Skip to content

Commit d8059be

Browse files
blacelleblacelle
committed
Prevent oauth2 sub to leak through the API
1 parent 288225c commit d8059be

38 files changed

+450
-197
lines changed

‎authorization/src/main/java/eu/solven/kumite/oauth2/authorizationserver/KumiteTokenService.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
import com.nimbusds.jwt.JWTClaimsSet;
2323
import com.nimbusds.jwt.SignedJWT;
2424

25-
import eu.solven.kumite.account.KumiteUser;
25+
import eu.solven.kumite.account.internal.KumiteUserRaw;
2626
import eu.solven.kumite.login.AccessTokenWrapper;
2727
import eu.solven.kumite.login.RefreshTokenWrapper;
2828
import eu.solven.kumite.oauth2.IKumiteOAuth2Constants;
@@ -76,7 +76,7 @@ public static JWK generateSignatureSecret(IUuidGenerator uuidGenerator) {
7676
return jwk;
7777
}
7878

79-
public String generateAccessToken(KumiteUser user,
79+
public String generateAccessToken(KumiteUserRaw user,
8080
Set<UUID> playerIds,
8181
Duration accessTokenValidity,
8282
boolean isRefreshToken) {
@@ -143,7 +143,7 @@ private String getIssuer() {
143143
* @return The generated JWT access token.
144144
* @throws IllegalStateException
145145
*/
146-
public AccessTokenWrapper wrapInJwtAccessToken(KumiteUser user, UUID playerId) {
146+
public AccessTokenWrapper wrapInJwtAccessToken(KumiteUserRaw user, UUID playerId) {
147147
// access_token are short-lived
148148
Duration accessTokenValidity = Duration.parse("PT1H");
149149

@@ -161,7 +161,7 @@ public AccessTokenWrapper wrapInJwtAccessToken(KumiteUser user, UUID playerId) {
161161

162162
// https://stackoverflow.com/questions/38986005/what-is-the-purpose-of-a-refresh-token
163163
// https://stackoverflow.com/questions/40555855/does-the-refresh-token-expire-and-if-so-when
164-
public RefreshTokenWrapper wrapInJwtRefreshToken(KumiteUser user, Set<UUID> playerIds) {
164+
public RefreshTokenWrapper wrapInJwtRefreshToken(KumiteUserRaw user, Set<UUID> playerIds) {
165165
// refresh_token are long-lived
166166
Duration refreshTokenValidity = Duration.parse("P365D");
167167

‎contest-core/src/main/java/eu/solven/kumite/account/AccountSearchHandler.java

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import org.springframework.web.reactive.function.server.ServerRequest;
99
import org.springframework.web.reactive.function.server.ServerResponse;
1010

11+
import eu.solven.kumite.account.internal.KumiteUser;
1112
import eu.solven.kumite.app.webflux.api.KumiteHandlerHelper;
1213
import lombok.AllArgsConstructor;
1314
import reactor.core.publisher.Mono;

‎contest-core/src/main/java/eu/solven/kumite/account/IKumiteUserRepository.java

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
import java.util.Map;
44
import java.util.Optional;
55

6+
import eu.solven.kumite.account.internal.KumiteUser;
7+
import eu.solven.kumite.account.internal.KumiteUserPreRegister;
8+
69
/**
710
* This is kind-of a {@link Map} from {@link KumiteUserRawRaw} to {@link KumiteUser}.
811
*
@@ -12,5 +15,5 @@
1215
public interface IKumiteUserRepository {
1316
Optional<KumiteUser> getUser(KumiteUserRawRaw accountId);
1417

15-
KumiteUser registerOrUpdate(KumiteUserRaw kumiteUserRaw);
18+
KumiteUser registerOrUpdate(KumiteUserPreRegister kumiteUserPreRegister);
1619
}

‎contest-core/src/main/java/eu/solven/kumite/account/InMemoryUserRepository.java

+16-6
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,11 @@
66
import java.util.concurrent.ConcurrentHashMap;
77

88
import eu.solven.kumite.account.fake_player.FakePlayer;
9+
import eu.solven.kumite.account.fake_player.FakeUser;
910
import eu.solven.kumite.account.fake_player.RandomPlayer;
11+
import eu.solven.kumite.account.fake_player.RandomUser;
12+
import eu.solven.kumite.account.internal.KumiteUser;
13+
import eu.solven.kumite.account.internal.KumiteUserPreRegister;
1014
import eu.solven.kumite.player.IAccountPlayersRegistry;
1115
import eu.solven.kumite.player.KumitePlayer;
1216
import eu.solven.kumite.tools.IUuidGenerator;
@@ -39,18 +43,24 @@ public void putIfAbsent(UUID accountId, KumiteUserRawRaw rawRaw) {
3943
}
4044

