Skip to content
This repository was archived by the owner on Apr 5, 2024. It is now read-only.

Commit d0de035

Browse files
open-schnickopen-schnick
committed
Fixed bug in authentication when tokens are invalid.
1 parent 5351317 commit d0de035

File tree

3 files changed

+46
-24
lines changed

3 files changed

+46
-24
lines changed

‎src/main/java/de/filefighter/rest/domain/authentication/AuthenticationBusinessService.java‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import de.filefighter.rest.domain.common.InputSanitizerService;
44
import de.filefighter.rest.domain.common.exceptions.RequestDidntMeetFormalRequirementsException;
5+
import de.filefighter.rest.domain.token.business.AccessTokenBusinessService;
56
import de.filefighter.rest.domain.token.data.dto.AccessToken;
67
import de.filefighter.rest.domain.user.business.UserDTOService;
78
import de.filefighter.rest.domain.user.data.dto.User;
@@ -24,12 +25,14 @@ public class AuthenticationBusinessService {
2425
private final UserDTOService userDtoService;
2526
private final InputSanitizerService inputSanitizerService;
2627
private final PasswordEncoder passwordEncoder;
28+
private final AccessTokenBusinessService accessTokenBusinessService;
2729

28-
public AuthenticationBusinessService(UserRepository userRepository, UserDTOService userDtoService, InputSanitizerService inputSanitizerService, PasswordEncoder passwordEncoder) {
30+
public AuthenticationBusinessService(UserRepository userRepository, UserDTOService userDtoService, InputSanitizerService inputSanitizerService, PasswordEncoder passwordEncoder, AccessTokenBusinessService accessTokenBusinessService) {
2931
this.userRepository = userRepository;
3032
this.userDtoService = userDtoService;
3133
this.inputSanitizerService = inputSanitizerService;
3234
this.passwordEncoder = passwordEncoder;
35+
this.accessTokenBusinessService = accessTokenBusinessService;
3336
}
3437

3538
public User authenticateUserWithUsernameAndPassword(String base64encodedUserAndPassword) {
@@ -72,11 +75,16 @@ public User authenticateUserWithRefreshToken(String refreshToken) {
7275
}
7376

7477
public User authenticateUserWithAccessToken(AccessToken accessToken) {
75-
UserEntity userEntity = userRepository.findByUserId(accessToken.getUserId());
76-
if (null == userEntity)
77-
throw new UserNotAuthenticatedException(accessToken.getUserId());
78-
79-
return userDtoService.createDto(userEntity);
78+
if (accessTokenBusinessService.accessTokenIsInvalid(accessToken.getValidUntil())) {
79+
log.debug("AccessToken used for auth was invalid: " + accessToken);
80+
throw new UserNotAuthenticatedException("AccessToken was not valid anymore.");
81+
} else {
82+
UserEntity userEntity = userRepository.findByUserId(accessToken.getUserId());
83+
if (null == userEntity)
84+
throw new UserNotAuthenticatedException(accessToken.getUserId());
85+
86+
return userDtoService.createDto(userEntity);
87+
}
8088
}
8189

8290
public void authenticateUserWithAccessTokenAndGroup(AccessToken accessToken, Group groups) {

‎src/main/java/de/filefighter/rest/domain/token/business/AccessTokenBusinessService.java‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ public AccessTokenBusinessService(AccessTokenRepository accessTokenRepository, A
2727
this.accessTokenDtoService = accessTokenDtoService;
2828
}
2929

30+
// basically auth with refresh token.
3031
public AccessToken getValidAccessTokenForUser(User user) {
3132
long userId = user.getUserId();
3233
AccessTokenEntity accessTokenEntity = accessTokenRepository.findByUserId(userId);
@@ -40,21 +41,19 @@ public AccessToken getValidAccessTokenForUser(User user) {
4041
.userId(userId)
4142
.build();
4243
accessTokenEntity = accessTokenRepository.save(accessTokenEntity);
43-
} else {
44-
if (currentTimeSeconds + ACCESS_TOKEN_SAFETY_MARGIN > accessTokenEntity.getValidUntil()) {
45-
log.info("Deleting AccessToken for UserId {}, because its invalid now.", userId);
46-
long deletedTokenAmount = accessTokenRepository.deleteByUserId(userId);
47-
if (1L != deletedTokenAmount)
48-
throw new FileFighterDataException("AccessToken for userId " + userId + " could not be deleted.");
49-
50-
accessTokenEntity = AccessTokenEntity
51-
.builder()
52-
.validUntil(currentTimeSeconds + ACCESS_TOKEN_DURATION_IN_SECONDS)
53-
.value(generateRandomTokenValue())
54-
.userId(userId)
55-
.build();
56-
accessTokenEntity = accessTokenRepository.save(accessTokenEntity);
57-
}
44+
} else if (accessTokenIsInvalid(accessTokenEntity.getValidUntil())) {
45+
log.debug("Deleting AccessToken for UserId {}, because its invalid now.", userId);
46+
long deletedTokenAmount = accessTokenRepository.deleteByUserId(userId);
47+
if (1L != deletedTokenAmount)
48+
throw new FileFighterDataException("AccessToken for userId " + userId + " could not be deleted.");
49+
50+
accessTokenEntity = AccessTokenEntity
51+
.builder()
52+
.validUntil(currentTimeSeconds + ACCESS_TOKEN_DURATION_IN_SECONDS)
53+
.value(generateRandomTokenValue())
54+
.userId(userId)
55+
.build();
56+
accessTokenEntity = accessTokenRepository.save(accessTokenEntity);
5857
}
5958

6059
return accessTokenDtoService.createDto(accessTokenEntity);
@@ -76,6 +75,10 @@ public AccessToken findAccessTokenByValue(String accessTokenValue) {
7675
return accessTokenDtoService.createDto(accessTokenEntity);
7776
}
7877

78+
public boolean accessTokenIsInvalid(long timeStampToTest) {
79+
return (Instant.now().getEpochSecond() + ACCESS_TOKEN_SAFETY_MARGIN > timeStampToTest);
80+
}
81+
7982
public static String generateRandomTokenValue() {
8083
return UUID.randomUUID().toString();
8184
}

‎src/test/java/de/filefighter/rest/domain/authentication/AuthenticationBusinessServiceUnitTest.java‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import de.filefighter.rest.domain.common.InputSanitizerService;
44
import de.filefighter.rest.domain.common.exceptions.RequestDidntMeetFormalRequirementsException;
5+
import de.filefighter.rest.domain.token.business.AccessTokenBusinessService;
56
import de.filefighter.rest.domain.token.data.dto.AccessToken;
67
import de.filefighter.rest.domain.user.business.UserDTOService;
78
import de.filefighter.rest.domain.user.data.dto.User;
@@ -28,12 +29,14 @@ class AuthenticationBusinessServiceUnitTest {
2829
private final UserDTOService userDtoServiceMock = mock(UserDTOService.class);
2930
private final InputSanitizerService inputSanitizerServiceMock = mock(InputSanitizerService.class);
3031
private final PasswordEncoder passwordEncoderMock = mock(PasswordEncoder.class);
32+
private final AccessTokenBusinessService accessTokenBusinessServiceMock = mock(AccessTokenBusinessService.class);
3133
private final AuthenticationBusinessService authenticationBusinessService =
3234
new AuthenticationBusinessService(
3335
userRepositoryMock,
3436
userDtoServiceMock,
3537
inputSanitizerServiceMock,
36-
passwordEncoderMock);
38+
passwordEncoderMock,
39+
accessTokenBusinessServiceMock);
3740

3841
@Test
3942
void authenticateUserWithUsernameAndPasswordThrows() {
@@ -120,12 +123,20 @@ void authenticateUserWithRefreshTokenWorksCorrectly() {
120123
@Test
121124
void authenticateUserWithAccessTokenThrows() {
122125
long userId = 420;
123-
AccessToken accessToken = AccessToken.builder().userId(userId).build();
126+
long timer = 123872183;
127+
AccessToken accessToken = AccessToken.builder().userId(userId).validUntil(timer).build();
124128

125-
when(userRepositoryMock.findByUserId(userId)).thenReturn(null);
129+
when(accessTokenBusinessServiceMock.accessTokenIsInvalid(timer)).thenReturn(true);
126130

127131
UserNotAuthenticatedException ex = assertThrows(UserNotAuthenticatedException.class, () ->
128132
authenticationBusinessService.authenticateUserWithAccessToken(accessToken));
133+
assertEquals(UserNotAuthenticatedException.getErrorMessagePrefix() + " AccessToken was not valid anymore.", ex.getMessage());
134+
135+
when(userRepositoryMock.findByUserId(userId)).thenReturn(null);
136+
when(accessTokenBusinessServiceMock.accessTokenIsInvalid(timer)).thenReturn(false);
137+
138+
ex = assertThrows(UserNotAuthenticatedException.class, () ->
139+
authenticationBusinessService.authenticateUserWithAccessToken(accessToken));
129140
assertEquals(UserNotAuthenticatedException.getErrorMessagePrefix() + " UserId was " + userId, ex.getMessage());
130141
}
131142

0 commit comments

Comments
 (0)