Sign upLogin

CMSgov/dpc-app

View on GitHub
Star
dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java

Summary

Maintainability
B
5 hrs
Test Coverage

File APIAuthHelpers.java has 382 lines of code (exceeds 250 allowed). Consider refactoring.
Wontfix

package gov.cms.dpc.testing;

import ca.uhn.fhir.context.FhirContext;
import ca.uhn.fhir.rest.client.api.IClientInterceptor;
import ca.uhn.fhir.rest.client.api.IGenericClient;
Severity: Minor
Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 5 hrs to fix

    APIAuthHelpers has 23 methods (exceeds 20 allowed). Consider refactoring.
    Wontfix

    public class APIAuthHelpers {
    public static final String TASK_URL = "http://localhost:9900/tasks/";
    public static final String KEY_VERIFICATION_SNIPPET = "This is the snippet used to verify a key pair in DPC.";
    private static final String CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
    private static final ObjectMapper mapper = new ObjectMapper();
    Severity: Minor
    Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 2 hrs to fix

      Method jwtAuthFlow has 42 lines of code (exceeds 25 allowed). Consider refactoring.
      Wontfix

          public static AuthResponse jwtAuthFlow(String baseURL, String macaroon, UUID keyID, PrivateKey privateKey) throws IOException, URISyntaxException {
        /* TODO revert this workaround to previous version of code
         * - git diff f2d3abe1f23e4d1ad2f2a01 5d799c57712418de674 <<< green is good
         * see also https://github.com/CMSgov/dpc-app/pull/849
         */
      Severity: Minor
      Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 1 hr to fix

        Method buildAuthenticatedClient has 7 arguments (exceeds 4 allowed). Consider refactoring.
        Wontfix

            public static IGenericClient buildAuthenticatedClient(FhirContext ctx, String baseURL, String macaroon, UUID keyID, PrivateKey privateKey, boolean disableSSLCheck, boolean enableRequestLog) {
        Severity: Major
        Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 50 mins to fix

          Method getTrustingManager has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring.
          Open

              private static TrustManager[] getTrustingManager() {
        return new TrustManager[]{new X509TrustManager() {
            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return null;
          Severity: Minor
          Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 45 mins to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          Method buildAuthenticatedClient has 6 arguments (exceeds 4 allowed). Consider refactoring.
          Wontfix

              public static IGenericClient buildAuthenticatedClient(FhirContext ctx, String baseURL, String macaroon, UUID keyID, PrivateKey privateKey, boolean disableSSLCheck) {
          Severity: Minor
          Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 45 mins to fix

            Method buildAdminClient has 5 arguments (exceeds 4 allowed). Consider refactoring.
            Wontfix

                public static IGenericClient buildAdminClient(FhirContext ctx, String baseURL, String macaroon, boolean disableSSLCheck, boolean enableRequestLog) {
            Severity: Minor
            Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 35 mins to fix

              Method buildAuthenticatedClient has 5 arguments (exceeds 4 allowed). Consider refactoring.
              Wontfix

                  public static IGenericClient buildAuthenticatedClient(FhirContext ctx, String baseURL, String macaroon, UUID keyID, PrivateKey privateKey) {
              Severity: Minor
              Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java - About 35 mins to fix

                Replace this use of System.out or System.err by a logger.
                Open

                            System.out.println("Refreshing access token");
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                When logging a message there are several important requirements which must be fulfilled:

                • The user must be able to easily retrieve the logs
                • The format of all logged message must be uniform to allow the user to easily read the log
                • Logged data must actually be recorded
                • Sensitive data must only be logged securely

                If a program directly writes to the standard outputs, there is absolutely no way to comply with those requirements. That's why defining and using a dedicated logger is highly recommended.

                Noncompliant Code Example

                System.out.println("My Message");  // Noncompliant

                Compliant Solution

                logger.log("My Message");

                See

                Replace this use of System.out or System.err by a logger.
                Open

                            System.out.println("Refreshing access token");
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                When logging a message there are several important requirements which must be fulfilled:

                • The user must be able to easily retrieve the logs
                • The format of all logged message must be uniform to allow the user to easily read the log
                • Logged data must actually be recorded
                • Sensitive data must only be logged securely

                If a program directly writes to the standard outputs, there is absolutely no way to comply with those requirements. That's why defining and using a dedicated logger is highly recommended.

                Noncompliant Code Example

                System.out.println("My Message");  // Noncompliant

                Compliant Solution

                logger.log("My Message");

                See

                Return an empty array instead of null.
                Open

                                return null;
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                Returning null instead of an actual array or collection forces callers of the method to explicitly test for nullity, making them more complex and less readable.

                Moreover, in many cases, null is used as a synonym for empty.

