URI·상태 코드·PRG

package board.web;

import static org.junit.jupiter.api.Assertions.assertAll;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.http.MediaType.APPLICATION_JSON;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.URI;
import java.util.List;
import java.util.Map;
import java.util.concurrent.atomic.AtomicLong;
import org.junit.jupiter.api.Test;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ProblemDetail;
import org.springframework.http.ResponseEntity;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.http.converter.json.ProblemDetailJacksonMixin;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.MvcResult;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.bind.annotation.RestControllerAdvice;

final class ApiOutcomeContractTest {
    private static final ObjectMapper JSON =
            new ObjectMapper().addMixIn(
                    ProblemDetail.class,
                    ProblemDetailJacksonMixin.class);

    @Test
    void creation_identifies_the_primary_resource_and_representation()
            throws Exception {
        var fixture = fixture();

        var result = fixture.mvc().perform(post("/api/posts")
                        .contentType(APPLICATION_JSON)
                        .accept(APPLICATION_JSON)
                        .content("""
                                {"title":"URI contract"}
                                """))
                .andReturn();
        var body = body(result);

        assertAll(
                () -> assertEquals(
                        201, result.getResponse().getStatus()),
                () -> assertEquals(
                        "/api/posts/42",
                        result.getResponse().getHeader(
                                HttpHeaders.LOCATION)),
                () -> assertCompatible(
                        APPLICATION_JSON,
                        result.getResponse().getContentType()),
                () -> assertEquals(42L, body.path("id").longValue()),
                () -> assertEquals(
                        "URI contract",
                        body.path("title").textValue()));
    }

    @Test
    void accepted_response_exposes_the_documented_monitor()
            throws Exception {
        var fixture = fixture();

        var result = fixture.mvc().perform(
                        post("/api/export-jobs")
                                .accept(APPLICATION_JSON))
                .andReturn();
        var body = body(result);

        assertAll(
                () -> assertEquals(
                        202, result.getResponse().getStatus()),
                () -> assertEquals(
                        "/api/export-jobs/7",
                        result.getResponse().getHeader(
                                HttpHeaders.LOCATION)),
                () -> assertEquals(
                        "PENDING", body.path("state").textValue()),
                () -> assertEquals(
                        "/api/export-jobs/7",
                        body.path("monitor").textValue()),
                () -> assertEquals(
                        0, fixture.service().completedJobCount()));
    }

    @Test
    void no_content_response_has_no_body() throws Exception {
        var fixture = fixture();

        var result = fixture.mvc().perform(
                        delete("/api/posts/42"))
                .andReturn();

        assertAll(
                () -> assertEquals(
                        204, result.getResponse().getStatus()),
                () -> assertEquals(
                        0,
                        result.getResponse()
                                .getContentAsByteArray().length),
                () -> assertTrue(fixture.service().wasDeleted(42L)));
    }

    @Test
    void problem_details_keep_client_actions_distinct()
            throws Exception {
        var fixture = fixture();

        var invalid = fixture.mvc().perform(post("/api/posts")
                        .contentType(APPLICATION_JSON)
                        .accept(
                                APPLICATION_JSON,
                                MediaType.APPLICATION_PROBLEM_JSON)
                        .content("""
                                {"title":" "}
                                """))
                .andReturn();
        var unauthenticated = fixture.mvc().perform(
                        get("/api/private-posts/42")
                                .accept(
                                        APPLICATION_JSON,
                                        MediaType.APPLICATION_PROBLEM_JSON))
                .andReturn();
        var conflict = fixture.mvc().perform(post("/api/posts")
                        .contentType(APPLICATION_JSON)
                        .accept(
                                APPLICATION_JSON,
                                MediaType.APPLICATION_PROBLEM_JSON)
                        .content("""
                                {"title":"already-used"}
                                """))
                .andReturn();

