\n * Authorization: :\n * \n * \n * The signed request hash is comprised of the session token + : + the relative url + , + the Http method + , + Date + , + nonce\n * This string is then Sha-256 encoded and then Base64 encoded\n * \n * An example:\n * \n * Example:\n * 9fbc6f9a-af1b-4767-a492-c8462fd2a4d9:user/2e2ce9e8-798e-42b6-9326-fd2e56aef7aa/cards,POST,2012-06-30T12:00:00+01:00,34e321a7c4\n * \n * \n * \n * This will be SHA-256 hashed and then Base64 encoded to produce:\n * \n * \n * HR/3DJp8RCGo50Wu+/3cr7ibdoNXKg1eYMt3HO5QoP4=\n * \n * \n * Authorization: 2e2ce9e8-798e-42b6-9326-fd2e56aef7aa:HR/3DJp8RCGo50Wu+/3cr7ibdoNXKg1eYMt3HO5QoP4=\n *\n * @author: Iain Porter\n */\npublic class RequestSigningAuthorizationService implements AuthorizationService {\n\n Logger LOG = LoggerFactory.getLogger(RequestSigningAuthorizationService.class);\n\n /**\n * If the nonce already exists in the cache the difference between its timestamp and the current time will be\n * greater than this value\n */\n private static final int NONCE_CHECK_TOLERANCE_IN_MILLIS = 20;\n\n /**\n * Maximum Number of Nonce values in the cache\n * The capacity will never be reached as long as the number of requests is below this value within the time range specified by\n * ApplicationConfig.getSessionDateOffsetInMinutes()\n */\n private static final int NONCE_CACHE_SIZE = 10000;\n\n /**\n * A an expiry cache that evicts nonce values after a configurable time period\n */\n private LoadingCache\n * Example:\n * 9fbc6f9a-af1b-4767-a492-c8462fd2a4d9:user/2e2ce9e8-798e-42b6-9326-fd2e56aef7aa,GET,2012-06-30T12:00:00+01:00,34e321a7c4\n * \n * \n * \n * This will be SHA-256 hashed and then Base64 encoded to produce:\n * \n * \n * HR/3DJp8RCGo50Wu+/3cr7ibdoNXKg1eYMt3HO5QoP4=\n * \n *\n * @param user should have a session token that will validate the request signature\n * @param authorizationRequest the request containing all the details needed to authorize the request\n * @param hashedToken the token to match against\n * @return true if the token is authorized\n */\n private boolean isAuthorized(User user, AuthorizationRequestContext authorizationRequest, String hashedToken) {\n Assert.notNull(user);\n Assert.notNull(authorizationRequest.getAuthorizationToken());\n String unEncodedString = composeUnEncodedRequest(authorizationRequest);\n AuthorizationToken authorizationToken = user.getAuthorizationToken();\n String userTokenHash = encodeAuthToken(authorizationToken.getToken(), unEncodedString);\n if (hashedToken.equals(userTokenHash)) {\n return true;\n }\n LOG.error(\"Hash check failed for hashed token: {} for the following request: {} for user: {}\",\n new Object[]{authorizationRequest.getAuthorizationToken(), unEncodedString, user.getId()});\n return false;\n }\n\n /**\n * Encode the token by prefixing it with the User's Session Token\n *\n * @param token\n * @return encoded token\n */\n private String encodeAuthToken(String token, String unencodedRequest) {\n byte[] digest = DigestUtils.sha256(token + \":\" + unencodedRequest);\n return new String(Base64.encodeBase64(digest));\n\n }\n\n /**\n * The recipe to compose a signed request\n *\n * @param authRequest\n * @return the string value to hash\n */\n private String composeUnEncodedRequest(AuthorizationRequestContext authRequest) {\n StringBuilder sb = new StringBuilder();\n sb.append(authRequest.getRequestUrl());\n sb.append(',');\n sb.append(authRequest.getHttpMethod().toUpperCase());\n sb.append(',');\n sb.append(authRequest.getRequestDateString());\n sb.append(',').append(authRequest.getNonceToken());\n return sb.toString();\n\n }\n\n /**\n * Ensure that the date of the request falls within the configured range\n * @param requestDateString\n */\n private void validateRequestDate(String requestDateString) {\n Date date = DateUtil.getDateFromIso8061DateString(requestDateString);\n DateTime now = new DateTime();\n DateTime offset = new DateTime(date);\n if (!