@@ -3,12 +3,14 @@ package io.openfuture.api.config.filter
33import com.fasterxml.jackson.databind.ObjectMapper
44import com.fasterxml.jackson.module.kotlin.jacksonObjectMapper
55import io.openfuture.api.config.propety.AuthorizationProperties
6- import org.springframework.http.HttpStatus.UNAUTHORIZED
76import io.openfuture.api.domain.exception.ExceptionResponse
87import io.openfuture.api.domain.key.WalletApiCreateRequest
98import io.openfuture.api.domain.state.WalletApiStateRequest
9+ import io.openfuture.api.entity.application.Application
1010import io.openfuture.api.service.ApplicationService
1111import io.openfuture.api.util.*
12+ import org.springframework.http.HttpStatus.NOT_FOUND
13+ import org.springframework.http.HttpStatus.UNAUTHORIZED
1214import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
1315import org.springframework.security.core.authority.SimpleGrantedAuthority
1416import org.springframework.security.core.context.SecurityContextHolder
@@ -36,44 +38,54 @@ class PublicApiAuthorizationFilter(
3638 val accessKey = request.getHeader(" X-API-KEY" )
3739 val signature = request.getHeader(" X-API-SIGNATURE" )
3840
39- val application = applicationService.getByAccessKey(accessKey)
40-
41- if (request.method == " POST" ) {
42-
43- val requestWrapper = CustomHttpRequestWrapper (request)
44- val walletApiCreateRequest =
45- mapper.readValue(requestWrapper.bodyInStringFormat, WalletApiCreateRequest ::class .java)
46- val mapper = jacksonObjectMapper()
47- val str = mapper.writeValueAsString(walletApiCreateRequest)
48-
49- if (! checkHash(accessKey, signature, walletApiCreateRequest.timestamp.toLong(), str)) {
50- val exceptionResponse =
51- ExceptionResponse (UNAUTHORIZED .value(), " Signature mismatch or request timeout" )
52- response.status = exceptionResponse.status
53- response.writer.write(mapper.writeValueAsString(exceptionResponse))
41+ try {
42+ val application = applicationService.getByAccessKey(accessKey)
43+
44+ if (request.method == " POST" ) {
45+
46+ val requestWrapper = CustomHttpRequestWrapper (request)
47+ val walletApiCreateRequest =
48+ mapper.readValue(requestWrapper.bodyInStringFormat, WalletApiCreateRequest ::class .java)
49+ val mapper = jacksonObjectMapper()
50+ val str = mapper.writeValueAsString(walletApiCreateRequest)
51+
52+ if (! checkHash(application, signature, str, walletApiCreateRequest.timestamp.toLong())) {
53+ println (" Signature mismatch or request timeout" )
54+ val exceptionResponse =
55+ ExceptionResponse (UNAUTHORIZED .value(), " Signature mismatch or request timeout" )
56+ response.status = exceptionResponse.status
57+ response.writer.write(mapper.writeValueAsString(exceptionResponse))
58+ return
59+ }
60+
61+ val token = UsernamePasswordAuthenticationToken (
62+ application.user,
63+ null ,
64+ listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" ))
65+ )
66+ SecurityContextHolder .getContext().authentication = token
67+
68+ chain.doFilter(requestWrapper, response)
69+ return
70+ } else {
71+ val token = UsernamePasswordAuthenticationToken (
72+ application.user,
73+ null ,
74+ listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" ))
75+ )
76+ SecurityContextHolder .getContext().authentication = token
77+
78+ chain.doFilter(request, response)
5479 return
5580 }
5681
57- val token = UsernamePasswordAuthenticationToken (
58- application.user,
59- null ,
60- listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" ))
61- )
62- SecurityContextHolder .getContext().authentication = token
63-
64- chain.doFilter(requestWrapper, response)
65- return
82+ } catch (exception: RuntimeException ) {
83+ println (" Exception thrown" )
84+ response.setContentType(" application/json" )
85+ response.setStatus(NOT_FOUND .value())
6686 }
67- else {
68- val token = UsernamePasswordAuthenticationToken (application.user, null , listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" )))
69- SecurityContextHolder .getContext().authentication = token
7087
71- chain.doFilter(request, response)
72- return
73- }
74- }
75-
76- else if (request.requestURI.startsWith(" /public" ) && request.getHeader(" OPEN-API-KEY" ) != null ) {
88+ } /* else if (request.requestURI.startsWith("/public") && request.getHeader("OPEN-API-KEY") != null) {
7789
7890 val accessKey = request.getHeader("OPEN-API-KEY")
7991 val signature = request.getHeader("OPEN-API-SIGNATURE")
@@ -86,19 +98,23 @@ class PublicApiAuthorizationFilter(
8698
8799 val application = applicationService.getByAccessKey(accessKey)
88100
89- if (! checkHash(accessKey , signature, walletApiStateRequest.timestamp.toLong(), str )) {
101+ if (!checkHash(application , signature, str, walletApiStateRequest.timestamp.toLong())) {
90102 val exceptionResponse = ExceptionResponse(UNAUTHORIZED.value(), "Signature mismatch or request timeout")
91103 response.status = exceptionResponse.status
92104 response.writer.write(mapper.writeValueAsString(exceptionResponse))
93105 return
94106 }
95107
96- val token = UsernamePasswordAuthenticationToken (application.user, null , listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" )))
108+ val token = UsernamePasswordAuthenticationToken(
109+ application.user,
110+ null,
111+ listOf(SimpleGrantedAuthority("ROLE_APPLICATION"))
112+ )
97113 SecurityContextHolder.getContext().authentication = token
98114
99115 chain.doFilter(requestWrapper, response)
100116 return
101- }
117+ }*/
102118
103119 chain.doFilter(request, response)
104120 }
@@ -107,16 +123,18 @@ class PublicApiAuthorizationFilter(
107123 // Do nothing
108124 }
109125
110- private fun checkHash (accessKey : String , signature : String , timestamp : Long , str : String ): Boolean {
126+ private fun checkHash (application : Application , signature : String , str : String , timestamp : Long ): Boolean {
127+
111128 val diffMinutes = differenceEpochs(currentEpochs(), timestamp)
112129 val expirePeriod = properties.expireApi!!
113130
114- val application = applicationService.getByAccessKey(accessKey)
115-
116131 val hmacSha256 = application.let {
117132 KeyGeneratorUtils .calcHmacSha256(it.apiSecretKey, str)
118133 }
119-
134+ println (hmacSha256)
135+ println (signature)
136+ println (" HASH ${hmacSha256 != signature} " )
137+ println (" PERIOD ${diffMinutes > expirePeriod} " )
120138 if (hmacSha256 != signature || diffMinutes > expirePeriod) {
121139 return false
122140 }
0 commit comments