        var invalidBody = body(invalid);
        var unauthorizedBody = body(unauthenticated);
        var conflictBody = body(conflict);
        var instances = List.of(
                invalidBody.path("instance").textValue(),
                unauthorizedBody.path("instance").textValue(),
                conflictBody.path("instance").textValue());

        assertAll(
                () -> assertEquals(
                        400, invalid.getResponse().getStatus()),
                () -> assertCompatible(
                        MediaType.APPLICATION_PROBLEM_JSON,
                        invalid.getResponse().getContentType()),
                () -> assertEquals(
                        "INVALID_REQUEST",
                        invalidBody.path("code").textValue()),
                () -> assertTrue(
                        invalidBody.path("errors").isArray()),
                () -> assertEquals(
                        401,
                        unauthenticated.getResponse().getStatus()),
                () -> assertCompatible(
                        MediaType.APPLICATION_PROBLEM_JSON,
                        unauthenticated.getResponse().getContentType()),
                () -> assertEquals(
                        "Bearer realm=\"board\"",
                        unauthenticated.getResponse().getHeader(
                                HttpHeaders.WWW_AUTHENTICATE)),
                () -> assertEquals(
                        "AUTHENTICATION_REQUIRED",
                        unauthorizedBody.path("code").textValue()),
                () -> assertEquals(
                        409, conflict.getResponse().getStatus()),
                () -> assertCompatible(
                        MediaType.APPLICATION_PROBLEM_JSON,
                        conflict.getResponse().getContentType()),
                () -> assertEquals(
                        "CURRENT_STATE_CONFLICT",
                        conflictBody.path("code").textValue()),
                () -> assertEquals(
                        "https://api.example.test/problems/"
                                + "current-state-conflict",
                        conflictBody.path("type").textValue()),
                () -> assertEquals(
                        List.of(
                                "urn:example:board:problem:1",
                                "urn:example:board:problem:2",
                                "urn:example:board:problem:3"),
                        instances),
                () -> assertEquals(
                        3, instances.stream().distinct().count()));
    }

    private static Fixture fixture() {
        var service = new BoardService();
        var controller = new BoardApiController(service);
        var mvc = MockMvcBuilders
                .standaloneSetup(controller)
                .setControllerAdvice(new ApiProblemHandler())
                .setMessageConverters(
                        new MappingJackson2HttpMessageConverter(JSON))
                .build();
        return new Fixture(service, mvc);
    }

    private static JsonNode body(MvcResult result) throws Exception {
        return JSON.readTree(
                result.getResponse().getContentAsByteArray());
    }

    private static void assertCompatible(
            MediaType expected, String actual) {
        assertTrue(actual != null);
        assertTrue(expected.isCompatibleWith(
                MediaType.parseMediaType(actual)));
    }

    record Fixture(BoardService service, MockMvc mvc) {
    }

    record CreatePostRequest(String title) {
    }

    record CreatePostResponse(long id, String title) {
        static CreatePostResponse from(Post post) {
            return new CreatePostResponse(post.id(), post.title());
        }
    }

    record Post(long id, String title) {
    }

    record ExportJob(long id, String state) {
    }

    record ExportJobResponse(
            long id, String state, String monitor) {
        static ExportJobResponse from(ExportJob job) {
            return new ExportJobResponse(
                    job.id(),
                    job.state(),
                    "/api/export-jobs/" + job.id());
        }
    }

    public static final class BoardService {
        private final AtomicLong postIds = new AtomicLong(41);
        private final AtomicLong jobIds = new AtomicLong(6);
        private final Map<Long, Boolean> deletions =
                new java.util.concurrent.ConcurrentHashMap<>();

        Post create(CreatePostRequest request) {
            if (request.title() == null
                    || request.title().isBlank()) {
                throw new InvalidInputException(
                        "title", "Title must not be blank.");
            }
            if ("already-used".equals(request.title())) {
                throw new CurrentStateConflictException(
                        "The collection already contains this title.");
            }
            return new Post(
                    postIds.incrementAndGet(), request.title());
        }

