Ticket #24149: 24149.patch

src/org/openstreetmap/josm/io/auth/CredentialsManager.java

@@ -133 +133 @@
             }
         }
         // see #11914: clear cache before we store new value
-        purgeCredentialsCache(requestorType);
+        purgeCredentialsCache(requestorType, host);
         delegate.store(requestorType, host, credentials);
     }
 
@@ -141 +141 @@
     public CredentialsAgentResponse getCredentials(RequestorType requestorType, String host, boolean noSuccessWithLastResponse)
             throws CredentialsAgentException {
         CredentialsAgentResponse credentials = delegate.getCredentials(requestorType, host, noSuccessWithLastResponse);
-        if (requestorType == RequestorType.SERVER) {
+        if (requestorType == RequestorType.SERVER && Objects.equals(OsmApi.getOsmApi().getHost(), host)) {
             // see #11914 : Keep UserIdentityManager up to date
             String userName = credentials.getUsername();
             userName = userName == null ? "" : userName.trim();
@@ -174 +174 @@
     public void purgeCredentialsCache(RequestorType requestorType) {
         delegate.purgeCredentialsCache(requestorType);
     }
+
+    @Override
+    public void purgeCredentialsCache(RequestorType requestorType, String host) {
+        delegate.purgeCredentialsCache(requestorType, host);
+    }
 }

test/unit/org/openstreetmap/josm/io/auth/CredentialsManagerTest.java

@@ -1 +1 @@
 // License: GPL. For details, see LICENSE file.
 package org.openstreetmap.josm.io.auth;
 
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
 import org.openstreetmap.josm.testutils.annotations.HTTP;
 
+import java.net.Authenticator;
+import java.util.List;
+
 /**
  * Test class for {@link CredentialsManager}
  */
@@ -12 +17 @@
     public CredentialsManager createAgent() {
         return new CredentialsManager(new JosmPreferencesCredentialAgent());
     }
+
+    @Test
+    public void testMultipleUnsavedHostsLookup() throws CredentialsAgentException {
+        final AbstractCredentialsAgent aca = new JosmPreferencesCredentialAgent();
+        // A provider that mimics user giving the credentials and choosing not to store them in preferences.
+        AbstractCredentialsAgent.setCredentialsProvider((requestorType, agent, response, username, password, host) -> {
+            response.setUsername("user" + host);
+            response.setPassword("password".toCharArray());
+            response.setSaveCredentials(false);
+            response.setCanceled(false);
+        });
+        final CredentialsManager agent = new CredentialsManager(aca);
+
+        String host1 = "example.com";
+        String host2 = "example.org";
+        for (String host : List.of(host1, host2)) {
+            // Try to get credentials after "failure" => provider gives the credentials.
+            agent.getCredentials(Authenticator.RequestorType.SERVER, host, true);
+        }
+        // Both hosts should receive their respective credentials.
+        CredentialsAgentResponse response = agent.getCredentials(Authenticator.RequestorType.SERVER, host1, false);
+        Assertions.assertEquals("user" + host1, response.getUsername());
+        response = agent.getCredentials(Authenticator.RequestorType.SERVER, host2, false);
+        Assertions.assertEquals("user" + host2, response.getUsername());
+    }
 }

src/org/openstreetmap/josm/io/OsmServerReader.java

@@ -207 +207 @@
             }
             try {
                 if (response.getResponseCode() == HttpURLConnection.HTTP_UNAUTHORIZED) {
-                    CredentialsManager.getInstance().purgeCredentialsCache(RequestorType.SERVER);
+                    CredentialsManager.getInstance().purgeCredentialsCache(RequestorType.SERVER, OsmApi.getOsmApi().getHost());
                     throw new OsmApiException(HttpURLConnection.HTTP_UNAUTHORIZED, null, null);
                 }
 

src/org/openstreetmap/josm/io/auth/AbstractCredentialsAgent.java

@@ -3 +3 @@
 
 import java.net.Authenticator.RequestorType;
 import java.net.PasswordAuthentication;
-import java.util.EnumMap;
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
 
 import org.openstreetmap.josm.tools.Logging;
+import org.openstreetmap.josm.tools.Pair;
 