(offset.isAfter(now.minusMinutes(config.getSessionDateOffsetInMinutes())) &&\n offset.isBefore(now.plusMinutes(config.getSessionDateOffsetInMinutes())))) {\n LOG.error(\"Date in header is out of range: {}\", requestDateString);\n throw new AuthorizationException(\"Date in header is out of range: \" + requestDateString);\n }\n }\n\n /**\n * The nonce value sent by the client and used in the request signature should be unique across the system\n * Nonce values will only be considered unique within the time limits of the cache.\n * The value will be protected if the cache expiry time is within the limits of the request date range.\n * If the date in the request is stale then the nonce value wil be irrelevant\n *\n * Note that the caching strategy will not work in a cluster. A distributed cache will be needed.\n *\n * @param nonceValue\n */\n private void validateNonce(String nonceValue) {\n Nonce nonce = nonceCache.getUnchecked(nonceValue);\n Duration tolerance = new Duration(nonce.timestamp, new DateTime());\n if (tolerance.isLongerThan(Duration.millis(NONCE_CHECK_TOLERANCE_IN_MILLIS))) {\n LOG.error(\"Nonce value was not unique: {}\", nonceValue);\n throw new AuthorizationException(\"Nonce value is not unique\");\n }\n }\n\n private static class Nonce {\n private DateTime timestamp;\n private String nonceValue;\n\n Nonce(DateTime time, String nonce) {\n this.timestamp = time;\n this.nonceValue = nonce;\n }\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/authorization/impl/SecurityContextImpl.java",
"content": "package com.porterhead.rest.authorization.impl;\n\nimport com.porterhead.rest.authorization.exception.InvalidAuthorizationHeaderException;\nimport com.porterhead.rest.user.api.ExternalUser;\nimport com.porterhead.rest.user.domain.Role;\n\nimport javax.ws.rs.core.SecurityContext;\nimport java.security.Principal;\n\n/**\n * Implementation of {@link javax.ws.rs.core.SecurityContext}\n *\n * User: porter\n * Date: 16/03/2012\n * Time: 16:13\n */\npublic class SecurityContextImpl implements SecurityContext {\n\n private final ExternalUser user;\n\n public SecurityContextImpl(ExternalUser user) {\n this.user = user;\n }\n\n public Principal getUserPrincipal() {\n return user;\n }\n\n public boolean isUserInRole(String role) {\n if(role.equalsIgnoreCase(Role.anonymous.name())) {\n return true;\n }\n if(user == null) {\n throw new InvalidAuthorizationHeaderException();\n }\n return user.getRole().equalsIgnoreCase(role);\n }\n\n public boolean isSecure() {\n return false;\n }\n\n public String getAuthenticationScheme() {\n return SecurityContext.BASIC_AUTH;\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/authorization/impl/SessionTokenAuthorizationService.java",
"content": "package com.porterhead.rest.authorization.impl;\n\nimport com.porterhead.rest.authorization.AuthorizationRequestContext;\nimport com.porterhead.rest.authorization.AuthorizationService;\nimport com.porterhead.rest.user.UserRepository;\nimport com.porterhead.rest.user.api.ExternalUser;\nimport com.porterhead.rest.user.domain.AuthorizationToken;\nimport com.porterhead.rest.user.domain.User;\nimport com.porterhead.rest.user.exception.AuthorizationException;\n\nimport java.util.Date;\n\n/**\n *\n * Simple authorization service that requires a session token in the Authorization header\n * This is then matched to a user\n *\n * @version 1.0\n * @author: Iain Porter\n * @since 29/01/2013\n */\npublic class SessionTokenAuthorizationService implements AuthorizationService {\n\n /**\n * directly