PD-6057 PD-6040 fixed 500 for revoke token and the incomplete source for affiliations (#7603)

* PD-6040 Populate the uri and host for source

* PD-6057  Fixed 500 error

Do we still need Features.OAUTH_TOKEN_VALIDATION.isActive()  check  or we should remove the legacy code

* Removed legacy code as oauth server is always on

Author: Camelia-Orcid

orcid-core/src/main/java/org/orcid/core/adapter/v3/impl/MapperFacadeFactory.java

@@ -405,10 +405,54 @@ public void mapBtoA(SourceAwareEntity<?> b, SourceAware a, MappingContext contex
                 }
             }
 
+            populateSourceUriAndHost(source);
+
             a.setSource(source);
         }
     }
 
+    private void populateSourceUriAndHost(Source source) {
+        if (source == null) {
+            return;
+        }
+
+        if (source.getSourceOrcid() != null && StringUtils.isNotBlank(source.getSourceOrcid().getPath())) {
+            if (StringUtils.isBlank(source.getSourceOrcid().getHost())) {
+                source.getSourceOrcid().setHost(orcidUrlManager.getBaseHost());
+            }
+            if (StringUtils.isBlank(source.getSourceOrcid().getUri())) {
+                source.getSourceOrcid().setUri(orcidUrlManager.getBaseUrl() + "/" + source.getSourceOrcid().getPath());
+            }
+        }
+
+        if (source.getSourceClientId() != null && StringUtils.isNotBlank(source.getSourceClientId().getPath())) {
+            if (StringUtils.isBlank(source.getSourceClientId().getHost())) {
+                source.getSourceClientId().setHost(orcidUrlManager.getBaseHost());
+            }
+            if (StringUtils.isBlank(source.getSourceClientId().getUri())) {
+                source.getSourceClientId().setUri(orcidUrlManager.getBaseUrl() + "/client/" + source.getSourceClientId().getPath());
+            }
+        }
+
+        if (source.getAssertionOriginOrcid() != null && StringUtils.isNotBlank(source.getAssertionOriginOrcid().getPath())) {
+            if (StringUtils.isBlank(source.getAssertionOriginOrcid().getHost())) {
+                source.getAssertionOriginOrcid().setHost(orcidUrlManager.getBaseHost());
+            }
+            if (StringUtils.isBlank(source.getAssertionOriginOrcid().getUri())) {
+                source.getAssertionOriginOrcid().setUri(orcidUrlManager.getBaseUrl() + "/" + source.getAssertionOriginOrcid().getPath());
+            }
+        }
+
+        if (source.getAssertionOriginClientId() != null && StringUtils.isNotBlank(source.getAssertionOriginClientId().getPath())) {
+            if (StringUtils.isBlank(source.getAssertionOriginClientId().getHost())) {
+                source.getAssertionOriginClientId().setHost(orcidUrlManager.getBaseHost());
+            }
+            if (StringUtils.isBlank(source.getAssertionOriginClientId().getUri())) {
+                source.getAssertionOriginClientId().setUri(orcidUrlManager.getBaseUrl() + "/client/" + source.getAssertionOriginClientId().getPath());
+            }
+        }
+    }
+
     private Source extractSourceFromEntityWithoutUtils(SourceAwareEntity<?> entity) {
         Source source = new Source();
 

orcid-web/src/main/java/org/orcid/frontend/oauth2/RevokeController.java

@@ -10,10 +10,9 @@
 import org.orcid.core.oauth.authorizationServer.AuthorizationServerUtil;
 import org.orcid.core.togglz.Features;
 import org.orcid.pojo.ajaxForm.PojoUtil;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -25,45 +24,45 @@
 @RequestMapping(value = { T2OrcidApiService.OAUTH_REVOKE }, consumes = MediaType.APPLICATION_FORM_URLENCODED, produces = MediaType.APPLICATION_JSON)
 public class RevokeController {
 
-    private static final Logger LOGGER = LoggerFactory.getLogger(RevokeController.class);
-
     @Resource
     private AuthorizationServerUtil authorizationServerUtil;
 
     @RequestMapping
     public ResponseEntity<?> revoke(HttpServletRequest request) throws IOException, URISyntaxException, InterruptedException {
         String tokenToRevoke = request.getParameter("token");
+        String authorization = request.getHeader("Authorization");
         Response r = null;
-        
-        if(Features.OAUTH_TOKEN_VALIDATION.isActive()) {
-            // Forward the request to the authorization server
-            if (PojoUtil.isEmpty(tokenToRevoke)) {
-                throw new IllegalArgumentException("Please provide the token to be param");
-            }
-            if(StringUtils.isNotBlank(request.getHeader("Authorization"))) {
-                String authorization = request.getHeader("Authorization");
-                r = authorizationServerUtil.forwardTokenRevocationRequest(authorization, tokenToRevoke);
-            } else {
-                String clientId = SecurityContextHolder.getContext().getAuthentication().getName();
-                String clientSecret = request.getParameter("client_secret");
-                r = authorizationServerUtil.forwardTokenRevocationRequest(clientId, clientSecret, tokenToRevoke);
-            }
-            HttpHeaders responseHeaders = new HttpHeaders();
-            responseHeaders.set(Features.OAUTH_TOKEN_VALIDATION.name(),
-                    "ON");
-            return ResponseEntity.status(r.getStatus()).headers(responseHeaders).body(r.getEntity());
+
+        if (PojoUtil.isEmpty(tokenToRevoke)) {
+            throw new IllegalArgumentException("Please provide the token to be param");
+        }
+
+        // Forward the request to the authorization server
+        if (StringUtils.isNotBlank(authorization)) {
+            r = authorizationServerUtil.forwardTokenRevocationRequest(authorization, tokenToRevoke);
         } else {
-            String clientId = SecurityContextHolder.getContext().getAuthentication().getName();
+            String clientId = resolveClientId(request);
             String clientSecret = request.getParameter("client_secret");
-            if (PojoUtil.isEmpty(tokenToRevoke)) {
-                throw new IllegalArgumentException("Please provide the token to be param");
-            }
             r = authorizationServerUtil.forwardTokenRevocationRequest(clientId, clientSecret, tokenToRevoke);
         }
         HttpHeaders responseHeaders = new HttpHeaders();
-        responseHeaders.set(Features.OAUTH_TOKEN_VALIDATION.name(),
-                "ON");
+        responseHeaders.set(Features.OAUTH_TOKEN_VALIDATION.name(), "ON");
         return ResponseEntity.status(r.getStatus()).headers(responseHeaders).body(r.getEntity());
+
+    }
+
+    private String resolveClientId(HttpServletRequest request) {
+        String clientId = request.getParameter("client_id");
+        if (StringUtils.isNotBlank(clientId)) {
+            return clientId;
+        }
+
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication != null && StringUtils.isNotBlank(authentication.getName())) {
+            return authentication.getName();
+        }
+
+        throw new IllegalArgumentException("Please provide client_id or Authorization header");
     }
 
 }