dcp-967 managed access

src/integration/java/org/humancellatlas/ingest/security/SecurityTest.java

@@ -1,7 +1,9 @@
 package org.humancellatlas.ingest.security;
 
+import org.hamcrest.CoreMatchers;
 import org.humancellatlas.ingest.config.MigrationConfiguration;
 import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
@@ -10,13 +12,14 @@
 import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.web.servlet.MockMvc;
 
 import java.util.stream.Stream;
 
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
 
 @SpringBootTest
 @AutoConfigureDataMongo()
@@ -51,14 +54,14 @@ class Authorised {
         @MethodSource("org.humancellatlas.ingest.security.SecurityTest#metadataTypes")
         @WithMockUser
         public void apiAccessWithTrailingSlashIsPermitted(String metadataTypePlural) throws Exception {
-            checkGetUrlIsAuthorized("/" + metadataTypePlural + "/");
+            checkGetUrlIsOk("/" + metadataTypePlural + "/");
         }
 
         @ParameterizedTest
         @MethodSource("org.humancellatlas.ingest.security.SecurityTest#metadataTypes")
         @WithMockUser
         public void apiAccessNoTrailingSlashIsPermitted(String metadataTypePlural) throws Exception {
-            checkGetUrlIsAuthorized("/" + metadataTypePlural);
+            checkGetUrlIsOk("/" + metadataTypePlural);
         }
 
     }
@@ -73,19 +76,36 @@ public void apiAccessWithTrailingSlashIsBlocked(String metadataTypePlural) throw
 
         @ParameterizedTest
         @MethodSource("org.humancellatlas.ingest.security.SecurityTest#metadataTypes")
-
         public void apiAccessNoTrailingSlashIsBlocked(String metadataTypePlural) throws Exception {
             checkGetUrlIsUnauthorized("/" + metadataTypePlural);
         }
-    }
 
 
+    }
+
+    @Nested
+    class RootResource {
+        @Test
+        public void checkUnauthenticatedJson_IsAllowed() throws Exception {
+            webApp.perform(get("/")
+                            .accept(MediaType.APPLICATION_JSON))
+                    .andExpect(status().isOk())
+                    .andExpect(jsonPath("_links").hasJsonPath());
+        }
+        @Test
+        public void checkUnauthenticatedHtml_IsAllowed() throws Exception {
+            webApp.perform(get("/browser/index.html")
+                            .accept(MediaType.TEXT_HTML))
+                    .andExpect(status().isOk())
+                    .andExpect(content().string(CoreMatchers.containsString("The HAL Browser (for Spring Data REST)")));
+        }
+    }
     private void checkGetUrlIsUnauthorized(String url) throws Exception {
         webApp.perform(
                 get(url)
         ).andExpect(status().isUnauthorized());
     }
-    private void checkGetUrlIsAuthorized(String url) throws Exception {
+    private void checkGetUrlIsOk(String url) throws Exception {
         webApp.perform(
                 get(url)
         ).andExpect(status().isOk());

src/main/java/org/humancellatlas/ingest/security/SecurityConfig.java

@@ -95,6 +95,8 @@ protected void configure(HttpSecurity http) throws Exception {
                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                 .cors().and()
                 .authorizeRequests()
+                .antMatchers(GET, "/").permitAll()
+                .antMatchers(GET, "/browser/**").permitAll()
                 .antMatchers(POST, "/submissionEnvelopes").authenticated()
                 .antMatchers(POST, "/projects").authenticated()
                 .antMatchers(POST, "/projects/suggestion").permitAll()