All future JSON-RPC calls will include the authentication token. */
+  @Override
+  public void useAuthenticationTokenInHeaderForJsonRpc(final String token) {
+
+    if (jsonRequestFactories != null) {
+      jsonRequestFactories.shutdown();
+    }
+
+    if (httpRequestFactory != null) {
+      httpRequestFactory = null;
+    }
+
+    useAuthenticationTokenInHeaderForJsonRpc = true;
+    this.token = token;
+  }
+
   private void checkIfWebSocketEndpointIsAvailable(final String url) {
     final WebSocketClient webSocketClient = new WebSocketClient(URI.create(url));
     // Web3j implementation always invoke the listener (even when one hasn't been set). We are using

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/dsl/transaction/net/NetVersionTransaction.java

@@ -17,8 +17,6 @@
 import tech.pegasys.pantheon.tests.acceptance.dsl.transaction.JsonRequestFactories;
 import tech.pegasys.pantheon.tests.acceptance.dsl.transaction.Transaction;
 
-import java.io.IOException;
-
 import org.web3j.protocol.core.methods.response.NetVersion;
 
 public class NetVersionTransaction implements Transaction<String> {
@@ -32,7 +30,7 @@ public String execute(final JsonRequestFactories node) {
       assertThat(result).isNotNull();
       assertThat(result.hasError()).isFalse();
       return result.getNetVersion();
-    } catch (final IOException e) {
+    } catch (final Exception e) {
       throw new RuntimeException(e);
     }
   }

acceptance-tests/src/test/java/tech/pegasys/pantheon/tests/acceptance/jsonrpc/HttpServiceLoginAcceptanceTest.java

@@ -14,6 +14,9 @@
 
 import tech.pegasys.pantheon.tests.acceptance.dsl.AcceptanceTestBase;
 import tech.pegasys.pantheon.tests.acceptance.dsl.node.Node;
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.cluster.Cluster;
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.cluster.ClusterConfiguration;
+import tech.pegasys.pantheon.tests.acceptance.dsl.node.cluster.ClusterConfigurationBuilder;
 
 import java.io.IOException;
 import java.net.URISyntaxException;
@@ -22,12 +25,17 @@
 import org.junit.Test;
 
 public class HttpServiceLoginAcceptanceTest extends AcceptanceTestBase {
+  private Cluster authenticatedCluster;
   private Node node;
 
   @Before
   public void setUp() throws IOException, URISyntaxException {
+    final ClusterConfiguration clusterConfiguration =
+        new ClusterConfigurationBuilder().setAwaitPeerDiscovery(false).build();
+
+    authenticatedCluster = new Cluster(clusterConfiguration, net);
     node = pantheon.createArchiveNodeWithAuthentication("node1");
-    cluster.start(node);
+    authenticatedCluster.start(node);
   }
 
   @Test
@@ -39,4 +47,17 @@ public void shouldFailLoginWithWrongCredentials() {
   public void shouldSucceedLoginWithCorrectCredentials() {
     node.verify(login.loginSucceeds("user", "pegasys"));
   }
+
+  @Test
+  public void jsonRpcMethodShouldSucceedWithAuthenticatedUserAndPermission() {
+    node.verify(login.loginSucceedsAndSetsAuthenticationToken("user", "pegasys"));
+    node.verify(net.awaitPeerCount(0));
+    node.verify(net.netVersionUnauthorizedExceptional("Unauthorized"));
+  }
+
+  @Override
+  public void tearDownAcceptanceTestBase() {
+    authenticatedCluster.stop();
+    super.tearDownAcceptanceTestBase();
+  }
 }

acceptance-tests/src/test/resources/authentication/auth.toml

@@ -1,3 +1,3 @@
 [Users.user]
 password = "$2a$10$l3GA7K8g6rJ/Yv.YFSygCuI9byngpEzxgWS9qEg5emYDZomQW7fGC"
-permissions = ["fakePermission"]
+permissions = ["fakePermission", "net/peerCount"]