Error Handling¶

@RestControllerAdvice
public class ApiExceptionHandler {

    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ErrorResponse> handleAccessDenied(
            AccessDeniedException ex, HttpServletRequest request) {

        ErrorResponse error = ErrorResponse.builder()
            .timestamp(Instant.now())
            .status(HttpStatus.FORBIDDEN.value())
            .error("Access Denied")
            .message("You don't have permission to access this resource")
            .path(request.getRequestURI())
            .build();

        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
    }

    @ExceptionHandler(AuthenticationException.class)
    public ResponseEntity<ErrorResponse> handleAuthenticationException(
            AuthenticationException ex, HttpServletRequest request) {

        ErrorResponse error = ErrorResponse.builder()
            .timestamp(Instant.now())
            .status(HttpStatus.UNAUTHORIZED.value())
            .error("Unauthorized")
            .message("Authentication required")
            .path(request.getRequestURI())
            .build();

        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
    }
}

@Component
public class CustomAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request,
                       HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException {

        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.setContentType("application/json");

        ErrorResponse error = ErrorResponse.builder()
            .timestamp(Instant.now())
            .status(403)
            .error("Access Denied")
            .message("You don't have permission to access this resource")
            .path(request.getRequestURI())
            .details(Map.of(
                "user", request.getRemoteUser(),
                "requiredAuthority", extractRequiredAuthority(request),
                "userAuthorities", getCurrentUserAuthorities()
            ))
            .build();

        ObjectMapper mapper = new ObjectMapper();
        response.getWriter().write(mapper.writeValueAsString(error));
    }
}

@Service
public class ApiClient {

    private final RestTemplate restTemplate;

    public ApiClient(RestTemplate restTemplate) {
        this.restTemplate = restTemplate;

        // Configure error handling
        restTemplate.setErrorHandler(new CustomResponseErrorHandler());
    }

    public <T> T makeRequest(String url, Class<T> responseType) {
        try {
            HttpHeaders headers = new HttpHeaders();
            headers.setBearerAuth(getJwtToken());
            HttpEntity<?> entity = new HttpEntity<>(headers);

            ResponseEntity<T> response = restTemplate.exchange(
                url, HttpMethod.GET, entity, responseType);

            return response.getBody();

        } catch (HttpClientErrorException ex) {
            handleClientError(ex);
            throw ex;
        } catch (HttpServerErrorException ex) {
            handleServerError(ex);
            throw ex;
        }
    }

    private void handleClientError(HttpClientErrorException ex) {
        if (ex.getStatusCode() == HttpStatus.UNAUTHORIZED) {
            // Handle authentication error
            log.warn("Authentication failed: {}", ex.getResponseBodyAsString());
        } else if (ex.getStatusCode() == HttpStatus.FORBIDDEN) {
            // Handle authorization error
            log.warn("Access denied: {}", ex.getResponseBodyAsString());
        }
    }
}

static class CustomResponseErrorHandler implements ResponseErrorHandler {

    @Override
    public boolean hasError(ClientHttpResponse response) throws IOException {
        return response.getStatusCode().is4xxClientError() || 
               response.getStatusCode().is5xxServerError();
    }

    @Override
    public void handleError(ClientHttpResponse response) throws IOException {
        String body = StreamUtils.copyToString(
            response.getBody(), StandardCharsets.UTF_8);

        ErrorResponse error = objectMapper.readValue(body, ErrorResponse.class);

        if (response.getStatusCode().is4xxClientError()) {
            throw new ApiClientException(error);
        } else {
            throw new ApiServerException(error);
        }
    }
}

@Test
void shouldReturn401WhenNoAuthenticationProvided() throws Exception {
    mockMvc.perform(get("/api/admin/secure"))
        .andExpect(status().isUnauthorized())
        .andExpected(jsonPath("$.status").value(401))
        .andExpected(jsonPath("$.error").value("Unauthorized"))
        .andExpect(jsonPath("$.message").value("Authentication required"))
        .andExpect(jsonPath("$.path").value("/api/admin/secure"));
}

@Test
void shouldReturn403WhenInsufficientRole() throws Exception {
    mockMvc.perform(get("/api/admin/secure")
            .with(jwt().authorities(new SimpleGrantedAuthority("ROLE_USER"))))
        .andExpect(status().isForbidden())
        .andExpected(jsonPath("$.status").value(403))
        .andExpect(jsonPath("$.error").value("Access Denied"));
}

@Test  
void shouldReturn400WhenInvalidLoginParameters() throws Exception {
    mockMvc.perform(post("/api/auth/login")
            .contentType(MediaType.APPLICATION_FORM_URLENCODED)
            .param("username", "")
            .param("password", ""))
        .andExpect(status().isBadRequest())
        .andExpected(jsonPath("$.status").value(400))
        .andExpected(jsonPath("$.details.validationErrors").isArray());
}

@Test
void shouldHandleJwtTokenExpiry() {
    // Create expired JWT token
    String expiredToken = jwtUtil.generateExpiredToken("user", "ROLE_USER");

    // Make request with expired token
    ResponseEntity<Map> response = restTemplate.exchange(
        "/api/user/secure",
        HttpMethod.GET,
        new HttpEntity<>(createAuthHeaders(expiredToken)),
        Map.class
    );

    // Verify error response
    assertThat(response.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
    assertThat(response.getBody().get("error")).isEqualTo("Unauthorized");
    assertThat(response.getBody().get("details"))
        .extracting("tokenStatus")
        .isEqualTo("EXPIRED");
}