        ExportJob acceptExport() {
            return new ExportJob(
                    jobIds.incrementAndGet(), "PENDING");
        }

        void delete(long id) {
            deletions.put(id, true);
        }

        boolean wasDeleted(long id) {
            return deletions.getOrDefault(id, false);
        }

        int completedJobCount() {
            return 0;
        }
    }

    @RestController
    public static final class BoardApiController {
        private final BoardService service;

        public BoardApiController(BoardService service) {
            this.service = service;
        }

        @PostMapping(
                path = "/api/posts",
                consumes = MediaType.APPLICATION_JSON_VALUE,
                produces = MediaType.APPLICATION_JSON_VALUE)
        public ResponseEntity<CreatePostResponse> create(
                @RequestBody CreatePostRequest request) {
            var post = service.create(request);
            return ResponseEntity
                    .created(URI.create(
                            "/api/posts/" + post.id()))
                    .body(CreatePostResponse.from(post));
        }

        @PostMapping(
                path = "/api/export-jobs",
                produces = MediaType.APPLICATION_JSON_VALUE)
        public ResponseEntity<ExportJobResponse> export() {
            var job = service.acceptExport();
            var monitor = URI.create(
                    "/api/export-jobs/" + job.id());
            return ResponseEntity
                    .accepted()
                    .location(monitor)
                    .body(ExportJobResponse.from(job));
        }

        @DeleteMapping("/api/posts/{id}")
        public ResponseEntity<Void> delete(@PathVariable("id") long id) {
            service.delete(id);
            return ResponseEntity.noContent().build();
        }

        @GetMapping(
                path = "/api/private-posts/{id}",
                produces = MediaType.APPLICATION_JSON_VALUE)
        public CreatePostResponse privatePost(
                @PathVariable("id") long id,
                @RequestHeader(
                        value = HttpHeaders.AUTHORIZATION,
                        required = false)
                String authorization) {
            if (!"Bearer valid-token".equals(authorization)) {
                throw new AuthenticationRequiredException();
            }
            return new CreatePostResponse(id, "private");
        }
    }

    @RestControllerAdvice
    public static final class ApiProblemHandler {
        private final AtomicLong occurrenceIds = new AtomicLong();

        @ExceptionHandler(InvalidInputException.class)
        public ResponseEntity<ProblemDetail> invalidInput(
                InvalidInputException exception) {
            var problem = problem(
                    HttpStatus.BAD_REQUEST,
                    "https://api.example.test/problems/"
                            + "invalid-request",
                    "Invalid request",
                    exception.getMessage(),
                    "INVALID_REQUEST");
            problem.setProperty(
                    "errors",
                    List.of(Map.of(
                            "field", exception.field(),
                            "message", exception.getMessage())));
            return response(HttpStatus.BAD_REQUEST, problem);
        }

        @ExceptionHandler(AuthenticationRequiredException.class)
        public ResponseEntity<ProblemDetail> authenticationRequired() {
            var status = HttpStatus.UNAUTHORIZED;
            var problem = problem(
                    status,
                    "https://api.example.test/problems/"
                            + "authentication-required",
                    "Authentication required",
                    "Supply valid credentials for this resource.",
                    "AUTHENTICATION_REQUIRED");
            return ResponseEntity
                    .status(status)
                    .header(
                            HttpHeaders.WWW_AUTHENTICATE,
                            "Bearer realm=\"board\"")
                    .contentType(MediaType.APPLICATION_PROBLEM_JSON)
                    .body(problem);
        }

