Skip to content

Commit 925ef67

Browse files
rishabhpoddarrishabhpoddar
authored
more fixes (#759)
1 parent 3860f4e commit 925ef67

File tree

4 files changed

+67
-31
lines changed

4 files changed

+67
-31
lines changed

‎src/main/java/io/supertokens/session/accessToken/AccessToken.java‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,8 @@ public static TokenInfo createNewAccessTokenV1(@Nonnull Main main, @Nonnull Stri
216216
@Nullable String parentRefreshTokenHash1,
217217
@Nonnull JsonObject userData, @Nullable String antiCsrfToken)
218218
throws StorageQueryException, StorageTransactionLogicException, InvalidKeyException,
219-
NoSuchAlgorithmException, UnsupportedEncodingException, InvalidKeySpecException, SignatureException {
219+
NoSuchAlgorithmException, UnsupportedEncodingException, InvalidKeySpecException, SignatureException,
220+
AccessTokenPayloadError {
220221

221222
Utils.PubPriKey signingKey = new Utils.PubPriKey(
222223
SigningKeys.getInstance(main).getLatestIssuedDynamicKey().value);
@@ -229,11 +230,10 @@ public static TokenInfo createNewAccessTokenV1(@Nonnull Main main, @Nonnull Stri
229230

230231
// we use toJsonTreeWithoutNulls here cause in this version of the token, we did not add claims which
231232
// had null values.
232-
String token = JWT.createAndSignLegacyAccessToken(Utils.toJsonTreeWithoutNulls(accessToken),
233+
String token = JWT.createAndSignLegacyAccessToken(accessToken.toJSON(),
233234
signingKey.privateKey,
234235
VERSION.V1);
235236
return new TokenInfo(token, accessToken.expiryTime, accessToken.timeCreated);
236-
237237
}
238238

239239
public static VERSION getAccessTokenVersion(AccessTokenInfo accessToken) {
@@ -369,8 +369,19 @@ JsonObject toJSON() throws AccessTokenPayloadError {
369369
}
370370
res.addProperty("sessionHandle", this.sessionHandle);
371371
res.addProperty("refreshTokenHash1", this.refreshTokenHash1);
372-
res.addProperty("parentRefreshTokenHash1", this.parentRefreshTokenHash1);
373-
res.addProperty("antiCsrfToken", this.antiCsrfToken);
372+
373+
if (this.version == VERSION.V1 || this.version == VERSION.V2) {
374+
if (parentRefreshTokenHash1 != null) {
375+
res.addProperty("parentRefreshTokenHash1", this.parentRefreshTokenHash1);
376+
}
377+
if (antiCsrfToken != null) {
378+
res.addProperty("antiCsrfToken", this.antiCsrfToken);
379+
}
380+
} else {
381+
// in v3 onwards, we always add these even if they are null
382+
res.addProperty("parentRefreshTokenHash1", this.parentRefreshTokenHash1);
383+
res.addProperty("antiCsrfToken", this.antiCsrfToken);
384+
}
374385

375386
if (this.version == VERSION.V3) {
376387
for (Map.Entry<String, JsonElement> element : this.userData.entrySet()) {

‎src/main/java/io/supertokens/utils/Utils.java‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -374,8 +374,4 @@ public static JsonObject addLegacySigningKeyInfos(Main main, JsonObject result,
374374
public static JsonElement toJsonTreeWithNulls(Object src) {
375375
return new GsonBuilder().serializeNulls().create().toJsonTree(src);
376376
}
377-
378-
public static JsonElement toJsonTreeWithoutNulls(Object src) {
379-
return new GsonBuilder().create().toJsonTree(src);
380-
}
381377
}

‎src/test/java/io/supertokens/test/session/AccessTokenTest.java‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import com.google.gson.JsonObject;
2020
import io.supertokens.ProcessState.EventAndException;
2121
import io.supertokens.ProcessState.PROCESS_STATE;
22+
import io.supertokens.exceptions.AccessTokenPayloadError;
2223
import io.supertokens.exceptions.TryRefreshTokenException;
2324
import io.supertokens.pluginInterface.exceptions.StorageQueryException;
2425
import io.supertokens.pluginInterface.exceptions.StorageTransactionLogicException;
@@ -72,7 +73,7 @@ public void beforeEach() {
7273
// * - create session with some data -> expire -> get access token without verifying, check payload is fine.
7374
@Test
7475
public void testCreateSessionWithDataExpireGetAccessTokenAndCheckPayload() throws Exception {
75-
String[] args = { "../" };
76+
String[] args = {"../"};
7677

