fix: CORS defaults

.github/workflows/integration-tests.yml

@@ -65,6 +65,8 @@ jobs:
                     APIML_SECURITY_AUTH_PASSTICKET_CUSTOMUSERHEADER: customUserHeader
                     APIML_SECURITY_AUTH_PASSTICKET_CUSTOMAUTHHEADER: customPassticketHeader
                     ZWE_CONFIGS_APIML_SERVICE_ADDITIONALREGISTRATION_0_DISCOVERYSERVICEURLS: https://discovery-service-2:10011/eureka
+                    APIML_SERVICE_CORSENABLED: true
+                    APIML_SERVICE_CORSDEFAULTALLOWEDORIGINS: https://localhost:10010,https://localhost2:10010
             mock-services:
                 image: ghcr.io/balhar-jakub/mock-services:${{ github.run_id }}-${{ github.run_number }}
             metrics-service:
@@ -679,6 +681,7 @@ jobs:
                     APIML_HEALTH_PROTECTED: true
                     APIML_SECURITY_AUTH_PASSTICKET_CUSTOMUSERHEADER: customUserHeader
                     APIML_SECURITY_AUTH_PASSTICKET_CUSTOMAUTHHEADER: customPassticketHeader
+                    APIML_SERVICE_CORSDEFAULTALLOWEDORIGINS: https://localhost:10010,https://localhost2:10010
             mock-services:
                 image: ghcr.io/balhar-jakub/mock-services:${{ github.run_id }}-${{ github.run_number }}
             metrics-service:

api-catalog-services/src/test/java/org/zowe/apiml/apicatalog/acceptance/ResponseHeaderFixTest.java

@@ -15,7 +15,6 @@
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.web.server.LocalServerPort;
 import org.springframework.context.annotation.Profile;
-import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -37,7 +36,6 @@
     webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT
 )
 @ActiveProfiles("ResponseHeaderFixTest")
-@DirtiesContext
 class ResponseHeaderFixTest {
 
     private static final int ADD_HEADER = 0;

api-catalog-services/src/test/java/org/zowe/apiml/apicatalog/functional/AttlsConfigTest.java

@@ -27,7 +27,6 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.mock.mockito.MockBean;
-import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.TestPropertySource;
 import org.zowe.apiml.apicatalog.ApiCatalogApplication;
@@ -47,7 +46,6 @@
 class AttlsConfigTest {
 
     @Nested
-    @DirtiesContext
     @ActiveProfiles({"AttlsConfigTestCatalog", "attlsServer", "attlsClient"})
     class GivenAttlsModeEnabled extends ApiCatalogFunctionalTest {
 
@@ -103,7 +101,6 @@ void requestFailsWithAttlsContextReasonWithHttp() {
         }
     )
     @ActiveProfiles({"attlsServer", "attlsClient", "debug"})
-    @DirtiesContext
     @SpringBootTest(
         classes = ApiCatalogApplication.class,
         webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT

build.gradle

@@ -60,6 +60,7 @@ allprojects {
 
     eclipse {
         classpath {
+            defaultOutputDir = file('build/classes/java/main')
             file {
                 whenMerged { classpath ->
                     for (ClasspathEntry entry : classpath.getEntries()) {
@@ -68,6 +69,12 @@ allprojects {
                             if (theEntry.path != null && theEntry.path.contains('org.eclipse.jdt.launching.JRE_CONTAINER')) {
                                 theEntry.accessRules.add(new AccessRule('accessible', 'com/sun/net/httpserver/**'))
                             }
+                            if (theEntry.path != null && (theEntry.path == 'src/main/java' || theEntry.path == 'src/main/resources')) {
+                                theEntry.output = 'build/classes/java/main'
+                            }
+                            if (theEntry.path != null && (theEntry.path == 'src/test/java' || theEntry.path == 'src/test/resources')) {
+                                theEntry.output = 'build/classes/java/test'
+                            }
                         }
                     }
                 }
@@ -146,6 +153,8 @@ subprojects {
 
     tasks.withType(Test) {
         maxParallelForks = 1
+        maxHeapSize = '2g'
+        systemProperty 'spring.test.context.cache.maxSize', '5'
     }
 }
 

caching-service/src/test/java/org/zowe/apiml/caching/acceptance/ResponseHeaderFixTest.java

