fix: SBOM analysis request should be blocked when user limit exceeded #302
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,203 @@ | ||
| package com.redhat.ecosystemappeng.exploitiq.service; | ||
|
|
||
| import com.fasterxml.jackson.databind.ObjectMapper; | ||
| import com.redhat.ecosystemappeng.exploitiq.repository.ProductRepositoryService; | ||
| import io.quarkus.test.InjectMock; | ||
| import io.quarkus.test.component.QuarkusComponentTest; | ||
| import jakarta.inject.Inject; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import java.io.ByteArrayInputStream; | ||
| import java.io.InputStream; | ||
| import java.nio.charset.StandardCharsets; | ||
|
|
||
| import static org.junit.jupiter.api.Assertions.assertThrows; | ||
| import static org.junit.jupiter.api.Assertions.assertEquals; | ||
| import static org.mockito.ArgumentMatchers.any; | ||
| import static org.mockito.ArgumentMatchers.anyString; | ||
| import static org.mockito.ArgumentMatchers.eq; | ||
| import static org.mockito.Mockito.doAnswer; | ||
| import static org.mockito.Mockito.doThrow; | ||
| import static org.mockito.Mockito.never; | ||
| import static org.mockito.Mockito.verify; | ||
| import static org.mockito.Mockito.when; | ||
|
|
||
| /** | ||
| * Tests that SPDX upload checks queue capacity before creating product, | ||
| * matching the pattern used by RPM and CycloneDX flows. | ||
| */ | ||
| @QuarkusComponentTest | ||
| class SbomReportServiceQueueAdmissionTest { | ||
|
Contributor
There was a problem hiding this comment. Important: Missing happy path test. Both tests verify rejection (queue throws before the lambda runs). There's no test verifying the lambda actually executes when capacity is available. The RPM equivalent ( A happy path test would catch:
Suggested approach: mock |
||
|
|
||
| @Inject | ||
| SbomReportService sbomReportService; | ||
|
|
||
| @InjectMock | ||
| RequestQueueService queueService; | ||
| @InjectMock | ||
| UserService userService; | ||
| @InjectMock | ||
| ProductRepositoryService productRepository; | ||
| @InjectMock | ||
| SpdxParsingService spdxParsingService; | ||
| @InjectMock | ||
| ComponentProcessingService componentProcessingService; | ||
| @InjectMock | ||
| CycloneDxParsingService cycloneDxParsingService; | ||
| @InjectMock | ||
| ReportService reportService; | ||
| @InjectMock | ||
| CredentialProcessingService credentialProcessingService; | ||
| @InjectMock | ||
| ObjectMapper objectMapper; | ||
|
|
||
| /** | ||
| * Test happy path: when capacity is available, the lambda executes, | ||
| * product is created, and component processing starts. | ||
| */ | ||
| @Test | ||
| void submitSpdx_HappyPath_CreatesProductAndProcessesComponents() throws Exception { | ||
| String spdxJson = """ | ||
| { | ||
| "spdxVersion": "SPDX-2.3", | ||
| "name": "happy-product", | ||
| "versionInfo": "3.0.0", | ||
| "documentNamespace": "https://example.com/happy", | ||
| "packages": [] | ||
| } | ||
| """; | ||
|
|
||
| InputStream spdxStream = new ByteArrayInputStream(spdxJson.getBytes(StandardCharsets.UTF_8)); | ||
|
|
||
| SpdxParsingService.ProductInfo productInfo = new SpdxParsingService.ProductInfo( | ||
| "happy-product", "3.0.0", null, null | ||
| ); | ||
| SpdxParsingService.ParsedSpdx parsedSpdx = new SpdxParsingService.ParsedSpdx( | ||
| productInfo, | ||
| java.util.List.of(), | ||
| java.util.List.of() | ||
| ); | ||
| when(spdxParsingService.parse(any())).thenReturn(parsedSpdx); | ||
| when(userService.getUserName()).thenReturn("charlie"); | ||
|
|
||
| // Mock queueService to execute the lambda when capacity is available | ||
| doAnswer(invocation -> { | ||
| @SuppressWarnings("unchecked") | ||
| java.util.function.Supplier<String> action = invocation.getArgument(2); | ||
| return action.get(); // Execute the lambda | ||
| }).when(queueService).runIfHasCapacity(eq("charlie"), anyString(), any()); | ||
|
|
||
| // Execute | ||
| String result = sbomReportService.submitSpdx(spdxStream, "CVE-2024-9999", null); | ||
|
|
||
| // Verify: Product created | ||
| verify(productRepository).save(any(), eq("charlie")); | ||
|
|
||
| // Verify: Component processing started | ||
| verify(componentProcessingService).processComponents(any(), anyString(), any(), eq("CVE-2024-9999"), eq(null)); | ||
|
|
||
| // Verify: Returns product ID (non-null) | ||
| assertEquals(true, result != null && !result.isEmpty()); | ||
| } | ||
|
|
||
| /** | ||
| * Test that SPDX upload throws UserQueueExceededException when user limit is exceeded, | ||
