From feced4a6573f7e2ff6f047f169debd0435cdbb14 Mon Sep 17 00:00:00 2001
From: Thomas Cederholm <thomas.cederholm@extendaretail.com>
Date: Mon, 18 May 2026 15:10:19 +0200
Subject: [PATCH] fix: Address Sonar feedback on security additions

- OpenApiServer: use record deconstruction pattern for
  SecurityScheme.Unsupported
- CredentialExtractor: rename unused catch binding to _
  (java22 unnamed pattern)
- SecurityBootValidationTest: hoist builder construction out of
  assertThatThrownBy lambdas so only build() can throw
---
 .../com/retailsvc/http/OpenApiServer.java     |  4 +--
 .../http/internal/CredentialExtractor.java    |  2 +-
 .../http/SecurityBootValidationTest.java      | 34 +++++++------------
 3 files changed, 16 insertions(+), 24 deletions(-)

diff --git a/src/main/java/com/retailsvc/http/OpenApiServer.java b/src/main/java/com/retailsvc/http/OpenApiServer.java
index bd0e069..550ecff 100644
--- a/src/main/java/com/retailsvc/http/OpenApiServer.java
+++ b/src/main/java/com/retailsvc/http/OpenApiServer.java
@@ -307,9 +307,9 @@ private static void validateSecurityWiring(Spec spec, Map<String, SchemeValidato
           throw new IllegalStateException(
               "security requirement references unknown scheme '" + name + "'");
         }
-        if (scheme instanceof SecurityScheme.Unsupported u) {
+        if (scheme instanceof SecurityScheme.Unsupported(String type)) {
           throw new IllegalStateException(
-              "scheme '" + name + "' uses unsupported type '" + u.type() + "'");
+              "scheme '" + name + "' uses unsupported type '" + type + "'");
         }
         if (!validators.containsKey(name)) {
           throw new IllegalStateException(
diff --git a/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java b/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java
index 9dee2a0..48b0b3b 100644
--- a/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java
+++ b/src/main/java/com/retailsvc/http/internal/CredentialExtractor.java
@@ -60,7 +60,7 @@ private static ExtractionResult extractBasic(HttpExchange exchange) {
     byte[] decoded;
     try {
       decoded = Base64.getDecoder().decode(parts[1]);
-    } catch (IllegalArgumentException e) {
+    } catch (IllegalArgumentException _) {
       return ExtractionResult.malformed();
     }
     String creds = new String(decoded, StandardCharsets.UTF_8);
diff --git a/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java b/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java
index 52a8bc9..f7b747b 100644
--- a/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java
+++ b/src/test/java/com/retailsvc/http/SecurityBootValidationTest.java
@@ -51,14 +51,9 @@ void missingValidatorThrows() {
             List.of(),
             List.of(Map.of("bearerAuth", List.of())));
     Spec spec = Spec.from(r);
+    OpenApiServer.Builder builder = handlerBuilder(spec);
 
-    assertThatThrownBy(
-            () ->
-                OpenApiServer.builder()
-                    .spec(spec)
-                    .handlers(Map.of("getX", req -> Response.ok(Map.of())))
-                    .port(0)
-                    .build())
+    assertThatThrownBy(builder::build)
         .isInstanceOf(IllegalStateException.class)
         .hasMessageContaining("bearerAuth");
   }
@@ -71,14 +66,9 @@ void unsupportedSchemeThrowsWhenReferenced() {
             List.of(),
             List.of(Map.of("oauth", List.of())));
     Spec spec = Spec.from(r);
+    OpenApiServer.Builder builder = handlerBuilder(spec);
 
-    assertThatThrownBy(
-            () ->
-                OpenApiServer.builder()
-                    .spec(spec)
-                    .handlers(Map.of("getX", req -> Response.ok(Map.of())))
-                    .port(0)
-                    .build())
+    assertThatThrownBy(builder::build)
         .isInstanceOf(IllegalStateException.class)
         .hasMessageContaining("unsupported");
   }
@@ -91,18 +81,20 @@ void unknownSchemeReferenceThrows() {
             List.of(),
             List.of(Map.of("missingScheme", List.of())));
     Spec spec = Spec.from(r);
+    OpenApiServer.Builder builder = handlerBuilder(spec);
 
-    assertThatThrownBy(
-            () ->
-                OpenApiServer.builder()
-                    .spec(spec)
-                    .handlers(Map.of("getX", req -> Response.ok(Map.of())))
-                    .port(0)
-                    .build())
+    assertThatThrownBy(builder::build)
         .isInstanceOf(IllegalStateException.class)
         .hasMessageContaining("missingScheme");
   }
 
+  private static OpenApiServer.Builder handlerBuilder(Spec spec) {
+    return OpenApiServer.builder()
+        .spec(spec)
+        .handlers(Map.of("getX", req -> Response.ok(Map.of())))
+        .port(0);
+  }
+
   @Test
   void externalAuthSkipsAllChecks() throws Exception {
     Map<String, Object> r =