7778
Utils.setValueInConfig("access_token_validity", "1"); // 1 second validity
7879

@@ -105,10 +106,11 @@ public void testCreateSessionWithDataExpireGetAccessTokenAndCheckPayload() throw
105106
assertNotNull(process.checkOrWaitForEvent(PROCESS_STATE.STOPPED));
106107

107108
}
109+
108110
// * - create session with some data -> expire -> get access token without verifying, check payload is fine.
109111
@Test
110112
public void testCreateSessionV2WithDataExpireGetAccessTokenAndCheckPayload() throws Exception {
111-
String[] args = { "../" };
113+
String[] args = {"../"};
112114

113115
Utils.setValueInConfig("access_token_validity", "1"); // 1 second validity
114116

@@ -146,7 +148,7 @@ public void testCreateSessionV2WithDataExpireGetAccessTokenAndCheckPayload() thr
146148
// what you gave
147149
@Test
148150
public void testSessionWithOldExpiryTimeForAccessToken() throws Exception {
149-
String[] args = { "../" };
151+
String[] args = {"../"};
150152

151153
TestingProcess process = TestingProcessManager.start(args);
152154
assertNotNull(process.checkOrWaitForEvent(PROCESS_STATE.STARTED));
@@ -181,7 +183,7 @@ public void testSessionWithOldExpiryTimeForAccessToken() throws Exception {
181183
// what you gave
182184
@Test
183185
public void testSessionWithOldExpiryTimeForAccessTokenV2() throws Exception {
184-
String[] args = { "../" };
186+
String[] args = {"../"};
185187

186188
TestingProcess process = TestingProcessManager.start(args);
187189
assertNotNull(process.checkOrWaitForEvent(PROCESS_STATE.STARTED));
@@ -215,7 +217,7 @@ public void testSessionWithOldExpiryTimeForAccessTokenV2() throws Exception {
215217
// * - create access token version 2 -> get version -> should be 2
216218
@Test
217219
public void testCreateAccessTokenVersion2AndCheck() throws Exception {
218-
String[] args = { "../" };
220+
String[] args = {"../"};
219221

220222
TestingProcess process = TestingProcessManager.start(args);
221223
assertNotNull(process.checkOrWaitForEvent(PROCESS_STATE.STARTED));
@@ -244,7 +246,7 @@ public void testCreateAccessTokenVersion2AndCheck() throws Exception {
244246
// good case test
245247
@Test
246248
public void inputOutputTest() throws Exception {
247-
String[] args = { "../" };
249+
String[] args = {"../"};
248250
TestingProcess process = TestingProcessManager.start(args);
249251
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
250252
assertNotNull(e);
@@ -254,25 +256,27 @@ public void inputOutputTest() throws Exception {
254256
// db key
255257
long expiryTime = System.currentTimeMillis() + 1000;
256258
TokenInfo newToken = AccessToken.createNewAccessToken(process.getProcess(), "sessionHandle", "userId",
257-
"refreshTokenHash1", "parentRefreshTokenHash1", jsonObj, "antiCsrfToken", expiryTime, AccessToken.VERSION.V3, false);
259+
"refreshTokenHash1", "parentRefreshTokenHash1", jsonObj, "antiCsrfToken", expiryTime,
260+
AccessToken.VERSION.V3, false);
258261
AccessTokenInfo info = AccessToken.getInfoFromAccessToken(process.getProcess(), newToken.token, true);
259262
assertEquals("sessionHandle", info.sessionHandle);
260263
assertEquals("userId", info.userId);
261264
assertEquals("refreshTokenHash1", info.refreshTokenHash1);
262265
assertEquals("parentRefreshTokenHash1", info.parentRefreshTokenHash1);
263266
assertEquals("value", info.userData.get("key").getAsString());
264267
assertEquals("antiCsrfToken", info.antiCsrfToken);
265-
assertEquals(expiryTime/1000*1000, info.expiryTime);
268+
assertEquals(expiryTime / 1000 * 1000, info.expiryTime);
266269

267270
JWT.JWTPreParseInfo jwtInfo = JWT.preParseJWTInfo(newToken.token);
268271
assertNotNull(jwtInfo.kid);
269272
assertEquals(jwtInfo.version, AccessToken.VERSION.V3);
270273

