notes-vci-token #112
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ plugins { | |
| } | ||
|
|
||
| group = 'es.in2' | ||
| version = '3.0.0' | ||
|
|
||
| java { | ||
| sourceCompatibility = '17' | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| package es.in2.issuer.backend.oidc4vci.domain.service.impl; | ||
|
|
||
| import com.nimbusds.jose.JWSObject; | ||
| import com.nimbusds.jose.Payload; | ||
| import es.in2.issuer.backend.oidc4vci.domain.model.TokenResponse; | ||
| import es.in2.issuer.backend.oidc4vci.domain.service.TokenWorkflow; | ||
| import es.in2.issuer.backend.shared.domain.service.CredentialIssuanceRecordService; | ||
| import es.in2.issuer.backend.shared.domain.service.JWTService; | ||
| import es.in2.issuer.backend.shared.domain.util.JwtUtils; | ||
| import es.in2.issuer.backend.shared.infrastructure.config.AppConfig; | ||
| import es.in2.issuer.backend.shared.infrastructure.repository.CacheStore; | ||
| import lombok.RequiredArgsConstructor; | ||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.springframework.stereotype.Service; | ||
| import reactor.core.publisher.Mono; | ||
|
|
||
| import java.time.Instant; | ||
| import java.time.temporal.ChronoUnit; | ||
| import java.util.Map; | ||
| import java.util.NoSuchElementException; | ||
|
|
||
| import static es.in2.issuer.backend.oidc4vci.domain.util.Constants.ACCESS_TOKEN_EXPIRATION_TIME_MINUTES; | ||
| import static es.in2.issuer.backend.oidc4vci.domain.util.Constants.REFRESH_TOKEN_EXPIRATION_TIME_DAYS; | ||
| import static es.in2.issuer.backend.shared.domain.util.Constants.GRANT_TYPE; | ||
|
|
||
| @Slf4j | ||
| @Service | ||
| @RequiredArgsConstructor | ||
| public class TokenWorkflowImpl implements TokenWorkflow { | ||
|
|
||
| private final CredentialIssuanceRecordService credentialIssuanceRecordService; | ||
| private final CacheStore<String> txCodeByPreAuthorizedCodeCacheStore; | ||
| private final JWTService jwtService; | ||
| private final AppConfig appConfig; | ||
| private final JwtUtils jwtUtils; | ||
|
|
||
| @Override | ||
| public Mono<TokenResponse> generateTokenResponse( | ||
| String grantType, | ||
| String preAuthorizedCode, | ||
| String txCode) { | ||
|
|
||
| return ensureGrantTypeIsPreAuthorizedCodeAndTxCodeAreCorrect(grantType, preAuthorizedCode, txCode) | ||
| .then(buildTokenResponse(preAuthorizedCode)); | ||
| } | ||
|
|
||
| private Mono<TokenResponse> buildTokenResponse(String preAuthorizedCode) { | ||
| Instant issueTime = Instant.now(); | ||
| long issueTimeEpochSeconds = issueTime.getEpochSecond(); | ||
| long accessTokenExpirationTimeEpochSeconds = generateAccessTokenExpirationTime(issueTime); | ||
| String accessToken = generateAccessToken(preAuthorizedCode, issueTimeEpochSeconds, accessTokenExpirationTimeEpochSeconds); | ||
| String tokenType = "bearer"; | ||
| long expiresIn = accessTokenExpirationTimeEpochSeconds - Instant.now().getEpochSecond(); | ||
| long refreshTokenExpirationTimeEpochSeconds = generateRefreshTokenExpirationTime(issueTime); | ||
| String refreshToken = generateRefreshToken(issueTimeEpochSeconds, refreshTokenExpirationTimeEpochSeconds); | ||
|
|
||
| return credentialIssuanceRecordService.getIdByPreAuthorizedCode(preAuthorizedCode) | ||
| .flatMap(credentialIssuanceRecordId -> { | ||
| String accessTokenJti = jwtUtils.getJti(accessToken); | ||
| String refreshTokenJti = jwtUtils.getJti(refreshToken); | ||
| return credentialIssuanceRecordService.setJtis( | ||
| credentialIssuanceRecordId, | ||
| accessTokenJti, | ||
| refreshTokenJti) | ||
| .thenReturn(TokenResponse.builder() | ||
| .accessToken(accessToken) | ||
| .tokenType(tokenType) | ||
| .expiresIn(expiresIn) | ||
| .refreshToken(refreshToken) | ||
| .build()); | ||
| }); | ||
| } | ||
|
|
||
| private String generateRefreshToken(long issueTimeEpochSeconds, long expirationTimeEpochSeconds) { | ||
| Payload payload = new Payload(Map.of( | ||
| "iss", appConfig.getIssuerBackendUrl(), | ||
| "iat", issueTimeEpochSeconds, | ||
| "exp", expirationTimeEpochSeconds | ||
| )); | ||
| return jwtService.generateJWT(payload.toString()); | ||
| } | ||
|
|
||
| private long generateAccessTokenExpirationTime(Instant issueTime) { | ||
| return issueTime.plus( | ||
| ACCESS_TOKEN_EXPIRATION_TIME_MINUTES, | ||
| ChronoUnit.MINUTES) | ||
| .getEpochSecond(); | ||
| } | ||
|
|
||
| private long generateRefreshTokenExpirationTime(Instant issueTime) { | ||
albertrodriguezin2 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| return issueTime.plus( | ||
| REFRESH_TOKEN_EXPIRATION_TIME_DAYS, | ||
| ChronoUnit.DAYS) | ||
| .getEpochSecond(); | ||
| } | ||
|
|
||
| private String generateAccessToken(String preAuthorizedCode, long issueTimeEpochSeconds, long expirationTimeEpochSeconds) { | ||
| Payload payload = new Payload(Map.of( | ||
| "iss", appConfig.getIssuerBackendUrl(), | ||
| "iat", issueTimeEpochSeconds, | ||
| "exp", expirationTimeEpochSeconds, | ||
| "jti", preAuthorizedCode | ||
| )); | ||
| return jwtService.generateJWT(payload.toString()); | ||
| } | ||
|
|
||
| private Mono<Void> ensureGrantTypeIsPreAuthorizedCodeAndTxCodeAreCorrect(String grantType, String preAuthorizedCode, String txCode) { | ||
|
Collaborator
There was a problem hiding this comment. creus que es pot separar la reponsabilitat de ensureGrantTypeIsPreAuthorizedCodeAndTxCodeAreCorrect()? Per un costat el grant_type i per altre el pre-authorized_code y el tx_code?
Contributor
Author
There was a problem hiding this comment. Abans ho teníem per separat (a main està així) i em vas demanar que ho unís en una sola funció.
Contributor
Author
There was a problem hiding this comment. Separar-ho |
||
| if (!GRANT_TYPE.equals(grantType)) { | ||
| return Mono.error(new IllegalArgumentException("Invalid grant type")); | ||
| } | ||
|
|
||
| return txCodeByPreAuthorizedCodeCacheStore | ||
| .get(preAuthorizedCode) | ||
| .onErrorMap(NoSuchElementException.class, ex -> new IllegalArgumentException("Invalid pre-authorized code")) | ||
| .flatMap(cacheTxCode -> | ||
| cacheTxCode.equals(txCode) | ||
| ? Mono.empty() | ||
| : Mono.error(new IllegalArgumentException("Invalid tx code")) | ||
| ); | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.