        @ExceptionHandler(CurrentStateConflictException.class)
        public ResponseEntity<ProblemDetail> currentStateConflict(
                CurrentStateConflictException exception) {
            var status = HttpStatus.CONFLICT;
            var problem = problem(
                    status,
                    "https://api.example.test/problems/"
                            + "current-state-conflict",
                    "Current state conflict",
                    exception.getMessage(),
                    "CURRENT_STATE_CONFLICT");
            return response(status, problem);
        }

        private ProblemDetail problem(
                HttpStatus status,
                String type,
                String title,
                String detail,
                String code) {
            var problem = ProblemDetail.forStatusAndDetail(
                    status, detail);
            problem.setType(URI.create(type));
            problem.setTitle(title);
            problem.setInstance(URI.create(
                    "urn:example:board:problem:"
                            + occurrenceIds.incrementAndGet()));
            problem.setProperty("code", code);
            return problem;
        }

        private static ResponseEntity<ProblemDetail> response(
                HttpStatus status, ProblemDetail problem) {
            return ResponseEntity
                    .status(status)
                    .contentType(MediaType.APPLICATION_PROBLEM_JSON)
                    .body(problem);
        }
    }

    static final class InvalidInputException
            extends RuntimeException {
        private final String field;

        InvalidInputException(String field, String message) {
            super(message);
            this.field = field;
        }

        String field() {
            return field;
        }
    }

    static final class AuthenticationRequiredException
            extends RuntimeException {
    }

    static final class CurrentStateConflictException
            extends RuntimeException {
        CurrentStateConflictException(String message) {
            super(message);
        }
    }
}

package board.web;

import static org.junit.jupiter.api.Assertions.assertAll;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;

import java.net.URI;
import java.util.concurrent.atomic.AtomicInteger;
import java.util.concurrent.atomic.AtomicLong;
import java.util.concurrent.atomic.AtomicReference;
import org.junit.jupiter.api.Test;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Controller;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.MvcResult;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import org.springframework.web.util.HtmlUtils;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.ResponseBody;

final class PrgRedirectContractTest {
    @Test
    void form_post_contract_returns_303_with_an_empty_body()
            throws Exception {
        var fixture = fixture();

        var result = submit(fixture.mvc());

        assertAll(
                () -> assertEquals(
                        303, result.getResponse().getStatus()),
                () -> assertEquals(
                        "/posts/42",
                        result.getResponse().getHeader(
                                HttpHeaders.LOCATION)),
                () -> assertEquals(
                        0,
                        result.getResponse()
                                .getContentAsByteArray().length,
                        "This endpoint contract uses an empty 303 body."),
                () -> assertEquals(
                        1, fixture.service().registrationCount()));
    }

    @Test
    void explicit_get_and_refresh_do_not_repeat_registration()
            throws Exception {
        var fixture = fixture();
        var submitted = submit(fixture.mvc());
        var location = submitted.getResponse().getHeader(
                HttpHeaders.LOCATION);

        var firstGet = fixture.mvc().perform(get(location))
                .andReturn();
        var refresh = fixture.mvc().perform(get(location))
                .andReturn();

        assertAll(
                () -> assertEquals(
                        200, firstGet.getResponse().getStatus()),
                () -> assertCompatible(
                        MediaType.TEXT_HTML,
                        firstGet.getResponse().getContentType()),
                () -> assertTrue(firstGet.getResponse()
                        .getContentAsString()
                        .contains("<h1>PRG</h1>")),
                () -> assertTrue(firstGet.getResponse()
                        .getContentAsString()
                        .contains("&lt;script&gt;alert(")),
                () -> assertFalse(firstGet.getResponse()
                        .getContentAsString()
                        .contains("<script>")),
                () -> assertEquals(
                        firstGet.getResponse().getContentAsString(),
                        refresh.getResponse().getContentAsString()),
                () -> assertEquals(
                        1, fixture.service().registrationCount()));
    }