                Noncompliant Code Example

                public static List<Result> getResults() {
  return null;                             // Noncompliant
}

public static Result[] getResults() {
  return null;                             // Noncompliant
}

public static void main(String[] args) {
  Result[] results = getResults();

  if (results != null) {                   // Nullity test required to prevent NPE
    for (Result result: results) {
      /* ... */
    }
  }
}

                Compliant Solution

                public static List<Result> getResults() {
  return Collections.emptyList();          // Compliant
}

public static Result[] getResults() {
  return new Result[0];
}

public static void main(String[] args) {
  for (Result result: getResults()) {
    /* ... */
  }
}

                See

                • CERT, MSC19-C. - For functions that return an array, prefer returning an empty array over a null value
                • CERT, MET55-J. - Return an empty array or collection instead of a null value for methods that return an array or collection

                Define and throw a dedicated exception instead of using a generic one.
                Open

                                throw new RuntimeException("Cannot create custom SSL context", e);
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                Using such generic exceptions as Error, RuntimeException, Throwable, and Exception prevents calling methods from handling true, system-generated exceptions differently than application-generated errors.

                Noncompliant Code Example

                public void foo(String bar) throws Throwable {  // Noncompliant
  throw new RuntimeException("My Message");     // Noncompliant
}

                Compliant Solution

                public void foo(String bar) {
  throw new MyOwnRuntimeException("My Message");
}

                Exceptions

                Generic exceptions in the signatures of overriding methods are ignored, because overriding method has to follow signature of the throw declaration in the superclass. The issue will be raised on superclass declaration of the method (or won't be raised at all if superclass is not part of the analysis).

                @Override
public void myMethod() throws Exception {...}

                Generic exceptions are also ignored in the signatures of methods that make calls to methods that throw generic exceptions.

                public void myOtherMethod throws Exception {
  doTheThing();  // this method throws Exception
}

                See

                Define a constant instead of duplicating this literal "Bearer " 3 times.
                Open

                        post.setHeader(HttpHeaders.AUTHORIZATION, "Bearer " + macaroon);
                Severity: Critical
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                Duplicated string literals make the process of refactoring error-prone, since you must be sure to update all occurrences.

                On the other hand, constants can be referenced from many places, but only need to be updated in a single place.

                Noncompliant Code Example

                With the default threshold of 3:

                public void run() {
  prepare("action1");                              // Noncompliant - "action1" is duplicated 3 times
  execute("action1");
  release("action1");
}

@SuppressWarning("all")                            // Compliant - annotations are excluded
private void method1() { /* ... */ }
@SuppressWarning("all")
private void method2() { /* ... */ }

public String method3(String a) {
  System.out.println("'" + a + "'");               // Compliant - literal "'" has less than 5 characters and is excluded
  return "";                                       // Compliant - literal "" has less than 5 characters and is excluded
}

                Compliant Solution

                private static final String ACTION_1 = "action1";  // Compliant

public void run() {
  prepare(ACTION_1);                               // Compliant
  execute(ACTION_1);
  release(ACTION_1);
}

                Exceptions

                To prevent generating some false-positives, literals having less than 5 characters are excluded.

                Use static access with "java.util.Date" for "from".
                Open

                                .setExpiration(Date.from(Instant.now().plus(5, ChronoUnit.MINUTES).minus(30, ChronoUnit.SECONDS)))
                Severity: Critical
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                In the interest of code clarity, static members of a base class should never be accessed using a derived type's name. Doing so is confusing and could create the illusion that two different static members exist.

                Noncompliant Code Example

                class Parent {
  public static int counter;
}

class Child extends Parent {
  public Child() {
    Child.counter++;  // Noncompliant
  }
}

                Compliant Solution

                class Parent {
  public static int counter;
}

class Child extends Parent {
  public Child() {
    Parent.counter++;
  }
}

                %n should be used in place of \n to produce the platform-specific line separator.
                Open

                        return String.format("-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----\n", encoded);
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java by sonar-java

                Because printf-style format strings are interpreted at runtime, rather than validated by the compiler, they can contain errors that result in the wrong strings being created. This rule statically validates the correlation of printf-style format strings to their arguments when calling the format(...) methods of java.util.Formatter, java.lang.String, java.io.PrintStream, MessageFormat, and java.io.PrintWriter classes and the printf(...) methods of java.io.PrintStream or java.io.PrintWriter classes.

                Noncompliant Code Example

                String.format("First {0} and then {1}", "foo", "bar");  //Noncompliant. Looks like there is a confusion with the use of {{java.text.MessageFormat}}, parameters "foo" and "bar" will be simply ignored here
String.format("Display %3$d and then %d", 1, 2, 3);   //Noncompliant; the second argument '2' is unused
String.format("Too many arguments %d and %d", 1, 2, 3);  //Noncompliant; the third argument '3' is unused
String.format("First Line\n");   //Noncompliant; %n should be used in place of \n to produce the platform-specific line separator
String.format("Is myObject null ? %b", myObject);   //Noncompliant; when a non-boolean argument is formatted with %b, it prints true for any nonnull value, and false for null. Even if intended, this is misleading. It's better to directly inject the boolean value (myObject == null in this case)
String.format("value is " + value); // Noncompliant
String s = String.format("string without arguments"); // Noncompliant

