Refactor JWT issuance for claims override

Author: ujibang

core/src/test/java/karate/accounts/account-properties-claims-override.feature

@@ -76,3 +76,38 @@ Feature: override-accounts-account-properties-claims per-request + JWT claims de
     # The override REPLACES the static list — "teams" (from the static default) must
     # not leak in either, since it was not requested in this override.
     * match payload.teams == '#notpresent'
+
+  # ---------------------------------------------------------------------------
+  Scenario: /token applies the same per-request override and denylist
+  # ---------------------------------------------------------------------------
+    # Authenticate as a file-realm user that has a "profile" property,
+    # via /token (JwtTokenManager path) with the override.
+    * def creds = 'claimsTest:ClaimsPass123!'
+    * def Base64 = Java.type('java.util.Base64')
+    * def encoded = Base64.getEncoder().encodeToString(creds.getBytes())
+
+    Given path '/token'
+    And header Authorization = 'Basic ' + encoded
+    And param _claims-override = 'profile,password,emailVerificationToken'
+    When method POST
+    Then status 200
+    And match response.access_token == '#present'
+
+    # Decode the JWT
+    * def jwtPart = response.access_token
+    * def parts = jwtPart.split('.')
+    * def payloadJson = new java.lang.String(java.util.Base64.getUrlDecoder().decode(parts[1]))
+    * def payload = JSON.parse(payloadJson)
+    * karate.log('JWT payload from /token:', payload)
+
+    # Override took effect: "profile" is NOT in the static default list (teams),
+    # so its presence proves the per-request override was applied by JwtTokenManager.
+    * match payload.profile == '#present'
+    * match payload.profile.name == 'FileClaims'
+
+    # Denylist cannot be bypassed
+    * match payload.password == '#notpresent'
+    * match payload.emailVerificationToken == '#notpresent'
+
+    # Override REPLACES the static list — default claims must not leak
+    * match payload.teams == '#notpresent'

core/src/test/resources/etc/conf-overrides.yml

@@ -23,7 +23,7 @@
 /jwtTokenManager/enabled: true
 /jwtTokenManager/ttl: 15
 /jwtTokenManager/account-properties-claims:
-  - tenants
+  - teams
 
 /authCookieSetter/enabled: true
 /authCookieSetter/ttl: 15
@@ -39,6 +39,13 @@
       password: secret
       roles: [ test ]
 
+    - userid: claimsTest
+      password: ClaimsPass123!
+      roles: [ user ]
+      profile:
+        name: FileClaims
+      teams: [ acme ]
+
     - userid: testWithArray
       password: secret
       array: [ one, two, three ]

security/src/main/java/org/restheart/security/authenticators/MongoRealmAuthenticator.java

@@ -451,10 +451,13 @@ private MongoRealmAccount getAccount(final String usersDb, final String id) {
     }
 
     /**
-     * if client authenticates passing the real credentials, update the account
-     * in the auth-token cache, otherwise the client authenticating with the
-     * auth-token will not see roles updates until the cache expires (by default
-     * TTL is 15 minutes after last request)
+     * When a client authenticates with real credentials (Basic Auth), invalidate the
+     * cached auth-token so that the next token generation picks up fresh roles and
+     * account-properties-claims from the request context. Simply removing the stale
+     * entry is better than regenerating it here: this method runs before
+     * {@code TokenInjector} attaches the per-request claim list, so any token built
+     * at this point would use the node-wide default instead of the tenant-specific
+     * override.
      *
      * @param account
      */
@@ -463,11 +466,7 @@ private void updateAuthTokenCache(final PwdCredentialAccount account) {
             final var _tm = registry.getTokenManager();
 
             if (_tm != null) {
-                final var tm = _tm.getInstance();
-
-                if (tm.get(account) != null) {
-                    tm.update(account);
-                }
+                _tm.getInstance().invalidate(account);
             }
         } catch (final ConfigurationException pce) {
             LOGGER.warn("error getting the token manager", pce);

security/src/main/java/org/restheart/security/services/OAuthAuthorizationService.java

@@ -38,14 +38,14 @@
 import org.restheart.plugins.PluginsRegistry;
 import org.restheart.plugins.RegisterPlugin;
 import org.restheart.security.ACLRegistry;
+import org.restheart.security.WithProperties;
 import org.restheart.security.interceptors.FormDataToBasicAuthInterceptor;
 import org.restheart.security.tokens.JwtConfigProvider;
-import org.restheart.security.tokens.JwtTokenManager;
+import org.restheart.security.tokens.JwtIssuer;
 import org.restheart.utils.HttpStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import com.auth0.jwt.JWT;
 import com.auth0.jwt.algorithms.Algorithm;
 
 import io.undertow.util.Headers;
@@ -73,12 +73,17 @@
  * <p>The code JWT carries the following claims:
  * <ul>
  *   <li>{@code sub} — username</li>
+ *   <li>{@code iss} — issuer (from jwtConfigProvider)</li>
+ *   <li>{@code aud} — audience (from jwtConfigProvider, when configured)</li>
+ *   <li>{@code jti} — unique JWT identifier</li>
+ *   <li>{@code iat} — issued-at timestamp</li>
+ *   <li>{@code exp} — expiry ({@value #CODE_TTL_MINUTES} minutes)</li>
  *   <li>{@code roles} — array of roles</li>
  *   <li>{@code cc} — code_challenge (PKCE)</li>
  *   <li>{@code ccm} — code_challenge_method</li>
  *   <li>{@code ruri} — redirect_uri</li>
  *   <li>{@code cid} — client_id</li>
- *   <li>{@code exp} — expiry ({@value #CODE_TTL_MINUTES} minutes)</li>
+ *   <li>account-properties-claims (from {@link JwtIssuer})</li>
  * </ul>
  *
  * @author Andrea Di Cesare {@literal <andrea@softinstigate.com>}
@@ -118,18 +123,57 @@ public class OAuthAuthorizationService implements ByteArrayService {
 
