fix(security): authenticate artifact token before object lookup

src/main/java/com/clearfolio/viewer/controller/ArtifactController.java

@@ -136,6 +136,11 @@ public Mono<ResponseEntity<byte[]>> getPdf(
             @RequestParam(value = ArtifactLinkService.ARTIFACT_TOKEN_PARAM, required = false) String queryToken,
             @RequestHeader(value = HttpHeaders.AUTHORIZATION, required = false) String authorizationHeader,
             @RequestHeader(value = "X-Request-Id", required = false) String traceId) {
+        String token = ArtifactLinkService.resolveToken(queryToken, authorizationHeader);
+        if (token == null) {
+            return Mono.just(ArtifactHttpResponse.tokenFailure(HttpStatus.UNAUTHORIZED));
+        }
+
         Optional<ConversionJob> job = conversionService.getJob(docId);
         if (job.isEmpty() || job.get().getStatus() != ConversionJobStatus.SUCCEEDED) {
             return Mono.just(ResponseEntity.status(HttpStatus.NOT_FOUND).build());
@@ -147,7 +152,6 @@ public Mono<ResponseEntity<byte[]>> getPdf(
         }
 
         byte[] pdfBytes = stored.get();
-        String token = ArtifactLinkService.resolveToken(queryToken, authorizationHeader);
         ArtifactTokenClaims claims;
         try {
             claims = artifactLinkService.verifyReadToken(docId, job.get(), pdfBytes, token);

src/test/java/com/clearfolio/viewer/controller/ArtifactControllerTest.java

@@ -53,7 +53,7 @@ void returnsNotFoundWhenJobMissing() {
         when(conversionService.getJob(docId)).thenReturn(Optional.empty());
 
         webTestClient.get()
-                .uri("/artifacts/{docId}.pdf", docId)
+                .uri("/artifacts/{docId}.pdf?artifactToken=opaque-present-token", docId)
                 .exchange()
                 .expectStatus().isNotFound();
     }
@@ -72,7 +72,7 @@ void returnsNotFoundWhenJobIsNotSucceeded() {
         when(conversionService.getJob(docId)).thenReturn(Optional.of(job));
 
         webTestClient.get()
-                .uri("/artifacts/{docId}.pdf", docId)
+                .uri("/artifacts/{docId}.pdf?artifactToken=opaque-present-token", docId)
                 .exchange()
                 .expectStatus().isNotFound();
     }
@@ -84,7 +84,7 @@ void returnsNotFoundWhenArtifactIsMissing() {
         when(conversionService.getJob(docId)).thenReturn(Optional.of(job));
 
         webTestClient.get()
-                .uri("/artifacts/{docId}.pdf", docId)
+                .uri("/artifacts/{docId}.pdf?artifactToken=opaque-present-token", docId)
                 .exchange()
                 .expectStatus().isNotFound();
     }

src/test/java/com/clearfolio/viewer/controller/ArtifactControllerTokenPreconditionTest.java

@@ -0,0 +1,74 @@
+package com.clearfolio.viewer.controller;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verifyNoInteractions;
+
+import java.util.UUID;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+
+import com.clearfolio.viewer.artifact.ArtifactLinkService;
+import com.clearfolio.viewer.artifact.ArtifactStore;
+import com.clearfolio.viewer.auth.TenantAccessService;
+import com.clearfolio.viewer.service.DocumentConversionService;
+
+/**
+ * Proves that the public artifact route authenticates token presence before
+ * reading conversion-job or artifact state that could become an existence oracle.
+ */
+class ArtifactControllerTokenPreconditionTest {
+
+    @Test
+    void missingArtifactTokenIsRejectedBeforeSensitiveObjectLookup() {
+        DocumentConversionService conversionService = mock(DocumentConversionService.class);
+        ArtifactStore artifactStore = mock(ArtifactStore.class);
+        ArtifactLinkService artifactLinkService = mock(ArtifactLinkService.class);
+        ArtifactController controller = new ArtifactController(
+                conversionService,
+                artifactStore,
+                artifactLinkService,
+                mock(TenantAccessService.class)
+        );
+
+        ResponseEntity<byte[]> response = controller.getPdf(
+                UUID.randomUUID(),
+                null,
+                null,
+                null,
+                null
+        ).block();
+
+        assertNotNull(response);
+        assertEquals(HttpStatus.UNAUTHORIZED, response.getStatusCode());
+        verifyNoInteractions(conversionService, artifactStore, artifactLinkService);
+    }
+
+    @Test
+    void unsupportedAuthorizationSchemeIsRejectedBeforeSensitiveObjectLookup() {
+        DocumentConversionService conversionService = mock(DocumentConversionService.class);
+        ArtifactStore artifactStore = mock(ArtifactStore.class);
+        ArtifactLinkService artifactLinkService = mock(ArtifactLinkService.class);
+        ArtifactController controller = new ArtifactController(
+                conversionService,
+                artifactStore,
+                artifactLinkService,
+                mock(TenantAccessService.class)
+        );
+
+        ResponseEntity<byte[]> response = controller.getPdf(
+                UUID.randomUUID(),
+                null,
+                "   ",
+                "Basic opaque-credential",
+                null
+        ).block();
+
+        assertNotNull(response);
+        assertEquals(HttpStatus.UNAUTHORIZED, response.getStatusCode());
+        verifyNoInteractions(conversionService, artifactStore, artifactLinkService);
+    }
+}