flag requireMockHandling in auth

client-java/controller-api/src/main/java/org/evomaster/client/java/controller/api/dto/auth/AuthenticationDto.java

@@ -15,6 +15,16 @@ public class AuthenticationDto {
      */
     public String name;
 
+    /**
+     * Specify that the authentication for this user requires setting up mock responses from external services
+     * in the API.
+     * This will be done as part of the fuzzing, although only possible for white-box testing.
+     *
+     * One consequence here is that, even if we provide correct auth info as input, then a request might still
+     * fail due to unauthorized access if the fuzzing process does not properly set up these mocked responses in the API itself.
+     */
+    public Boolean requireMockHandling;
+
     /**
      * The headers needed for authentication.
      * This is used to represent cases in which auth info is static/fixed,

core/src/main/kotlin/org/evomaster/core/problem/httpws/auth/HttpWsAuthenticationInfo.kt

@@ -24,7 +24,8 @@ open class HttpWsAuthenticationInfo(
      * Represent call done to a login endpoint, from which a token or cookie is extracted
      * for auth in following requests.
      */
-    val endpointCallLogin: EndpointCallLogin?
+    val endpointCallLogin: EndpointCallLogin?,
+    val requireMockHandling: Boolean
 ): AuthenticationInfo(name) {
 
     init {
@@ -65,7 +66,9 @@ open class HttpWsAuthenticationInfo(
                 null
             }
 
-           return HttpWsAuthenticationInfo(dto.name.trim(), headers, endpointCallLogin)
+            val requireMockHandling = dto.requireMockHandling != null && dto.requireMockHandling
+
+           return HttpWsAuthenticationInfo(dto.name.trim(), headers, endpointCallLogin, requireMockHandling)
         }
     }
 

core/src/main/kotlin/org/evomaster/core/problem/rest/service/AbstractRestFitness.kt

@@ -559,7 +559,7 @@ abstract class AbstractRestFitness : HttpWsFitness<RestIndividual>() {
             }
         }
 
-        if (response.status == 401 && a.auth !is NoAuth) {
+        if (response.status == 401 && a.auth !is NoAuth && !a.auth.requireMockHandling) {
             /*
                 if the endpoint itself is to get auth info, we might exclude auth check for it
                 eg,