actuator tests

Author: aschey-forpeople

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/Configuration.java

@@ -37,6 +37,8 @@ public class Configuration {
           "/v3/fhir/swagger-ui/*",
           "/v3/fhir/api-docs",
           "/actuator",
+          // We can allow the basic health endpoint, but other actuator endpoints may show
+          // things we don't want to expose, so /actuator/* should not be allowed
           "/actuator/health",
           "/actuator/health/*",
           "/favicon.ico");

apps/bfd-server-ng/src/test/java/gov/cms/bfd/server/ng/AuthenticationFilterTest.java

@@ -31,7 +31,14 @@ public class AuthenticationFilterTest {
   @Mock FilterChain filterChain;
 
   @ParameterizedTest
-  @ValueSource(strings = {"/favicon.ico", "/v3/fhir/swagger-ui", "/v3/fhir/swagger-ui/style.css"})
+  @ValueSource(
+      strings = {
+        "/favicon.ico",
+        "/v3/fhir/swagger-ui",
+        "/v3/fhir/swagger-ui/",
+        "/v3/fhir/swagger-ui/style.css",
+        "/actuator/health"
+      })
   void testAllowedPaths(String path) throws ServletException, IOException {
     when(environment.getActiveProfiles()).thenReturn(new String[] {"aws"});
     when(request.getRequestURI()).thenReturn(path);
@@ -42,7 +49,7 @@ void testAllowedPaths(String path) throws ServletException, IOException {
   }
 
   @ParameterizedTest
-  @ValueSource(strings = {"/v3/fhir/Patient"})
+  @ValueSource(strings = {"/v3/fhir/Patient", "/actuator/random"})
   void testNotAllowedPaths(String path) throws ServletException, IOException {
     when(environment.getActiveProfiles()).thenReturn(new String[] {"aws"});
     when(request.getRequestURI()).thenReturn(path);