271274
process.kill();
272275
}
276+
273277
@Test
274278
public void inputOutputTestStatic() throws Exception {
275-
String[] args = { "../" };
279+
String[] args = {"../"};
276280
TestingProcess process = TestingProcessManager.start(args);
277281
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
278282
assertNotNull(e);
@@ -282,15 +286,16 @@ public void inputOutputTestStatic() throws Exception {
282286
// db key
283287
long expiryTime = System.currentTimeMillis() + 1000;
284288
TokenInfo newToken = AccessToken.createNewAccessToken(process.getProcess(), "sessionHandle", "userId",
285-
"refreshTokenHash1", "parentRefreshTokenHash1", jsonObj, "antiCsrfToken", expiryTime, AccessToken.VERSION.V3, true);
289+
"refreshTokenHash1", "parentRefreshTokenHash1", jsonObj, "antiCsrfToken", expiryTime,
290+
AccessToken.VERSION.V3, true);
286291
AccessTokenInfo info = AccessToken.getInfoFromAccessToken(process.getProcess(), newToken.token, true);
287292
assertEquals("sessionHandle", info.sessionHandle);
288293
assertEquals("userId", info.userId);
289294
assertEquals("refreshTokenHash1", info.refreshTokenHash1);
290295
assertEquals("parentRefreshTokenHash1", info.parentRefreshTokenHash1);
291296
assertEquals("value", info.userData.get("key").getAsString());
292297
assertEquals("antiCsrfToken", info.antiCsrfToken);
293-
assertEquals(expiryTime/1000*1000, info.expiryTime);
298+
assertEquals(expiryTime / 1000 * 1000, info.expiryTime);
294299

295300
JWT.JWTPreParseInfo jwtInfo = JWT.preParseJWTInfo(newToken.token);
296301
assertNotNull(jwtInfo.kid);
@@ -300,7 +305,7 @@ public void inputOutputTestStatic() throws Exception {
300305

301306
@Test
302307
public void inputOutputTestV2() throws Exception {
303-
String[] args = { "../" };
308+
String[] args = {"../"};
304309
TestingProcess process = TestingProcessManager.start(args);
305310
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
306311
assertNotNull(e);
@@ -310,7 +315,8 @@ public void inputOutputTestV2() throws Exception {
310315
// db key
311316
long expiryTime = System.currentTimeMillis() + 1000;
312317
TokenInfo newToken = AccessToken.createNewAccessToken(process.getProcess(), "sessionHandle", "userId",
313-
"refreshTokenHash1", "parentRefreshTokenHash1", jsonObj, "antiCsrfToken", expiryTime, AccessToken.VERSION.V2, false);
318+
"refreshTokenHash1", "parentRefreshTokenHash1", jsonObj, "antiCsrfToken", expiryTime,
319+
AccessToken.VERSION.V2, false);
314320
AccessTokenInfo info = AccessToken.getInfoFromAccessToken(process.getProcess(), newToken.token, true);
315321
assertEquals("sessionHandle", info.sessionHandle);
316322
assertEquals("userId", info.userId);
@@ -325,8 +331,8 @@ public void inputOutputTestV2() throws Exception {
325331
@Test
326332
public void inputOutputTestv1() throws InterruptedException, InvalidKeyException, NoSuchAlgorithmException,
327333
StorageQueryException, StorageTransactionLogicException, TryRefreshTokenException,
328-
UnsupportedEncodingException, InvalidKeySpecException, SignatureException {
329-
String[] args = { "../" };
334+
UnsupportedEncodingException, InvalidKeySpecException, SignatureException, AccessTokenPayloadError {
335+
String[] args = {"../"};
330336
TestingProcess process = TestingProcessManager.start(args);
331337
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
332338
assertNotNull(e);
@@ -352,7 +358,7 @@ public void signingKeyShortInterval()
352358
throws InterruptedException, StorageQueryException, StorageTransactionLogicException, IOException {
353359
Utils.setValueInConfig("access_token_dynamic_signing_key_update_interval", "0.00027"); // 1 second
354360

355-
String[] args = { "../" };
361+
String[] args = {"../"};
356362
TestingProcess process = TestingProcessManager.start(args);
357363
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
358364
assertNotNull(e);
@@ -368,7 +374,7 @@ public void signingKeyShortInterval()
368374
public void signingKeyChangeDoesNotThrow() throws Exception {
369375
Utils.setValueInConfig("access_token_dynamic_signing_key_update_interval", "0.00027"); // 1 second
370376

