#120: DataTransferPublicAccessTest.kt

Integration test for the public (external) DataTransfer REST layer — the most comprehensive DataTransfer test at 227 lines. Tests the anonymous access flow: external link → login → upload/download/delete → logout, using mocked HTTP requests and JCR files.

Components under test

• DataTransferPublicSession (#101) — session management, brute-force protection
• DataTransferPublicPageRest — returns page layout JSON for the anonymous React UI
• DataTransferPublicServicesRest (#100) — upload, download, delete, multiDownload endpoints
• LoginProtection — brute-force time offset enforcement

Test scenarios (~10 test methods)

• Login with valid credentials: creates an area with external_download_enabled=true, externalAccessToken, externalPassword, calls DataTransferPublicSession.login() — verifies session contains area data
• Login with wrong password: verifies LoginProtection increments failed attempts, and after repeated failures the time offset kicks in
• Brute-force lockout: after enough failures, login() returns LOGIN_TIME_OFFSET status — verified by calling login 3+ times faster than the offset window
• Personal box excluded from public access: isPersonalBox() areas always return LoginResultStatus.FAILED — the paranoia check in checkDataBaseEntry()
• Upload: mocks MultipartFile (Spring's uploaded file wrapper), calls upload REST endpoint, verifies file ID appears in ownedFiles list
• Download: uploads a file as external user, then downloads it — verifies InputStreamResource content matches
• Delete own file: verifies isOwnerOfFile() returns true, and delete succeeds
• Cannot delete someone else's file: external user2 tries to delete user1's upload — verifies isOwnerOfFile() returns false
• Multi-download: upload 3 files, download all as ZIP — verifies ZipInputStream contains all 3 entries
• Session fixation: verifies that after login, the JSESSIONID changes (old session invalidated, new session created with transferred area data)

Mocked HTTP layer

Uses Mockito to mock HttpServletRequest and HttpSession — critical because DataTransferPublicSession stores data directly in HTTP session attributes. The mock session simulates getSession(false), getSession(true), getAttribute("transferAreas"), setAttribute(), and invalidate() — all exercised in the session fixation test.

Also mocks MultipartFile for upload tests and HttpServletResponse + ServletOutputStream → ByteArrayOutputStream for download content capture.