access user objects\n */\n private final UserRepository userRepository;\n\n public SessionTokenAuthorizationService(UserRepository repository) {\n this.userRepository = repository;\n }\n\n public ExternalUser authorize(AuthorizationRequestContext securityContext) {\n String token = securityContext.getAuthorizationToken();\n ExternalUser externalUser = null;\n if(token == null) {\n return externalUser;\n }\n User user = userRepository.findBySession(token);\n if(user == null) {\n throw new AuthorizationException(\"Session token not valid\");\n }\n AuthorizationToken authorizationToken = user.getAuthorizationToken();\n if (authorizationToken.getToken().equals(token)) {\n externalUser = new ExternalUser(user);\n }\n return externalUser;\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/config/ApplicationConfig.java",
"content": "package com.porterhead.rest.config;\n\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.context.annotation.PropertySource;\nimport org.springframework.core.env.Environment;\n\n/**\n * User: porter\n * Date: 17/05/2012\n * Time: 19:07\n */\n@Configuration\n@PropertySource({\"classpath:/properties/app.properties\"})\npublic class ApplicationConfig {\n\n private final static String HOSTNAME_PROPERTY = \"hostNameUrl\";\n\n private final static String SECURITY_AUTHORIZATION_REQUIRE_SIGNED_REQUESTS = \"security.authorization.requireSignedRequests\";\n private final static String AUTHORIZATION_EXPIRY_DURATION = \"authorization.timeToLive.inSeconds\";\n private final static String SESSION_DATE_OFFSET_IN_MINUTES = \"session.date.offset.inMinutes\";\n private final static String TOKEN_EMAIL_REGISTRATION_DURATION = \"token.emailRegistration.timeToLive.inMinutes\";\n private final static String TOKEN_EMAIL_VERIFICATION_DURATION = \"token.emailVerification.timeToLive.inMinutes\";\n private final static String TOKEN_LOST_PASSWORD_DURATION = \"token.lostPassword.timeToLive.inMinutes\";\n private final static String EMAIL_SERVICES_FROM_ADDRESS = \"email.services.fromAddress\";\n private final static String EMAIL_SERVICES_REPLYTO_ADDRESS = \"email.services.replyTo\";\n private final static String EMAIL_SERVICES_VERIFICATION_EMAIL_SUBJECT_TEXT = \"email.services.emailVerificationSubjectText\";\n private final static String EMAIL_SERVICES_REGISTRATION_EMAIL_SUBJECT_TEXT = \"email.services.emailRegistrationSubjectText\";\n private final static String EMAIL_SERVICES_LOST_PASSWORD_SUBJECT_TEXT = \"email.services.lostPasswordSubjectText\";\n\n\n @Autowired\n protected Environment environment;\n\n public String getHostNameUrl() {\n return environment.getProperty(HOSTNAME_PROPERTY);\n }\n\n public String getFacebookClientId() {\n return environment.getProperty(\"facebook.clientId\");\n }\n\n public String getFacebookClientSecret() {\n return environment.getProperty(\"facebook.clientSecret\");\n }\n\n public int getAuthorizationExpiryTimeInSeconds() {\n return Integer.parseInt(environment.getProperty(AUTHORIZATION_EXPIRY_DURATION));\n }\n\n public int getSessionDateOffsetInMinutes() {\n return Integer.parseInt(environment.getProperty(SESSION_DATE_OFFSET_IN_MINUTES));\n }\n\n public int getEmailRegistrationTokenExpiryTimeInMinutes() {\n return Integer.parseInt(environment.getProperty(TOKEN_EMAIL_REGISTRATION_DURATION));\n }\n\n public int getEmailVerificationTokenExpiryTimeInMinutes() {\n return Integer.parseInt(environment.getProperty(TOKEN_EMAIL_VERIFICATION_DURATION));\n }\n\n public int getLostPasswordTokenExpiryTimeInMinutes() {\n return Integer.parseInt(environment.getProperty(TOKEN_LOST_PASSWORD_DURATION));\n }\n\n public String getEmailVerificationSubjectText() {\n return environment.getProperty(EMAIL_SERVICES_VERIFICATION_EMAIL_SUBJECT_TEXT);\n }\n\n