371-
String[] args = { "../" };
377+
String[] args = {"../"};
372378
TestingProcess process = TestingProcessManager.start(args);
373379
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
374380
assertNotNull(e);
@@ -394,7 +400,7 @@ public void accessTokenShortLifetimeThrowsRefreshTokenError()
394400
throws Exception {
395401
Utils.setValueInConfig("access_token_validity", "1"); // 1 second
396402

397-
String[] args = { "../" };
403+
String[] args = {"../"};
398404
TestingProcess process = TestingProcessManager.start(args);
399405
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
400406
assertNotNull(e);
@@ -421,7 +427,7 @@ public void accessTokenShortLifetimeThrowsRefreshTokenError()
421427
@Test
422428
public void verifyRandomAccessTokenFailure()
423429
throws InterruptedException, StorageQueryException, StorageTransactionLogicException {
424-
String[] args = { "../" };
430+
String[] args = {"../"};
425431
TestingProcess process = TestingProcessManager.start(args);
426432
assertNotNull(process.checkOrWaitForEvent(PROCESS_STATE.STARTED));
427433

@@ -439,7 +445,7 @@ public void keyChangeThreadSafetyTest() throws Exception {
439445
Utils.setValueInConfig("access_token_dynamic_signing_key_update_interval", "0.00027"); // 1 second
440446
Utils.setValueInConfig("access_token_validity", "1"); // 1 second
441447

442-
String[] args = { "../" };
448+
String[] args = {"../"};
443449
TestingProcess process = TestingProcessManager.start(args);
444450
EventAndException e = process.checkOrWaitForEvent(PROCESS_STATE.STARTED);
445451
assertNotNull(e);

‎src/test/java/io/supertokens/test/session/api/SessionRegenerateAPITest2_21.java‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -137,10 +137,16 @@ public void testCallRegenerateSessionWithv1AccessTokenFromReallyOldAndItSucceeds
137137
JsonObject toUpdate = new JsonObject();
138138
toUpdate.addProperty("k1", "v1");
139139

140-
TokenInfo newToken = AccessToken.createNewAccessTokenV1(process.getProcess(), session.session.handle, "user1",
140+
TokenInfo newToken = AccessToken.createNewAccessTokenV1(process.getProcess(),
141+
session.session.handle, "user1",
141142
info.refreshTokenHash1, null, new JsonObject(), null);
142143

143-
System.out.println(newToken.token);
144+
String payload = newToken.token.split("\\.")[1];
145+
String jsonStr = io.supertokens.utils.Utils.convertFromBase64(payload);
146+
assert (jsonStr.contains("userId"));
147+
assert (!jsonStr.contains("parentRefreshTokenHash1"));
148+
assert (!jsonStr.contains("antiCsrf"));
149+
assert (!jsonStr.contains("\"version\":\"V1\""));
144150

145151
sessionRegenerateRequest.addProperty("accessToken", newToken.token);
146152
sessionRegenerateRequest.add("userDataInJWT", toUpdate);
@@ -149,6 +155,23 @@ public void testCallRegenerateSessionWithv1AccessTokenFromReallyOldAndItSucceeds
149155
"http://localhost:3567/recipe/session/regenerate", sessionRegenerateRequest, 1000, 1000, null,
150156
SemVer.v2_21.get(), "session");
151157
assertEquals("OK", jsonResp.get("status").getAsString());
158+
String accessToken = jsonResp.get("accessToken").getAsJsonObject().get("token").getAsString();
159+
payload = accessToken.split("\\.")[1];
160+
jsonStr = io.supertokens.utils.Utils.convertFromBase64(payload);
161+
assert (jsonStr.contains("userId"));
162+
assert (!jsonStr.contains("parentRefreshTokenHash1"));
163+
assert (!jsonStr.contains("antiCsrf"));
164+
assert (!jsonStr.contains("\"version\":\"V1\""));
165+
166+
sessionRegenerateRequest = new JsonObject();
167+
sessionRegenerateRequest.addProperty("accessToken", accessToken);
168+
toUpdate.addProperty("k2", "v2");
169+
sessionRegenerateRequest.add("userDataInJWT", toUpdate);
170+
171+
jsonResp = HttpRequestForTesting.sendJsonPOSTRequest(process.getProcess(), "",
172+
"http://localhost:3567/recipe/session/regenerate", sessionRegenerateRequest, 1000, 1000, null,
173+
SemVer.v2_21.get(), "session");
174+
assertEquals("OK", jsonResp.get("status").getAsString());
152175

153176
process.kill();
154177
assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));

0 commit comments

Comments
 (0)