@@ -18,7 +18,6 @@
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.web.server.LocalServerPort;
 import org.springframework.context.annotation.Profile;
-import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -43,7 +42,6 @@
 )
 @ActiveProfiles("ResponseHeaderFixTest")
 @TestInstance(TestInstance.Lifecycle.PER_CLASS)
-@DirtiesContext
 class ResponseHeaderFixTest {
 
     private static final int ADD_HEADER = 0;

caching-service/src/test/java/org/zowe/apiml/caching/config/AttlsConfigTest.java

@@ -27,7 +27,6 @@
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.web.server.LocalServerPort;
 import org.springframework.http.HttpStatus;
-import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.TestPropertySource;
 import org.zowe.apiml.caching.CachingService;
@@ -60,7 +59,6 @@ private String getUri(String hostname, int port, String scheme) {
             "caching.storage.mode=inMemory"
         }
     )
-    @DirtiesContext
     @Nested
     class GivenAttlsModeEnabled {
 
@@ -131,7 +129,6 @@ void requestFailsWithAttlsReasonWithHttp() {
         }
     )
     @ActiveProfiles({"attlsServer", "attlsClient"})
-    @DirtiesContext
     @SpringBootTest(
         classes = CachingService.class,
         webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT

cloud-gateway-package/src/main/resources/bin/start.sh

@@ -227,8 +227,6 @@ _BPX_JOBNAME=${ZWE_zowe_job_prefix}${CLOUD_GATEWAY_CODE} java \
     -Dapiml.service.hostname=${ZWE_haInstance_hostname:-localhost} \
     -Dapiml.service.port=${ZWE_configs_port:-10023} \
     -Dapiml.service.forwardClientCertEnabled=${ZWE_configs_apiml_service_forwardClientCertEnabled:-false} \
-    -Dapiml.service.corsEnabled=${ZWE_configs_apiml_service_corsEnabled:-false} \
-    -Dapiml.service.corsAllowedMethods=${ZWE_configs_apiml_service_corsAllowedMethods:-} \
     -Dapiml.security.x509.registry.allowedUsers=${ZWE_configs_apiml_security_x509_registry_allowedUsers:-} \
     -Dapiml.logs.location=${ZWE_zowe_logDirectory} \
     -Dapiml.zoweManifest=${ZWE_zowe_runtimeDirectory}/manifest.json \

cloud-gateway-service/src/main/java/org/zowe/apiml/cloudgatewayservice/config/ConnectionsConfig.java

@@ -137,7 +137,7 @@ public class ConnectionsConfig {
     private int requestTimeout;
 
     @Value("${apiml.service.corsEnabled:false}")
-    private boolean corsEnabled;
+    private boolean gatewayCorsEnabled;
 
     @Value("${apiml.service.corsAllowedMethods:GET,HEAD,POST,PATCH,DELETE,PUT,OPTIONS}")
     private List<String> corsAllowedMethods;
@@ -356,7 +356,10 @@ public CorsConfigurationSource corsConfigurationSource(RoutePredicateHandlerMapp
 
     @Bean
     public CorsUtils corsUtils() {
-        return new CorsUtils(corsEnabled, corsAllowedMethods, null);
+        return CorsUtils.builder()
+            .gatewayCorsEnabled(gatewayCorsEnabled)
+            .defaultAllowedCorsHttpMethods(corsAllowedMethods)
+            .build();
     }
 
     @Bean

cloud-gateway-service/src/main/java/org/zowe/apiml/cloudgatewayservice/service/RouteLocator.java

@@ -10,33 +10,32 @@
 
 package org.zowe.apiml.cloudgatewayservice.service;
 
