@@ -6,6 +6,7 @@ import io.openfuture.api.config.propety.AuthorizationProperties
6
6
import org.springframework.http.HttpStatus.UNAUTHORIZED
7
7
import io.openfuture.api.domain.exception.ExceptionResponse
8
8
import io.openfuture.api.domain.key.WalletApiCreateRequest
9
+ import io.openfuture.api.domain.state.WalletApiStateRequest
9
10
import io.openfuture.api.service.ApplicationService
10
11
import io.openfuture.api.util.*
11
12
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
@@ -34,24 +35,43 @@ class PublicApiAuthorizationFilter(
34
35
35
36
val accessKey = request.getHeader(" X-API-KEY" )
36
37
val signature = request.getHeader(" X-API-SIGNATURE" )
37
- val expirePeriod = properties.expireApi!!
38
38
39
39
val requestWrapper = CustomHttpRequestWrapper (request)
40
40
val walletApiCreateRequest =
41
41
mapper.readValue(requestWrapper.bodyInStringFormat, WalletApiCreateRequest ::class .java)
42
-
43
- val diffMinutes = differenceEpochs(currentEpochs(), walletApiCreateRequest.timestamp.toLong() )
42
+ val mapper = jacksonObjectMapper()
43
+ val str = mapper.writeValueAsString(walletApiCreateRequest )
44
44
45
45
val application = applicationService.getByAccessKey(accessKey)
46
46
47
+ if (! checkHash(accessKey, signature, walletApiCreateRequest.timestamp.toLong(), str)) {
48
+ val exceptionResponse = ExceptionResponse (UNAUTHORIZED .value(), " Signature mismatch or request timeout" )
49
+ response.status = exceptionResponse.status
50
+ response.writer.write(mapper.writeValueAsString(exceptionResponse))
51
+ return
52
+ }
53
+
54
+ val token = UsernamePasswordAuthenticationToken (application.user, null , listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" )))
55
+ SecurityContextHolder .getContext().authentication = token
56
+
57
+ chain.doFilter(requestWrapper, response)
58
+ return
59
+ }
60
+
61
+ else if (request.requestURI.startsWith(" /public" ) && request.getHeader(" OPEN-API-KEY" ) != null ) {
62
+
63
+ val accessKey = request.getHeader(" OPEN-API-KEY" )
64
+ val signature = request.getHeader(" OPEN-API-SIGNATURE" )
65
+
66
+ val requestWrapper = CustomHttpRequestWrapper (request)
67
+ val walletApiStateRequest =
68
+ mapper.readValue(requestWrapper.bodyInStringFormat, WalletApiStateRequest ::class .java)
47
69
val mapper = jacksonObjectMapper()
48
- val str = mapper.writeValueAsString(walletApiCreateRequest )
70
+ val str = mapper.writeValueAsString(walletApiStateRequest )
49
71
50
- val hmacSha256 = application.let {
51
- KeyGeneratorUtils .calcHmacSha256(it.apiSecretKey, str)
52
- }
72
+ val application = applicationService.getByAccessKey(accessKey)
53
73
54
- if (hmacSha256 != signature || diffMinutes > expirePeriod ) {
74
+ if (! checkHash(accessKey, signature, walletApiStateRequest.timestamp.toLong(), str) ) {
55
75
val exceptionResponse = ExceptionResponse (UNAUTHORIZED .value(), " Signature mismatch or request timeout" )
56
76
response.status = exceptionResponse.status
57
77
response.writer.write(mapper.writeValueAsString(exceptionResponse))
@@ -65,11 +85,26 @@ class PublicApiAuthorizationFilter(
65
85
return
66
86
}
67
87
68
-
69
88
chain.doFilter(request, response)
70
89
}
71
90
72
91
override fun destroy () {
73
92
// Do nothing
74
93
}
94
+
95
+ private fun checkHash (accessKey : String , signature : String , timestamp : Long , str : String ): Boolean {
96
+ val diffMinutes = differenceEpochs(currentEpochs(), timestamp)
97
+ val expirePeriod = properties.expireApi!!
98
+
99
+ val application = applicationService.getByAccessKey(accessKey)
100
+
101
+ val hmacSha256 = application.let {
102
+ KeyGeneratorUtils .calcHmacSha256(it.apiSecretKey, str)
103
+ }
104
+
105
+ if (hmacSha256 != signature || diffMinutes > expirePeriod) {
106
+ return false
107
+ }
108
+ return true
109
+ }
75
110
}
0 commit comments