Skip to content

Host validation test cases - #14224

Open
JanithaSampathBandara wants to merge 7 commits into
wso2:masterfrom
JanithaSampathBandara:host-validation-test-cases
Open

Host validation test cases#14224
JanithaSampathBandara wants to merge 7 commits into
wso2:masterfrom
JanithaSampathBandara:host-validation-test-cases

Conversation

@JanithaSampathBandara

Copy link
Copy Markdown

Purpose

This PR adds product-level integration test coverage for outbound network access control and destination validation functionality.

Goals

  • Validate platform-level access control behavior
  • Validate tenant-level access control behavior
  • Validate private network access restrictions
  • Validate configuration precedence behavior
  • Validate supported URL validation entry points

Approach

Added integration test coverage for:

  • Platform allow mode validation
  • Platform deny mode validation
  • Tenant access control validation
  • Private network access restrictions
  • Configuration precedence validation
  • Host and destination matching behavior

Testing

Verified:

  • All newly added integration tests pass
  • Platform access control behavior works as expected
  • Tenant access control behavior works as expected
  • Private network restrictions work as expected
  • Configuration precedence is enforced correctly

Release Note

Added integration test coverage for outbound network access control and destination validation functionality.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


JanithaSampathBandara seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@coderabbitai

coderabbitai Bot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c24cbae4-1f07-432c-a015-54bbc5445ec0

📥 Commits

Reviewing files that changed from the base of the PR and between e6df4b8 and c169a7a.

📒 Files selected for processing (2)
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationDisabledTestCase.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationTenantAllowModeTestCase.java
🚧 Files skipped from review as they are similar to previous changes (2)
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationDisabledTestCase.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationTenantAllowModeTestCase.java

📝 Walkthrough

Walkthrough

Adds test helper wrappers and comprehensive integration test suites, cases, TOML deployment profiles, and test resources to validate host/network-access rules across platform allow mode, private-block mode, disabled mode, and tenant allow mode.

Changes

Host Validation Integration Tests

Layer / File(s) Summary
Test helper methods
RestAPIAdminImpl.java, RestAPIPublisherImpl.java
Added discoverKeyManager(url, type), validateEndpointRaw(endpointUrl, apiId), and validateOASDefinitionByURL(url) delegation methods to expose raw validation API responses.
Allow mode tests
HostValidationAllowModeTestSuite.java, HostValidationAllowModeTestCase.java, hostValidationAllowModeBpnaEnabled/deployment.toml, testng.xml
Platform-level allow mode is configured and tests verify that non-platform-listed and private IP URLs are blocked while platform rules take precedence over tenant settings.
Disabled mode tests
HostValidationDisabledTestSuite.java, HostValidationDisabledTestCase.java, hostValidationDisabled/deployment.toml, testng.xml
Host validation disabled configuration is applied and test validates that endpoint and private IP validation succeed without "not trusted" blocking errors.
Private block mode tests
HostValidationPrivateBlockTestSuite.java, HostValidationPrivateBlockTestCase.java, hostValidationPrivateBlock/deployment.toml, testng.xml
Private network blocking configuration rejects loopback and link-local addresses across endpoint validation, key manager operations, and WSDL import surfaces with "not trusted" errors.
Tenant allow mode tests
HostValidationTenantAllowModeTestSuite.java, HostValidationTenantAllowModeTestCase.java, hostValidationTenantAllowMode/deployment.toml, testng.xml
Tenant-level allow mode configuration enables extensive coverage of endpoint validation, key manager lifecycle, API/MCP server creation and updates, import flows (OpenAPI, AsyncAPI, GraphQL), and tenant isolation behavior.
Test resources
hv-test-asyncapi.yaml, hv-test-graphql.graphql, hv-test-openapi.yaml
Test API definitions (AsyncAPI WebSocket, GraphQL Query, OpenAPI endpoint) used across host validation test scenarios.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 3.39% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title 'Host validation test cases' accurately describes the primary change—adding comprehensive integration test coverage for host validation functionality across multiple test scenarios and modes.
Description check ✅ Passed The description is well-structured and clearly related to the changeset, detailing the purpose (testing outbound network access control), goals (platform/tenant validation, private network restrictions), approach (integration test coverage), and verification that tests pass.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationDisabledTestCase.java`:
- Around line 45-51: The test uses a fixed API name when constructing the
APIRequest which can cause restAPIPublisher.addAPI(...) to return null on name
collisions and lead to a null dereference when assigning apiId; change the
APIRequest creation in HostValidationDisabledTestCase to use a unique name
(e.g., append a timestamp or UUID to "HostValidationDisabledTestAPI") and add a
null check/assert after restAPIPublisher.addAPI(apiRequest) before assigning
apiId to fail fast with a clear message if the API creation returned null.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0dbc664f-cf38-4d79-afbd-4fec1a06dec1

📥 Commits

Reviewing files that changed from the base of the PR and between d93cf8e and e6df4b8.

⛔ Files ignored due to path filters (3)
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/hostValidationResources/hv-test-api-blocked.zip is excluded by !**/*.zip
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/hostValidationResources/hv-test-mcp-blocked.zip is excluded by !**/*.zip
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/hostValidationResources/hv-test-mcp-valid.zip is excluded by !**/*.zip
📒 Files selected for processing (18)
  • all-in-one-apim/modules/integration/tests-common/integration-test-utils/src/main/java/org/wso2/am/integration/test/impl/RestAPIAdminImpl.java
  • all-in-one-apim/modules/integration/tests-common/integration-test-utils/src/main/java/org/wso2/am/integration/test/impl/RestAPIPublisherImpl.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationAllowModeTestCase.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationAllowModeTestSuite.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationDisabledTestCase.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationDisabledTestSuite.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationPrivateBlockTestCase.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationPrivateBlockTestSuite.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationTenantAllowModeTestCase.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/java/org/wso2/am/integration/tests/other/HostValidationTenantAllowModeTestSuite.java
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/configFiles/hostValidationAllowModeBpnaEnabled/deployment.toml
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/configFiles/hostValidationDisabled/deployment.toml
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/configFiles/hostValidationPrivateBlock/deployment.toml
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/configFiles/hostValidationTenantAllowMode/deployment.toml
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/hostValidationResources/hv-test-asyncapi.yaml
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/hostValidationResources/hv-test-graphql.graphql
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/artifacts/AM/hostValidationResources/hv-test-openapi.yaml
  • all-in-one-apim/modules/integration/tests-integration/tests-backend/src/test/resources/testng.xml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants