chore(authorization): deduplicate constant strings

Author: slisson

authorization/src/main/kotlin/org/modelix/authorization/AuthorizationPlugin.kt

@@ -66,7 +66,7 @@ object ModelixAuthorization : BaseRouteScopedPlugin<IModelixAuthorizationConfig,
                         val token = JWT.create()
                             .withIssuer("modelix")
                             .withAudience("modelix")
-                            .withClaim("email", "[email protected]")
+                            .withClaim(KeycloakTokenConstants.EMAIL, "[email protected]")
                             .sign(Algorithm.HMAC256("unit-tests"))
                         // The signing algorithm and key isn't relevant because the token is already considered valid
                         // and the signature is never checked.

authorization/src/main/kotlin/org/modelix/authorization/KeycloakTokenConstants.kt

@@ -0,0 +1,8 @@
+package org.modelix.authorization
+
+object KeycloakTokenConstants {
+    val EMAIL = "email"
+    val PREFERRED_USERNAME = "preferred_username"
+    val REALM_ACCESS = "realm_access"
+    val REALM_ACCESS_ROLES = "roles"
+}

authorization/src/main/kotlin/org/modelix/authorization/KtorAuthUtils.kt

@@ -61,10 +61,6 @@ fun createModelixAccessToken(hmac512key: String, user: String, grantedPermission
     }
 }
 
-private fun Map<String, Any>?.readRolesArray(): List<String> {
-    return this?.get("roles") as? List<String> ?: emptyList()
-}
-
 fun ApplicationCall.getBearerToken(): String? {
     val authHeader = request.parseAuthorizationHeader()
     if (authHeader == null || authHeader.authScheme != AuthScheme.Bearer) return null

authorization/src/main/kotlin/org/modelix/authorization/ModelixJWTUtil.kt

@@ -144,8 +144,8 @@ class ModelixJWTUtil {
         }
 
         val payload = JWTClaimsSet.Builder()
-            .claim("preferred_username", user)
-            .claim("permissions", grantedPermissions)
+            .claim(KeycloakTokenConstants.PREFERRED_USERNAME, user)
+            .claim(ModelixTokenConstants.PERMISSIONS, grantedPermissions)
             .expirationTime(Date(Instant.now().plus(12, ChronoUnit.HOURS).toEpochMilli()))
             .also { additionalTokenContent(TokenBuilder(it)) }
             .build()
@@ -171,7 +171,7 @@ class ModelixJWTUtil {
     }
 
     fun extractPermissions(token: DecodedJWT): List<String>? {
-        return token.claims["permissions"]?.asList(String::class.java)
+        return token.claims[ModelixTokenConstants.PERMISSIONS]?.asList(String::class.java)
     }
 
     fun loadGrantedPermissions(token: DecodedJWT, evaluator: PermissionEvaluator) {
@@ -197,14 +197,14 @@ class ModelixJWTUtil {
     }
 
     fun extractUserId(jwt: DecodedJWT): String? {
-        return jwt.getClaim("email")?.asString()
-            ?: jwt.getClaim("preferred_username")?.asString()
+        return jwt.getClaim(KeycloakTokenConstants.EMAIL)?.asString()
+            ?: jwt.getClaim(KeycloakTokenConstants.PREFERRED_USERNAME)?.asString()
     }
 
     fun extractUserRoles(jwt: DecodedJWT): List<String> {
         val keycloakRoles = jwt
-            .getClaim("realm_access")?.asMap()
-            ?.get("roles")
+            .getClaim(KeycloakTokenConstants.REALM_ACCESS)?.asMap()
+            ?.get(KeycloakTokenConstants.REALM_ACCESS_ROLES)
             ?.let { it as? List<*> }
             ?.mapNotNull { it as? String }
             ?: emptyList()

authorization/src/main/kotlin/org/modelix/authorization/ModelixTokenConstants.kt

@@ -0,0 +1,5 @@
+package org.modelix.authorization
+
+object ModelixTokenConstants {
+    val PERMISSIONS = "permissions"
+}

authorization/src/test/kotlin/org/modelix/authorization/AccessControlDataTest.kt

@@ -26,7 +26,7 @@ class AccessControlDataTest {
     @Test
     fun `can grant permissions to identity tokens`() {
         val token = JWT.create()
-            .withClaim("email", email)
+            .withClaim(KeycloakTokenConstants.EMAIL, email)
             .sign(Algorithm.HMAC256("unit-tests"))
             .let { JWT.decode(it) }
         val data = AccessControlData().withGrantToUser(email, PermissionParts("r1", "write").fullId)