-import lombok.AccessLevel;
-import lombok.Getter;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.cloud.client.ServiceInstance;
 import org.springframework.cloud.client.discovery.ReactiveDiscoveryClient;
 import org.springframework.cloud.gateway.filter.FilterDefinition;
 import org.springframework.cloud.gateway.route.RouteDefinition;
 import org.springframework.cloud.gateway.route.RouteDefinitionLocator;
-import org.springframework.context.ApplicationContext;
 import org.springframework.stereotype.Service;
-import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
 import org.zowe.apiml.auth.Authentication;
 import org.zowe.apiml.auth.AuthenticationScheme;
 import org.zowe.apiml.cloudgatewayservice.service.routing.RouteDefinitionProducer;
 import org.zowe.apiml.cloudgatewayservice.service.scheme.SchemeHandler;
 import org.zowe.apiml.eurekaservice.client.util.EurekaMetadataParser;
 import org.zowe.apiml.product.routing.RoutedService;
-import org.zowe.apiml.util.CorsUtils;
 import org.zowe.apiml.util.StringUtils;
 import reactor.core.publisher.Flux;
 
-import java.util.*;
+import java.util.Comparator;
+import java.util.EnumMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import static org.zowe.apiml.constants.EurekaMetadataDefinition.APIML_ID;
 import static org.zowe.apiml.constants.EurekaMetadataDefinition.SERVICE_SUPPORTING_CLIENT_CERT_FORWARDING;
 
 @Service
@@ -47,28 +46,18 @@ public class RouteLocator implements RouteDefinitionLocator {
     @Value("${apiml.service.forwardClientCertEnabled:false}")
     private boolean forwardingClientCertEnabled;
 
-    private final ApplicationContext context;
-
-    private final CorsUtils corsUtils;
     private final ReactiveDiscoveryClient discoveryClient;
 
     private final List<FilterDefinition> commonFilters;
     private final List<RouteDefinitionProducer> routeDefinitionProducers;
     private final Map<AuthenticationScheme, SchemeHandler> schemeHandlers = new EnumMap<>(AuthenticationScheme.class);
 
-    @Getter(lazy = true, value = AccessLevel.PRIVATE)
-    private final UrlBasedCorsConfigurationSource corsConfigurationSource = context.getBean(UrlBasedCorsConfigurationSource.class);
-
     public RouteLocator(
-        ApplicationContext context,
-        CorsUtils corsUtils,
         ReactiveDiscoveryClient discoveryClient,
         List<FilterDefinition> commonFilters,
         List<SchemeHandler> schemeHandlersList,
         List<RouteDefinitionProducer> routeDefinitionProducers
     ) {
-        this.context = context;
-        this.corsUtils = corsUtils;
         this.discoveryClient = discoveryClient;
         this.commonFilters = commonFilters;
         this.routeDefinitionProducers = routeDefinitionProducers;
@@ -93,16 +82,6 @@ void setAuth(ServiceInstance serviceInstance, RouteDefinition routeDefinition, A
         }
     }
 
-    void setCors(ServiceInstance serviceInstance) {
-        corsUtils.setCorsConfiguration(
-            serviceInstance.getServiceId().toLowerCase(),
-            serviceInstance.getMetadata(),
-            (prefix, serviceId, config) -> {
-                serviceId = serviceInstance.getMetadata().getOrDefault(APIML_ID, serviceInstance.getServiceId().toLowerCase());
-                getCorsConfigurationSource().registerCorsConfiguration("/" + serviceId + "/**", config);
-            });
-    }
-
     Stream<RoutedService> getRoutedService(ServiceInstance serviceInstance) {
         // TODO: this is till the SCGW and GW uses the same DS. The routing rules should be different for each application
         if (org.apache.commons.lang.StringUtils.equalsIgnoreCase("GATEWAY", serviceInstance.getServiceId())) {
@@ -175,13 +154,9 @@ public Flux<RouteDefinition> getRouteDefinitions() {
         // counter of generated route definition to prevent clashing by the order
         AtomicInteger order = new AtomicInteger();
         // iterate over services
-        return getServiceInstances().flatMap(Flux::fromIterable).map(serviceInstance -> {
-            // configure CORS for the service (if necessary)
-            setCors(serviceInstance);
-
+        return getServiceInstances().flatMap(Flux::fromIterable).map(serviceInstance ->
             // generate route definition per services and its routing rules
-            return getAuthFilterPerRoute(order, serviceInstance, getPostRoutingFilters(serviceInstance));
-        })
+            getAuthFilterPerRoute(order, serviceInstance, getPostRoutingFilters(serviceInstance)))
         .flatMapIterable(list -> list);
     }
 

cloud-gateway-service/src/test/java/org/zowe/apiml/cloudgatewayservice/acceptance/CorsPerServiceTest.java