public String getEmailRegistrationSubjectText() {\n return environment.getProperty(EMAIL_SERVICES_REGISTRATION_EMAIL_SUBJECT_TEXT);\n }\n\n public String getLostPasswordSubjectText() {\n return environment.getProperty(EMAIL_SERVICES_LOST_PASSWORD_SUBJECT_TEXT);\n }\n\n public String getEmailFromAddress() {\n return environment.getProperty(EMAIL_SERVICES_FROM_ADDRESS);\n }\n\n public String getEmailReplyToAddress() {\n return environment.getProperty(EMAIL_SERVICES_REPLYTO_ADDRESS);\n }\n\n public Boolean requireSignedRequests() {\n return environment.getProperty(SECURITY_AUTHORIZATION_REQUIRE_SIGNED_REQUESTS).equalsIgnoreCase(\"true\");\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/config/ApplicationDevConfig.java",
"content": "package com.porterhead.rest.config;\n\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.context.annotation.Profile;\nimport org.springframework.context.annotation.PropertySource;\nimport org.springframework.security.crypto.encrypt.Encryptors;\nimport org.springframework.security.crypto.encrypt.TextEncryptor;\n\n/**\n * @version 1.0\n * @author: Iain Porter iain.porter@porterhead.com\n * @since 21/09/2012\n */\n@Configuration\n@Profile(value={\"dev\", \"local\"})\n@PropertySource({\"classpath:/properties/dev-app.properties\"})\npublic class ApplicationDevConfig {\n\n @Bean\n public TextEncryptor textEncryptor() {\n return Encryptors.noOpText();\n }\n\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/config/ApplicationProductionConfig.java",
"content": "package com.porterhead.rest.config;\n\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.context.annotation.Profile;\nimport org.springframework.context.annotation.PropertySource;\nimport org.springframework.core.env.Environment;\nimport org.springframework.security.crypto.encrypt.Encryptors;\nimport org.springframework.security.crypto.encrypt.TextEncryptor;\n\n/**\n * @version 1.0\n * @author: Iain Porter iain.porter@porterhead.com\n * @since 21/09/2012\n */\n@Configuration\n@Profile(value=\"production\")\n@PropertySource({\"classpath:/properties/production-app.properties\"})\npublic class ApplicationProductionConfig {\n\n @Autowired\n Environment environment;\n\n @Bean\n public TextEncryptor textEncryptor() {\n return Encryptors.queryableText(environment.getProperty(\"security.encryptPassword\"),\n environment.getProperty(\"security.encryptSalt\"));\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/config/ApplicationStagingConfig.java",
"content": "package com.porterhead.rest.config;\n\nimport org.springframework.beans.factory.annotation.Autowired;\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.context.annotation.Profile;\nimport org.springframework.context.annotation.PropertySource;\nimport org.springframework.core.env.Environment;\nimport org.springframework.security.crypto.encrypt.Encryptors;\nimport org.springframework.security.crypto.encrypt.TextEncryptor;\n\n/**\n *\n * @version 1.0\n * @author: Iain Porter iain.porter@porterhead.com\n * @since 21/09/2012\n */\n@Configuration\n@Profile(value=\"staging\")\n@PropertySource({\"classpath:/properties/staging-app.properties\"})\npublic class ApplicationStagingConfig {\n\n @Autowired\n Environment environment;\n\n @Bean\n public TextEncryptor textEncryptor() {\n return Encryptors.queryableText(environment.getProperty(\"security.encryptPassword\"),\n environment.getProperty(\"security.encryptSalt\"));\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/exception/ApplicationRuntimeException.java",
"content": "package com.porterhead.rest.exception;\n\n\npublic class ApplicationRuntimeException extends BaseWebApplicationException {\n\n public ApplicationRuntimeException(String applicationMessage) {\n super(500, \"50002\", \"Internal System error\", applicationMessage);\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/exception/BaseWebApplicationException.java",