4145
@Override
42-
public KumiteUser registerOrUpdate(KumiteUserRaw kumiteUserRaw) {
43-
KumiteUserRawRaw rawRaw = kumiteUserRaw.getRawRaw();
46+
public KumiteUser registerOrUpdate(KumiteUserPreRegister kumiteUserPreRegister) {
47+
KumiteUserRawRaw rawRaw = kumiteUserPreRegister.getRawRaw();
4448

4549
return accountIdToUser.compute(rawRaw, (k, alreadyIn) -> {
46-
KumiteUser.KumiteUserBuilder kumiteUserBuilder = KumiteUser.builder().raw(kumiteUserRaw);
50+
KumiteUser.KumiteUserBuilder kumiteUserBuilder = KumiteUser.builder()
51+
.rawRaw(rawRaw)
52+
// TODO We should merge with pre-existing details
53+
.details(kumiteUserPreRegister.getDetails());
4754
if (alreadyIn == null) {
4855
UUID accountId = generateAccountId(rawRaw);
4956

5057
KumitePlayer player = register(rawRaw, accountId);
5158

5259
UUID playerId = player.getPlayerId();
53-
log.info("Registering as new user accountId={} playerId={} raw={}", accountId, playerId, kumiteUserRaw);
60+
log.info("Registering as new user accountId={} playerId={} raw={}",
61+
accountId,
62+
playerId,
63+
kumiteUserPreRegister);
5464

5565
kumiteUserBuilder.accountId(accountId).playerId(playerId);
5666
} else {
@@ -66,9 +76,9 @@ protected UUID generateAccountId(KumiteUserRawRaw rawRaw) {
6676
}
6777

6878
public static UUID generateAccountId(IUuidGenerator uuidGenerator, KumiteUserRawRaw rawRaw) {
69-
if (rawRaw.equals(FakePlayer.user().getRaw().getRawRaw())) {
79+
if (rawRaw.equals(FakeUser.rawRaw())) {
7080
return FakePlayer.ACCOUNT_ID;
71-
} else if (rawRaw.equals(RandomPlayer.user().getRaw().getRawRaw())) {
81+
} else if (rawRaw.equals(RandomUser.rawRaw())) {
7282
return RandomPlayer.ACCOUNT_ID;
7383
}
7484
return uuidGenerator.randomUUID();

‎contest-core/src/main/java/eu/solven/kumite/account/KumiteUsersRegistry.java

+4-2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import java.util.Optional;
44
import java.util.UUID;
55

6+
import eu.solven.kumite.account.internal.KumiteUser;
7+
import eu.solven.kumite.account.internal.KumiteUserPreRegister;
68
import eu.solven.kumite.player.KumitePlayer;
79
import lombok.RequiredArgsConstructor;
810

@@ -35,8 +37,8 @@ public KumiteUser getUser(KumiteUserRawRaw rawUser) {
3537
* @return a {@link KumiteUser}. This may be a new account if this was not known. If this was already known, we
3638
* update the oauth2 details and return an existing accountId
3739
*/
38-
public KumiteUser registerOrUpdate(KumiteUserRaw kumiteUserRaw) {
39-
KumiteUser kumiteUser = userRepository.registerOrUpdate(kumiteUserRaw);
40+
public KumiteUser registerOrUpdate(KumiteUserPreRegister userPreRegister) {
41+
KumiteUser kumiteUser = userRepository.registerOrUpdate( userPreRegister);
4042

4143
return kumiteUser;
4244
}

‎contest-core/src/main/java/eu/solven/kumite/app/InjectKumiteAccountsConfig.java

+5-3
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,12 @@
55
import org.springframework.context.annotation.Configuration;
66
import org.springframework.context.annotation.Profile;
77

8-
import eu.solven.kumite.account.KumiteUser;
98
import eu.solven.kumite.account.KumiteUsersRegistry;
109
import eu.solven.kumite.account.fake_player.FakePlayer;
10+
import eu.solven.kumite.account.fake_player.FakeUser;
1111
import eu.solven.kumite.account.fake_player.RandomPlayer;
12+
import eu.solven.kumite.account.fake_player.RandomUser;
13+
import eu.solven.kumite.account.internal.KumiteUser;
1214
import eu.solven.kumite.player.IAccountPlayersRegistry;
1315
import lombok.extern.slf4j.Slf4j;
1416

@@ -23,7 +25,7 @@ public KumiteUser initFakePlayer(KumiteUsersRegistry usersRegistry,
2325
IAccountPlayersRegistry accountPlayersRegistry) {
2426
log.info("Registering the {} account and players", IKumiteSpringProfiles.P_FAKEUSER);
2527

26-
KumiteUser user = usersRegistry.registerOrUpdate(FakePlayer.user().getRaw());
28+
KumiteUser user = usersRegistry.registerOrUpdate(FakeUser.pre());
2729
// Register an additional player
2830
accountPlayersRegistry.registerPlayer(FakePlayer.player(1));
2931

@@ -36,7 +38,7 @@ public KumiteUser initRandomPlayer(KumiteUsersRegistry usersRegistry,
3638
IAccountPlayersRegistry accountPlayersRegistry) {
3739
log.info("Registering the random account and players");
3840