MessageFormat.format("Result '{0}'.", value); // Noncompliant; String contains no format specifiers. (quote are discarding format specifiers)
MessageFormat.format("Result {0}.", value, value);  // Noncompliant; 2nd argument is not used
MessageFormat.format("Result {0}.", myObject.toString()); // Noncompliant; no need to call toString() on objects

java.util.Logger logger;
logger.log(java.util.logging.Level.SEVERE, "Result {0}.", myObject.toString()); // Noncompliant; no need to call toString() on objects
logger.log(java.util.logging.Level.SEVERE, "Result.", new Exception()); // compliant, parameter is an exception
logger.log(java.util.logging.Level.SEVERE, "Result '{0}'", 14); // Noncompliant - String contains no format specifiers.
logger.log(java.util.logging.Level.SEVERE, "Result " + param, exception); // Noncompliant; Lambda should be used to differ string concatenation.

org.slf4j.Logger slf4jLog;
org.slf4j.Marker marker;

slf4jLog.debug(marker, "message {}");
slf4jLog.debug(marker, "message", 1); // Noncompliant - String contains no format specifiers.

org.apache.logging.log4j.Logger log4jLog;
log4jLog.debug("message", 1); // Noncompliant - String contains no format specifiers.

                Compliant Solution

                String.format("First %s and then %s", "foo", "bar");
String.format("Display %2$d and then %d", 1, 3);
String.format("Too many arguments %d %d", 1, 2);
String.format("First Line%n");
String.format("Is myObject null ? %b", myObject == null);
String.format("value is %d", value);
String s = "string without arguments";

MessageFormat.format("Result {0}.", value);
MessageFormat.format("Result '{0}'  =  {0}", value);
MessageFormat.format("Result {0}.", myObject);

java.util.Logger logger;
logger.log(java.util.logging.Level.SEVERE, "Result {0}.", myObject);
logger.log(java.util.logging.Level.SEVERE, "Result {0}'", 14);
logger.log(java.util.logging.Level.SEVERE, exception, () -> "Result " + param);

org.slf4j.Logger slf4jLog;
org.slf4j.Marker marker;

slf4jLog.debug(marker, "message {}");
slf4jLog.debug(marker, "message {}", 1);

org.apache.logging.log4j.Logger log4jLog;
log4jLog.debug("message {}", 1);

                See

                Identical blocks of code found in 2 locations. Consider refactoring.
                Open

                        private void refreshAuthToken() {
            System.out.println("Refreshing access token");
            try {
                final AuthResponse authResponse = jwtAuthFlow(this.baseURL, this.clientToken, this.keyID, this.privateKey);
                // Set the refresh time to be 30 seconds before expiration
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java and 1 other location - About 1 hr to fix
                dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java on lines 460..472

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 97.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Identical blocks of code found in 2 locations. Consider refactoring.
                Open

                        private void refreshAuthToken() {
            System.out.println("Refreshing access token");
            try {
                final AuthResponse authResponse = jwtAuthFlow(this.baseURL, this.clientToken, this.keyID, this.privateKey);
                // Set the refresh time to be 30 seconds before expiration
                Severity: Major
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java and 1 other location - About 1 hr to fix
                dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java on lines 417..429

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 97.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Identical blocks of code found in 2 locations. Consider refactoring.
                Open

                    public static class MacaroonsInterceptor implements IClientInterceptor {

        private String macaroon;

        public MacaroonsInterceptor(String macaroon) {
                Severity: Minor
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java and 1 other location - About 1 hr to fix
                dpc-common/src/main/java/gov/cms/dpc/fhir/helpers/FHIRHelpers.java on lines 144..169

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 69.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Similar blocks of code found in 2 locations. Consider refactoring.
                Wontfix

                        HAPISmartInterceptor(String baseURL, String clientToken, UUID keyID, PrivateKey privateKey) {
            this.baseURL = baseURL;
            this.clientToken = clientToken;
            this.keyID = keyID;
            this.privateKey = privateKey;
                Severity: Minor
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java and 1 other location - About 45 mins to fix
                dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java on lines 442..450

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 53.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Similar blocks of code found in 2 locations. Consider refactoring.
                Wontfix

                        HttpClientAuthInterceptor(String baseURL, String clientToken, UUID keyID, PrivateKey privateKey) {
            this.baseURL = baseURL;
            this.clientToken = clientToken;
            this.keyID = keyID;
            this.privateKey = privateKey;
                Severity: Minor
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java and 1 other location - About 45 mins to fix
                dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java on lines 389..397

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 53.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                Identical blocks of code found in 2 locations. Consider refactoring.
                Open

                        final String macaroon = MacaroonsBuilder
                .modify(MacaroonsBuilder.deserialize(goldenMacaroon).get(0))
                .add_first_party_caveat(String.format("organization_id = %s", organizationID))
                .getMacaroon().serialize(MacaroonVersion.SerializationVersion.V2_JSON);
                Severity: Minor
                Found in dpc-testing/src/main/java/gov/cms/dpc/testing/APIAuthHelpers.java and 1 other location - About 30 mins to fix
                dpc-smoketest/src/main/java/gov/cms/dpc/testing/smoketests/SmokeTest.java on lines 285..288

                Duplicated Code

                Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                Tuning

                This issue has a mass of 40.

                We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                Refactorings

                Further Reading

                There are no issues that match your filters.

                Category
                Status