Add test data and some tests

src/main/java/org/tailormap/api/configuration/dev/PopulateTestData.java

@@ -493,7 +493,28 @@ public void createTestConfiguration() throws Exception {
                             "Gemeentegebied",
                             new GeoServiceLayerSettings().legendImageId(legend.getId().toString())))
                 .setPublished(true)
-                .setTitle("PDOK Kadaster bestuurlijke gebieden")
+                .setTitle("PDOK Kadaster bestuurlijke gebieden"),
+            new GeoService()
+                .setId("bestuurlijkegebieden-proxied")
+                .setProtocol(WMS)
+                .setUrl(
+                    "https://service.pdok.nl/kadaster/bestuurlijkegebieden/wms/v1_0?service=WMS")
+                .setAuthorizationRules(rule)
+                // The service actually doesn't require authentication, but also doesn't mind it
+                // Just for testing that proxied services with auth are not available in public
+                // apps (even when logged in), in any controllers (map, proxy, features)
+                .setAuthentication(
+                    new ServiceAuthentication()
+                        .method(ServiceAuthentication.MethodEnum.PASSWORD)
+                        .username("test")
+                        .password("test"))
+                .setSettings(
+                    new GeoServiceSettings()
+                        // No attribution required: service is CC0
+                        .serverType(GeoServiceSettings.ServerTypeEnum.MAPSERVER)
+                        .useProxy(true))
+                .setPublished(true)
+                .setTitle("Bestuurlijke gebieden (proxied met auth)")
             // TODO MapServer WMS "https://wms.geonorge.no/skwms1/wms.adm_enheter_historisk"
             );
 
@@ -677,6 +698,27 @@ public void createTestConfiguration() throws Exception {
               geoServiceRepository.save(geoService);
             });
 
+    geoServiceRepository
+        .findById("bestuurlijkegebieden-proxied")
+        .ifPresent(
+            geoService -> {
+              geoService
+                  .getSettings()
+                  .getLayerSettings()
+                  .put(
+                      "Provinciegebied",
+                      new GeoServiceLayerSettings()
+                          .featureType(
+                              new FeatureTypeRef()
+                                  .featureSourceId(
+                                      featureSources
+                                          .get("pdok-kadaster-bestuurlijkegebieden")
+                                          .getId())
+                                  .featureTypeName("bestuurlijkegebieden:Provinciegebied"))
+                          .title("Provinciegebied (WFS, proxied met auth)"));
+              geoServiceRepository.save(geoService);
+            });
+
     CatalogNode featureSourceCatalogNode =
         new CatalogNode().id("feature_sources").title("Test feature sources");
     rootCatalogNode.addChildrenItem(featureSourceCatalogNode.getId());
@@ -938,6 +980,7 @@ public void createTestConfiguration() throws Exception {
                             .childrenIds(
                                 List.of(
                                     "lyr:pdok-kadaster-bestuurlijkegebieden:Provinciegebied",
+                                    "lyr:bestuurlijkegebieden-proxied:Provinciegebied",
                                     "lyr:pdok-kadaster-bestuurlijkegebieden:Gemeentegebied",
                                     "lyr:snapshot-geoserver:postgis:begroeidterreindeel",
                                     "lyr:snapshot-geoserver:sqlserver:wegdeel",
@@ -953,6 +996,16 @@ public void createTestConfiguration() throws Exception {
                             .serviceId("pdok-kadaster-bestuurlijkegebieden")
                             .layerName("Provinciegebied")
                             .visible(true))
+                    // This is a layer from proxied service with auth that should also not be
+                    // visible, but it has a feature source attached, should also be denied for
+                    // features access and not be included in TOC
+                    .addLayerNodesItem(
+                        new AppTreeLayerNode()
+                            .objectType("AppTreeLayerNode")
+                            .id("lyr:bestuurlijkegebieden-proxied:Provinciegebied")
+                            .serviceId("bestuurlijkegebieden-proxied")
+                            .layerName("Provinciegebied")
+                            .visible(false))
                     .addLayerNodesItem(
                         new AppTreeLayerNode()
                             .objectType("AppTreeLayerNode")