 /**
  * Partial implementation of the {@link CredentialsAgent} interface.
@@ -47 +48 @@
         credentialsProvider = Objects.requireNonNull(provider, "provider");
     }
 
-    protected Map<RequestorType, PasswordAuthentication> memoryCredentialsCache = new EnumMap<>(RequestorType.class);
+    protected Map<Pair<RequestorType, String>, PasswordAuthentication> memoryCredentialsCache = new HashMap<>();
 
     @Override
     public CredentialsAgentResponse getCredentials(final RequestorType requestorType, final String host, boolean noSuccessWithLastResponse)
@@ -64 +65 @@
          * Last request was successful and there was no credentials stored in file (or only the username is stored).
          * -> Try to recall credentials that have been entered manually in this session.
          */
-        if (!noSuccessWithLastResponse && memoryCredentialsCache.containsKey(requestorType) &&
+        Pair<RequestorType, String> mccKey = Pair.create(requestorType, host);
+        if (!noSuccessWithLastResponse && memoryCredentialsCache.containsKey(mccKey) &&
                 (credentials == null || credentials.getPassword() == null || credentials.getPassword().length == 0)) {
-            PasswordAuthentication pa = memoryCredentialsCache.get(requestorType);
+            PasswordAuthentication pa = memoryCredentialsCache.get(mccKey);
             response.setUsername(pa.getUserName());
             response.setPassword(pa.getPassword());
             response.setCanceled(false);
@@ -88 +90 @@
                 ));
             } else {
                 // User decides not to save credentials to file. Keep it in memory so we don't have to ask over and over again.
-                memoryCredentialsCache.put(requestorType, new PasswordAuthentication(response.getUsername(), response.getPassword()));
+                memoryCredentialsCache.put(mccKey, new PasswordAuthentication(response.getUsername(), response.getPassword()));
             }
         } else {
             // We got it from file.
@@ -101 +103 @@
 
     @Override
     public final void purgeCredentialsCache(RequestorType requestorType) {
-        memoryCredentialsCache.remove(requestorType);
+        memoryCredentialsCache.keySet().removeIf(pair -> pair.a == requestorType);
+    }
+
+    @Override
+    public void purgeCredentialsCache(RequestorType requestorType, String host) {
+        memoryCredentialsCache.remove(Pair.create(requestorType, host));
     }
 
     /**

src/org/openstreetmap/josm/io/OsmApi.java

@@ -824 +824 @@
                         throw new OsmApiException(retCode, errorHeader, errorBody);
                 case HttpURLConnection.HTTP_UNAUTHORIZED:
                 case HttpURLConnection.HTTP_FORBIDDEN:
-                    CredentialsManager.getInstance().purgeCredentialsCache(RequestorType.SERVER);
+                    CredentialsManager.getInstance().purgeCredentialsCache(RequestorType.SERVER, getHost());
                     throw new OsmApiException(retCode, errorHeader, errorBody, activeConnection.getURL().toString(),
                             doAuthenticate ? retrieveBasicAuthorizationLogin(client) : null, response.getContentType());
                 default:

src/org/openstreetmap/josm/io/auth/CredentialsAgent.java

@@ -83 +83 @@
     /**
      * Purges the internal credentials cache for the given requestor type.
      * @param requestorType the type of service.
-     * {@link RequestorType#SERVER} for the OSM API server, {@link RequestorType#PROXY} for a proxy server
+     * {@link RequestorType#PROXY} for a proxy server, {@link RequestorType#SERVER} for other servers.
      * @since 12992
      */
     void purgeCredentialsCache(RequestorType requestorType);
 
+    /**
+     * Purges the internal credentials cache for the given requestor type and host.
+     * @param requestorType the type of service.
+     * @param host the host.
+     * {@link RequestorType#PROXY} for a proxy server, {@link RequestorType#SERVER} for other servers.
+     */
+    default void purgeCredentialsCache(RequestorType requestorType, String host) {
+        purgeCredentialsCache(requestorType);
+    }
+
     /**
      * Provide a Panel that is shown below the API password / username fields
      * in the JOSM Preferences. (E.g. a warning that password is saved unencrypted.)