refreshToken(HttpServletRequest,HttpServletResponse)   A
last analyzed

Complexity

Conditions 3

Size

Total Lines 27
Code Lines 18

Duplication

Lines 0
Ratio 0 %

Importance

Changes 1
Bugs 0 Features 0
Metric Value
cc 3
c 1
b 0
f 0
dl 0
loc 27
rs 9.5
eloc 18
1
package unicon.matthews.security.endpoint;
2
3
import java.io.IOException;
4
import java.util.Collections;
5
import java.util.List;
6
7
import javax.servlet.ServletException;
8
import javax.servlet.http.HttpServletRequest;
9
import javax.servlet.http.HttpServletResponse;
10
11
import org.springframework.beans.factory.annotation.Autowired;
12
import org.springframework.beans.factory.annotation.Qualifier;
13
import org.springframework.http.MediaType;
14
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
15
import org.springframework.security.core.GrantedAuthority;
16
import org.springframework.security.core.authority.SimpleGrantedAuthority;
17
import org.springframework.web.bind.annotation.RequestMapping;
18
import org.springframework.web.bind.annotation.RequestMethod;
19
import org.springframework.web.bind.annotation.ResponseBody;
20
import org.springframework.web.bind.annotation.RestController;
21
22
import unicon.matthews.Vocabulary;
23
import unicon.matthews.oneroster.Org;
24
import unicon.matthews.oneroster.exception.OrgNotFoundException;
25
import unicon.matthews.oneroster.service.OrgService;
26
import unicon.matthews.security.auth.jwt.extractor.TokenExtractor;
27
import unicon.matthews.security.auth.jwt.verifier.TokenVerifier;
28
import unicon.matthews.security.config.JwtSettings;
29
import unicon.matthews.security.config.WebSecurityConfig;
30
import unicon.matthews.security.exception.InvalidJwtToken;
31
import unicon.matthews.security.model.UserContext;
32
import unicon.matthews.security.model.token.JwtToken;
33
import unicon.matthews.security.model.token.JwtTokenFactory;
34
import unicon.matthews.security.model.token.RawAccessJwtToken;
35
import unicon.matthews.security.model.token.RefreshToken;
36
37
/**
38
 * RefreshTokenEndpoint
39
 * 
40
 * @author vladimir.stankovic
41
 *
42
 * Aug 17, 2016
43
 */
44
@RestController
45
public class RefreshTokenEndpoint {
46
    @Autowired private JwtTokenFactory tokenFactory;
47
    @Autowired private JwtSettings jwtSettings;
48
    @Autowired private OrgService orgService;
49
    @Autowired private TokenVerifier tokenVerifier;
50
    @Autowired @Qualifier("jwtHeaderTokenExtractor") private TokenExtractor tokenExtractor;
51
    
52
    @RequestMapping(value="/api/auth/token", method=RequestMethod.GET, produces={ MediaType.APPLICATION_JSON_VALUE })
53
    public @ResponseBody JwtToken refreshToken(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
54
        String tokenPayload = tokenExtractor.extract(request.getHeader(WebSecurityConfig.JWT_TOKEN_HEADER_PARAM));
55
        
56
        RawAccessJwtToken rawToken = new RawAccessJwtToken(tokenPayload);
57
        RefreshToken refreshToken = RefreshToken.create(rawToken, jwtSettings.getTokenSigningKey()).orElseThrow(() -> new InvalidJwtToken());
58
59
        String jti = refreshToken.getJti();
60
        if (!tokenVerifier.verify(jti)) {
61
            throw new InvalidJwtToken();
62
        }
63
64
        String orgId = refreshToken.getSubject();
65
        String tenantId = refreshToken.getClaims().getBody().get("tenant", String.class);
66
67
        Org org;
68
        try {
69
          org = orgService.findByTenantIdAndOrgSourcedId(tenantId, orgId);
70
        } 
71
        catch (OrgNotFoundException e) {
72
          throw new AuthenticationCredentialsNotFoundException(e.getMessage());
73
        }
74
75
        List<GrantedAuthority> authorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ORG_ADMIN"));        
76
        UserContext userContext = UserContext.create(org.getMetadata().get(Vocabulary.TENANT), org.getSourcedId(), authorities);        
77
78
        return tokenFactory.createAccessJwtToken(userContext);
79
    }
80
}
81