| * and does NOT create a product document. This matches the behavior of RPM analysis. | ||
| */ | ||
| @Test | ||
| void submitSpdx_UserQueueExceeded_DoesNotCreateProduct() throws Exception { | ||
| // Prepare minimal valid SPDX JSON | ||
| String spdxJson = """ | ||
| { | ||
| "spdxVersion": "SPDX-2.3", | ||
| "name": "test-product", | ||
| "documentNamespace": "https://example.com/test", | ||
| "packages": [ | ||
| { | ||
| "name": "test-component", | ||
| "versionInfo": "1.0.0", | ||
| "externalRefs": [ | ||
| { | ||
| "referenceCategory": "PACKAGE-MANAGER", | ||
| "referenceType": "purl", | ||
| "referenceLocator": "pkg:oci/test@sha256:abcd1234" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| """; | ||
|
|
||
| InputStream spdxStream = new ByteArrayInputStream(spdxJson.getBytes(StandardCharsets.UTF_8)); | ||
|
|
||
| // Mock parsing to return valid parsed data | ||
| SpdxParsingService.ProductInfo productInfo = new SpdxParsingService.ProductInfo( | ||
| "test-product", "1.0.0", null, null | ||
| ); | ||
| SpdxParsingService.ParsedSpdx parsedSpdx = new SpdxParsingService.ParsedSpdx( | ||
| productInfo, | ||
| java.util.List.of(), // components | ||
| java.util.List.of() // unsupported components | ||
| ); | ||
| when(spdxParsingService.parse(any())).thenReturn(parsedSpdx); | ||
| when(userService.getUserName()).thenReturn("alice"); | ||
|
|
||
| // Mock queueService to throw UserQueueExceededException (user limit exceeded) | ||
| doThrow(new UserQueueExceededException(5)) | ||
| .when(queueService).runIfHasCapacity(eq("alice"), anyString(), any()); | ||
|
|
||
| // Assert that exception is thrown | ||
| assertThrows(UserQueueExceededException.class, | ||
| () -> sbomReportService.submitSpdx(spdxStream, "CVE-2024-1234", null)); | ||
|
Comment on lines
+150
to
+151
Contributor
There was a problem hiding this comment. Important: Arguments to
Consider using doThrow(new UserQueueExceededException(5))
.when(queueService).runIfHasCapacity(eq("alice"), anyString(), any());Same applies to the second test with |
||
|
|
||
| // Verify: No product created (save never called on productRepository) | ||
| verify(productRepository, never()).save(any(), any()); | ||
|
|
||
| // Verify: No component processing started | ||
| verify(componentProcessingService, never()).processComponents(any(), any(), any(), any(), any()); | ||
| } | ||
|
|
||
| /** | ||
| * Test that SPDX upload throws RequestQueueExceededException when global queue is full, | ||
| * and does NOT create a product document. | ||
| */ | ||
| @Test | ||
| void submitSpdx_GlobalQueueExceeded_DoesNotCreateProduct() throws Exception { | ||
| String spdxJson = """ | ||
| { | ||
| "spdxVersion": "SPDX-2.3", | ||
| "name": "test-product", | ||
| "versionInfo": "2.0.0", | ||
| "documentNamespace": "https://example.com/test2", | ||
| "packages": [] | ||
| } | ||
| """; | ||
|
|
||
| InputStream spdxStream = new ByteArrayInputStream(spdxJson.getBytes(StandardCharsets.UTF_8)); | ||
|
|
||
| SpdxParsingService.ProductInfo productInfo = new SpdxParsingService.ProductInfo( | ||
| "test-product", "2.0.0", null, null | ||
| ); | ||
| SpdxParsingService.ParsedSpdx parsedSpdx = new SpdxParsingService.ParsedSpdx( | ||
| productInfo, | ||
| java.util.List.of(), | ||
| java.util.List.of() | ||
| ); | ||
| when(spdxParsingService.parse(any())).thenReturn(parsedSpdx); | ||
| when(userService.getUserName()).thenReturn("bob"); | ||
|
|
||
| // Mock queueService to throw RequestQueueExceededException (global queue full) | ||
| doThrow(new RequestQueueExceededException(500)) | ||
| .when(queueService).runIfHasCapacity(eq("bob"), anyString(), any()); | ||
|
|
||
| // Assert that exception is thrown | ||
| assertThrows(RequestQueueExceededException.class, | ||
| () -> sbomReportService.submitSpdx(spdxStream, "CVE-2024-5678", null)); | ||
|
|
||
| // Verify: No product created | ||
|
Contributor
There was a problem hiding this comment. Suggestion: Add The first test verifies both verify(productRepository, never()).save(any(), any());
verify(componentProcessingService, never()).processComponents(any(), any(), any(), any(), any()); |
||
| verify(productRepository, never()).save(any(), any()); | ||
|
|
||
| // Verify: No component processing started | ||
| verify(componentProcessingService, never()).processComponents(any(), any(), any(), any(), any()); | ||
| } | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@TamarW0 This is used for the slot reservation in the queue, but the product uses another generated productId, you need it to be the same.