@@ -11,6 +11,7 @@
 package org.zowe.apiml.cloudgatewayservice.acceptance;
 
 import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.zowe.apiml.cloudgatewayservice.acceptance.common.AcceptanceTest;
 import org.zowe.apiml.cloudgatewayservice.acceptance.common.AcceptanceTestWithMockServices;
@@ -27,6 +28,7 @@ class CorsPerServiceTest extends AcceptanceTestWithMockServices {
     private static final String HEADER_X_FORWARD_TO = "X-Forward-To";
 
     @Test
+    @Disabled("CORS Not supported in SCGW. Using Spring's defaults")
     void routeToServiceWithCorsEnabled() throws IOException {
         mockService("serviceid1")
             .addEndpoint("/test")

cloud-gateway-service/src/test/java/org/zowe/apiml/cloudgatewayservice/acceptance/common/AcceptanceTest.java

@@ -26,7 +26,11 @@
 @Retention(RetentionPolicy.RUNTIME)
 @ComponentScan(basePackages = "org.zowe.apiml.cloudgatewayservice")
 @SpringBootTest(classes = CloudGatewayServiceTestApplication.class, webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
-    properties = {"management.server.port=10091","server.internal.enabled=false"})
+    properties = {
+        "management.server.port=-1",
+        "server.internal.enabled=false"
+    }
+)
 @Import(DiscoveryClientTestConfig.class)
 @DirtiesContext
 public @interface AcceptanceTest {

cloud-gateway-service/src/test/java/org/zowe/apiml/cloudgatewayservice/config/ConnectionsConfigTest.java

@@ -31,7 +31,6 @@
 import org.springframework.test.util.ReflectionTestUtils;
 import org.zowe.apiml.util.CorsUtils;
 
-import java.lang.reflect.Field;
 import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -131,12 +130,10 @@ public class WhenCorsAllowedMethodsIsNotSet {
             private ConnectionsConfig connectionsConfig;
 
             @Test
-            void validateDefaultCorsAllowedMethods() throws NoSuchFieldException, IllegalAccessException {
+            void validateDefaultCorsAllowedMethods()  {
                 CorsUtils corsUtils = connectionsConfig.corsUtils();
-
-                Field field = corsUtils.getClass().getDeclaredField("allowedCorsHttpMethods");
-                field.setAccessible(true);
-                List<String> corsAllowedMethods = (List<String>) field.get(corsUtils);
+                @SuppressWarnings("unchecked")
+                List<String> corsAllowedMethods = (List<String>) ReflectionTestUtils.getField(corsUtils, "defaultAllowedCorsHttpMethods");
                 assertEquals(7, corsAllowedMethods.size());
             }
         }
@@ -152,18 +149,19 @@ public class WhenCorsAllowedMethodsIsSet {
             private ConnectionsConfig connectionsConfig;
 
             @Test
-            void validateCorsAllowedMethods() throws NoSuchFieldException, IllegalAccessException {
+            void validateCorsAllowedMethods()  {
                 CorsUtils corsUtils = connectionsConfig.corsUtils();
 
-                Field field = corsUtils.getClass().getDeclaredField("allowedCorsHttpMethods");
-                field.setAccessible(true);
-                List<String> corsAllowedMethods = (List<String>) field.get(corsUtils);
+                @SuppressWarnings("unchecked")
+                List<String> corsAllowedMethods = (List<String>) ReflectionTestUtils.getField(corsUtils, "defaultAllowedCorsHttpMethods");
                 assertEquals(3, corsAllowedMethods.size());
                 assertEquals("GET", corsAllowedMethods.get(0));
                 assertEquals("POST", corsAllowedMethods.get(1));
                 assertEquals("PATCH", corsAllowedMethods.get(2));
             }
+
         }
+
     }
 
 }