src/test/java/org/tailormap/api/controller/ViewerControllerIntegrationTest.java

@@ -12,6 +12,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.print;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
@@ -146,13 +147,54 @@ void should_contain_proxy_url() throws Exception {
       username = "tm-admin",
       authorities = {"admin"})
   @SuppressWarnings("PMD.JUnitTestsShouldIncludeAssert")
-  void should_not_contain_proxied_secured_service_layer() throws Exception {
+  void should_contain_proxied_secured_service_layer() throws Exception {
     final String path = apiBasePath + "/app/secured/map";
     mockMvc
         .perform(get(path).accept(MediaType.APPLICATION_JSON).with(setServletPath(path)))
         .andExpect(status().isOk())
         .andExpect(content().contentType(MediaType.APPLICATION_JSON))
-        .andExpect(jsonPath("$.services[?(@.title == 'Openbasiskaart (proxied)')]").exists());
+        .andExpect(jsonPath("$.appLayers[?(@.id == 'lyr:openbasiskaart-proxied:osm')]").exists())
+        .andExpect(jsonPath("$.services[?(@.id == 'openbasiskaart-proxied')]").exists());
+  }
+
+  @Test
+  @SuppressWarnings("PMD.JUnitTestsShouldIncludeAssert")
+  void should_not_contain_proxied_secured_service_layer_on_public_app() throws Exception {
+    final String path = apiBasePath + "/app/default/map";
+    mockMvc
+        .perform(get(path).accept(MediaType.APPLICATION_JSON).with(setServletPath(path)))
+        .andExpect(status().isOk())
+        .andExpect(content().contentType(MediaType.APPLICATION_JSON))
+        .andExpect(
+            jsonPath("$.appLayers[?(@.id == 'lyr:openbasiskaart-proxied:osm')]").doesNotExist())
+        .andExpect(jsonPath("$.services[?(@.id == 'openbasiskaart-proxied')]").doesNotExist())
+        .andExpect(
+            jsonPath("$.appLayers[?(@.id == 'lyr:bestuurlijkegebieden-proxied:Provinciegebied')]")
+                .doesNotExist())
+        .andExpect(
+            jsonPath("$.services[?(@.id == 'bestuurlijkegebieden-proxied')]").doesNotExist());
+  }
+
+  @Test
+  @WithMockUser(
+      username = "tm-admin",
+      authorities = {"admin"})
+  @SuppressWarnings("PMD.JUnitTestsShouldIncludeAssert")
+  void should_not_contain_proxied_secured_service_layer_on_public_app_even_when_authorized()
+      throws Exception {
+    final String path = apiBasePath + "/app/default/map";
+    mockMvc
+        .perform(get(path).accept(MediaType.APPLICATION_JSON).with(setServletPath(path)))
+        .andExpect(status().isOk())
+        .andExpect(content().contentType(MediaType.APPLICATION_JSON))
+        .andExpect(
+            jsonPath("$.appLayers[?(@.id == 'lyr:openbasiskaart-proxied:osm')]").doesNotExist())
+        .andExpect(jsonPath("$.services[?(@.id == 'openbasiskaart-proxied')]").doesNotExist())
+        .andExpect(
+            jsonPath("$.appLayers[?(@.id == 'lyr:bestuurlijkegebieden-proxied:Provinciegebied')]")
+                .doesNotExist())
+        .andExpect(
+            jsonPath("$.services[?(@.id == 'bestuurlijkegebieden-proxied')]").doesNotExist());
   }
 
   @Test
@@ -179,14 +221,15 @@ void should_return_data_for_configured_app() throws Exception {
     final String path = apiBasePath + "/app/default/map";
     mockMvc
         .perform(get(path).accept(MediaType.APPLICATION_JSON).with(setServletPath(path)))
+        .andDo(print())
         .andExpect(status().isOk())
         .andExpect(content().contentType(MediaType.APPLICATION_JSON))
         .andExpect(jsonPath("$.initialExtent").isMap())
         .andExpect(jsonPath("$.maxExtent").isMap())
         .andExpect(jsonPath("$.services").isArray())
         .andExpect(jsonPath("$.appLayers").isArray())
         .andExpect(jsonPath("$.appLayers[0]").isMap())
-        .andExpect(jsonPath("$.appLayers.length()").value(14))
+        .andExpect(jsonPath("$.appLayers.length()").value(19))
         .andExpect(jsonPath("$.appLayers[0].hasAttributes").value(false))
         .andExpect(jsonPath("$.appLayers[1].hasAttributes").value(false))
         .andExpect(jsonPath("$.appLayers[4].legendImageUrl").isEmpty())