"content": "package com.porterhead.rest.exception;\n\nimport com.porterhead.rest.api.ErrorResponse;\n\nimport javax.ws.rs.WebApplicationException;\nimport javax.ws.rs.core.MediaType;\nimport javax.ws.rs.core.Response;\n\n/**\n * @version 1.0\n * @author: Iain Porter iain.porter@porterhead.com\n * @since 19/10/2012\n */\npublic abstract class BaseWebApplicationException extends WebApplicationException {\n\n private final int status;\n private final String errorMessage;\n private final String errorCode;\n private final String developerMessage;\n\n public BaseWebApplicationException(int httpStatus, String errorCode, String errorMessage, String developerMessage) {\n this.status = httpStatus;\n this.errorMessage = errorMessage;\n this.errorCode = errorCode;\n this.developerMessage = developerMessage;\n }\n\n\n @Override\n public Response getResponse() {\n return Response.status(status).type(MediaType.APPLICATION_JSON_TYPE).entity(getErrorResponse()).build();\n }\n\n public ErrorResponse getErrorResponse() {\n ErrorResponse response = new ErrorResponse();\n response.setErrorCode(errorCode);\n response.setApplicationMessage(developerMessage);\n response.setConsumerMessage(errorMessage);\n return response;\n }\n\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/exception/NotFoundException.java",
"content": "package com.porterhead.rest.exception;\n\nimport javax.ws.rs.WebApplicationException;\n\n/**\n * User: porter\n * Date: 03/05/2012\n * Time: 12:27\n */\npublic class NotFoundException extends WebApplicationException {\n\n public NotFoundException() {\n super(404);\n }\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/exception/ValidationException.java",
"content": "package com.porterhead.rest.exception;\n\nimport com.porterhead.rest.api.ErrorResponse;\nimport com.porterhead.rest.api.ValidationError;\n\nimport javax.validation.ConstraintViolation;\nimport javax.ws.rs.WebApplicationException;\nimport javax.ws.rs.core.MediaType;\nimport javax.ws.rs.core.Response;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Set;\n\n/**\n * User: porter\n * Date: 03/05/2012\n * Time: 21:43\n */\npublic class ValidationException extends WebApplicationException {\n\n private final int status = 400;\n private String errorMessage;\n private String developerMessage;\n private List\n * \n com.sun.jersey.spi.container.ResourceFilters \n com.porterhead.com.porterhead.rest.filter.ResourceFilterFactory \n \n * \n *\n *\n * @author: Iain Porter\n */\n@Component\n@Provider\npublic class ResourceFilterFactory extends RolesAllowedResourceFilterFactory {\n\n @Autowired\n private SecurityContextFilter securityContextFilter;\n\n @Override\n public List\n * /user/1883c578-76be-47fb-a5c1-7bbea3bf7fd0 using uuid as the identifier\n *\n * /user/jsmith using the username as the identifier\n *\n * \n *\n * @return Object unique identifier for the object\n */\n public Object getIdentifier() {\n return getUuid().toString();\n }\n\n public int getVersion() {\n return version;\n }\n\n public Date getTimeCreated() {\n return timeCreated;\n }\n\n}\n"
},
{
"path": "src/main/java/com/porterhead/rest/resource/GenericExceptionMapper.java",
"content": "package com.porterhead.rest.resource;\n\nimport org.slf4j.Logger;\nimport org.slf4j.LoggerFactory;\n\nimport javax.ws.rs.WebApplicationException;\nimport javax.ws.rs.core.Response;\nimport javax.ws.rs.ext.ExceptionMapper;\nimport javax.ws.rs.ext.Provider;\n\n/**\n * User: porter\n * Date: 22/03/2012\n * Time: 15:56\n */\n@Provider\npublic class GenericExceptionMapper implements ExceptionMapper\n\n
|
\n\n
|
\n\n
|