    @Test
    void redirect_statuses_remain_distinct() throws Exception {
        var fixture = fixture();
        var statusCodes = new int[] {301, 302, 307, 308};

        for (var statusCode : statusCodes) {
            var result = fixture.mvc().perform(
                            post("/redirects/{status}", statusCode))
                    .andReturn();

            assertAll(
                    () -> assertEquals(
                            statusCode,
                            result.getResponse().getStatus()),
                    () -> assertEquals(
                            "/posts/42",
                            result.getResponse().getHeader(
                                    HttpHeaders.LOCATION)));
        }

        assertEquals(0, fixture.service().registrationCount());
    }

    private static MvcResult submit(MockMvc mvc) throws Exception {
        return mvc.perform(post("/posts")
                        .contentType(
                        MediaType.APPLICATION_FORM_URLENCODED)
                        .param("title", "PRG")
                        .param(
                                "content",
                                "<script>alert('x')</script>"))
                .andReturn();
    }

    private static Fixture fixture() {
        var service = new RecordingPostService();
        var mvc = MockMvcBuilders
                .standaloneSetup(new PostFormController(service))
                .build();
        return new Fixture(service, mvc);
    }

    private static void assertCompatible(
            MediaType expected, String actual) {
        assertTrue(actual != null);
        assertTrue(expected.isCompatibleWith(
                MediaType.parseMediaType(actual)));
    }

    record Fixture(RecordingPostService service, MockMvc mvc) {
    }

    record Post(long id, String title, String content) {
    }

    public static final class PostForm {
        private String title;
        private String content;

        public String getTitle() {
            return title;
        }

        public void setTitle(String title) {
            this.title = title;
        }

        public String getContent() {
            return content;
        }

        public void setContent(String content) {
            this.content = content;
        }
    }

    public static final class RecordingPostService {
        private final AtomicLong ids = new AtomicLong(41);
        private final AtomicInteger registrations =
                new AtomicInteger();
        private final AtomicReference<Post> latest =
                new AtomicReference<>();

        Post register(PostForm form) {
            registrations.incrementAndGet();
            var post = new Post(
                    ids.incrementAndGet(),
                    form.getTitle(),
                    form.getContent());
            latest.set(post);
            return post;
        }

        Post find(long id) {
            var post = latest.get();
            if (post == null || post.id() != id) {
                throw new IllegalArgumentException(
                        "Unknown post: " + id);
            }
            return post;
        }

        int registrationCount() {
            return registrations.get();
        }
    }

    @Controller
    public static final class PostFormController {
        private final RecordingPostService service;

        public PostFormController(RecordingPostService service) {
            this.service = service;
        }

        @PostMapping(
                path = "/posts",
                consumes =
                        MediaType.APPLICATION_FORM_URLENCODED_VALUE)
        public ResponseEntity<Void> register(
                @ModelAttribute PostForm form) {
            var post = service.register(form);
            return ResponseEntity
                    .status(HttpStatus.SEE_OTHER)
                    .location(URI.create(
                            "/posts/" + post.id()))
                    .build();
        }

        @GetMapping(
                path = "/posts/{id}",
                produces = MediaType.TEXT_HTML_VALUE)
        @ResponseBody
        public ResponseEntity<String> show(@PathVariable("id") long id) {
            var post = service.find(id);
            var html = "<!doctype html><html><body><h1>"
                    + HtmlUtils.htmlEscape(post.title())
                    + "</h1><p>"
                    + HtmlUtils.htmlEscape(post.content())
                    + "</p></body></html>";
            return ResponseEntity
                    .ok()
                    .contentType(MediaType.TEXT_HTML)
                    .body(html);
        }

        @PostMapping("/redirects/{status}")
        public ResponseEntity<Void> redirect(
                @PathVariable("status") int status) {
            var redirectStatus = switch (status) {
                case 301 -> HttpStatus.MOVED_PERMANENTLY;
                case 302 -> HttpStatus.FOUND;
                case 307 -> HttpStatus.TEMPORARY_REDIRECT;
                case 308 -> HttpStatus.PERMANENT_REDIRECT;
                default -> throw new IllegalArgumentException(
                        "Unsupported redirect: " + status);
            };
            return ResponseEntity
                    .status(redirectStatus)
                    .location(URI.create("/posts/42"))
                    .build();
        }
    }
}