     private String loginUrl;
     private List<String> allowedRedirectUris;
-    private Algorithm signingAlgo;
+    private volatile JwtIssuer jwtIssuer;
 
     @OnInit
     public void init() {
         this.loginUrl = argOrDefault(config, "login-url", null);
         this.allowedRedirectUris = argOrDefault(config, "allowed-redirect-uris", List.of());
-        this.signingAlgo = buildAlgorithm(jwtConfig);
 
         // allow unauthenticated GET (redirect to login) and authenticated POST (issue code)
         aclRegistry.registerAllow(req -> "/authorize".equals(req.getPath()));
     }
 
+    /**
+     * The shared JWT issuance policy. Built lazily: resolving the password property name
+     * needs {@code mongoRealmAuthenticator}, which may not be initialized when this plugin's
+     * {@code @OnInit} runs.
+     */
+    private JwtIssuer issuer() {
+        var local = this.jwtIssuer;
+
+        if (local == null) {
+            synchronized (this) {
+                local = this.jwtIssuer;
+                if (local == null) {
+                    var algo = buildAlgorithm(jwtConfig);
+                    local = new JwtIssuer(algo, jwtConfig.issuer(), jwtConfig.audience(),
+                            jwtConfig.accountPropertiesClaims(), resolvePasswordPropertyName());
+                    this.jwtIssuer = local;
+                }
+            }
+        }
+
+        return local;
+    }
+
+    private String resolvePasswordPropertyName() {
+        try {
+            var pr = registry.getAuthenticator("mongoRealmAuthenticator");
+            if (pr != null && pr.isEnabled()
+                    && pr.getInstance() instanceof org.restheart.security.authenticators.MongoRealmAuthenticator mra) {
+                var prop = mra.getPropPassword();
+                if (prop != null && !prop.isBlank()) {
+                    return prop;
+                }
+            }
+        } catch (Exception e) {
+            LOGGER.debug("Could not resolve mongoRealmAuthenticator/prop-password, using default", e);
+        }
+
+        return JwtIssuer.DEFAULT_PASSWORD_PROPERTY;
+    }
+
     @Override
     public void handle(ByteArrayRequest request, ByteArrayResponse response) throws Exception {
         switch (request.getMethod()) {
@@ -269,26 +313,26 @@ private void handlePost(ByteArrayRequest request, ByteArrayResponse response) {
 
         // Issue authorization code as a short-lived signed JWT.
         // Stateless: any node sharing the same JWT key can later verify it.
-        var roles = account.getRoles().toArray(String[]::new);
-        var codeBuilder = JWT.create()
-                .withIssuer(jwtConfig.issuer())
-                .withSubject(account.getPrincipal().getName())
-                .withExpiresAt(Date.from(Instant.now().plus(CODE_TTL_MINUTES, ChronoUnit.MINUTES)))
-                .withArrayClaim(CLAIM_ROLES, roles)
+        var jwtIssuer = issuer();
+        var codeBuilder = jwtIssuer.newBuilder(
+                        account.getPrincipal().getName(),
+                        account.getRoles(),
+                        Date.from(Instant.now().plus(CODE_TTL_MINUTES, ChronoUnit.MINUTES)))
+                .withIssuedAt(Instant.now())
                 .withClaim(CLAIM_CODE_CHALLENGE, codeChallenge)
                 .withClaim(CLAIM_CODE_CHALLENGE_METHOD, codeChallengeMethod)
                 .withClaim(CLAIM_REDIRECT_URI, redirectUri)
                 .withClaim(CLAIM_CLIENT_ID, clientId);
 
-        // Propagate account-properties-claims via JwtTokenManager so the logic stays in one place.
-        // The request carries the effective claim list on a multi-tenant deployment: the access
-        // token is later built from this code's payload, so a claim dropped here is lost for good.
-        var tokenMgr = registry.getTokenManager();
-        if (tokenMgr != null && tokenMgr.getInstance() instanceof JwtTokenManager jtm) {
-            codeBuilder = jtm.withAccountPropertiesClaims(codeBuilder, account, request);
+        // Propagate account-properties-claims so the access token (later built from this
+        // code's payload) carries the same claims. The request carries the effective claim
+        // list on a multi-tenant deployment.
+        if (account instanceof WithProperties<?> awp) {
+            codeBuilder = jwtIssuer.applyAccountClaims(codeBuilder, awp.propertiesAsMap(),
+                    JwtIssuer.claimsOverride(request));
         }
 
-        var code = codeBuilder.sign(signingAlgo);
+        var code = jwtIssuer.sign(codeBuilder);
 
         var sb = new StringBuilder(redirectUri);
         sb.append(redirectUri.contains("?") ? "&" : "?");