From 0ed2efbbcb09cc9cd0a4ef6e41437dff0e0adc1d Mon Sep 17 00:00:00 2001 From: labkey-matthewb Date: Thu, 10 Sep 2026 12:00:34 -0700 Subject: [PATCH] consistent use of getGuestUser() --- src/org/labkey/test/tests/SecurityTest.java | 12 ++++++++++++ src/org/labkey/test/util/SimpleHttpResponse.java | 5 ++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/src/org/labkey/test/tests/SecurityTest.java b/src/org/labkey/test/tests/SecurityTest.java index 14e007db89..f92ca16c05 100644 --- a/src/org/labkey/test/tests/SecurityTest.java +++ b/src/org/labkey/test/tests/SecurityTest.java @@ -306,8 +306,20 @@ protected void guestTest() @LogMethod protected void disableGuestAccountTest() { + // Guests hold Reader on the project, so the API is reachable as guest until the account is disabled + new ApiPermissionsHelper(this).setSiteGroupPermissions("Guests", READER_ROLE); + String apiUrl = buildURL("query", getProjectName(), "getSchemas"); + checker().verifyEquals("Basic auth as 'guest' should succeed while guest account is enabled", + HttpStatus.SC_OK, getHttpResponse(apiUrl, "guest", "guest").getResponseCode()); + OptionalFeatureHelper.setOptionalFeature(createDefaultConnection(), "disableGuestAccount", true); + checker().verifyEquals("Anonymous API request should be rejected when guest account is disabled", + HttpStatus.SC_UNAUTHORIZED, getHttpResponse(apiUrl, "GET", null, null, null).getResponseCode()); + // Basic auth with the reserved "guest" username must not resurrect the guest account + checker().verifyEquals("Basic auth as 'guest' should be rejected when guest account is disabled", + HttpStatus.SC_UNAUTHORIZED, getHttpResponse(apiUrl, "guest", "guest").getResponseCode()); + goToHome(); signOut(); diff --git a/src/org/labkey/test/util/SimpleHttpResponse.java b/src/org/labkey/test/util/SimpleHttpResponse.java index f777271d1d..f25f07e9fa 100644 --- a/src/org/labkey/test/util/SimpleHttpResponse.java +++ b/src/org/labkey/test/util/SimpleHttpResponse.java @@ -18,6 +18,7 @@ import org.labkey.test.TestFileUtils; import java.io.IOException; +import java.io.InputStream; import java.net.HttpURLConnection; import java.util.HashMap; import java.util.List; @@ -43,7 +44,9 @@ static SimpleHttpResponse readResponse(HttpURLConnection con) throws IOException } catch (IOException error) { - response.responseBody = TestFileUtils.getStreamContentsAsString(con.getErrorStream()); + // Error stream is null after a failed Basic auth retry + InputStream errorStream = con.getErrorStream(); + response.responseBody = errorStream == null ? "" : TestFileUtils.getStreamContentsAsString(errorStream); } response.responseHeaderFields = new HashMap<>(con.getHeaderFields());