39-
KumiteUser user = usersRegistry.registerOrUpdate(RandomPlayer.user().getRaw());
41+
KumiteUser user = usersRegistry.registerOrUpdate(RandomUser.pre());
4042
// Register an additional player
4143
accountPlayersRegistry.registerPlayer(RandomPlayer.player(1));
4244

‎contest-core/src/main/java/eu/solven/kumite/randomgamer/RandomPlaysVs1Config.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
import org.springframework.context.annotation.Import;
1111
import org.springframework.context.annotation.Profile;
1212

13-
import eu.solven.kumite.account.KumiteUser;
13+
import eu.solven.kumite.account.internal.KumiteUser;
1414
import eu.solven.kumite.app.IKumiteSpringProfiles;
1515
import eu.solven.kumite.contest.ActiveContestGenerator;
1616
import eu.solven.kumite.contest.ContestSearchParameters;

‎contest-core/src/main/java/eu/solven/kumite/randomgamer/RandomPlaysVsThemselvesConfig.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
import org.springframework.context.annotation.Import;
99
import org.springframework.context.annotation.Profile;
1010

11-
import eu.solven.kumite.account.KumiteUser;
11+
import eu.solven.kumite.account.internal.KumiteUser;
1212
import eu.solven.kumite.app.IKumiteSpringProfiles;
1313
import eu.solven.kumite.contest.ActiveContestGenerator;
1414
import eu.solven.kumite.eventbus.EventSubscriber;

‎contest-core/src/test/java/eu/solven/kumite/scenario/TestTSPLifecycle.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@
1515
import org.springframework.test.context.TestPropertySource;
1616
import org.springframework.test.context.junit.jupiter.SpringExtension;
1717

18-
import eu.solven.kumite.account.KumiteUser;
1918
import eu.solven.kumite.account.KumiteUsersRegistry;
19+
import eu.solven.kumite.account.internal.KumiteUser;
2020
import eu.solven.kumite.account.login.IKumiteTestConstants;
2121
import eu.solven.kumite.app.IKumiteSpringProfiles;
2222
import eu.solven.kumite.app.KumiteServerComponentsConfiguration;
@@ -74,7 +74,7 @@ public class TestTSPLifecycle {
7474

7575
@Test
7676
public void testSinglePlayer() {
77-
KumiteUser account = usersRegistry.registerOrUpdate(IKumiteTestConstants.userRaw());
77+
KumiteUser account = usersRegistry.registerOrUpdate(IKumiteTestConstants.userPreRegister());
7878
UUID accountId = account.getAccountId();
7979

8080
List<GameMetadata> games =

‎player/src/main/java/eu/solven/kumite/app/KumiteWebclientServerProperties.java

+6-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,10 @@
44
import org.springframework.core.env.Profiles;
55

66
import eu.solven.kumite.account.fake_player.FakePlayer;
7+
import eu.solven.kumite.account.fake_player.FakeUser;
78
import eu.solven.kumite.account.fake_player.RandomPlayer;
9+
import eu.solven.kumite.account.fake_player.RandomUser;
10+
import eu.solven.kumite.account.internal.KumiteUser;
811
import eu.solven.kumite.login.RefreshTokenWrapper;
912
import eu.solven.kumite.oauth2.authorizationserver.KumiteTokenService;
1013
import eu.solven.kumite.tools.IUuidGenerator;
@@ -39,15 +42,15 @@ public static String loadRefreshToken(Environment env, IUuidGenerator uuidGenera
3942
}
4043
KumiteTokenService kumiteTokenService = new KumiteTokenService(env, uuidGenerator);
4144
RefreshTokenWrapper wrappedRefreshToken =
42-
kumiteTokenService.wrapInJwtRefreshToken(FakePlayer.user(), FakePlayer.fakePlayers());
45+
kumiteTokenService.wrapInJwtRefreshToken(KumiteUser.raw(FakeUser.user()), FakePlayer.fakePlayers());
4346
refreshToken = wrappedRefreshToken.getRefreshToken();
4447
} else if (KumiteWebclientServerProperties.PLACEHOLDER_GENERATERANDOMPLAYER.equals(refreshToken)) {
4548
{
4649
log.info("Generating on-the-fly a fakeUser refreshToken");
4750
}
4851
KumiteTokenService kumiteTokenService = new KumiteTokenService(env, uuidGenerator);
49-
RefreshTokenWrapper wrappedRefreshToken =
50-
kumiteTokenService.wrapInJwtRefreshToken(RandomPlayer.user(), RandomPlayer.playerIds());
52+
RefreshTokenWrapper wrappedRefreshToken = kumiteTokenService
53+
.wrapInJwtRefreshToken(KumiteUser.raw(RandomUser.user()), RandomPlayer.playerIds());
5154
refreshToken = wrappedRefreshToken.getRefreshToken();
5255
}
5356
return refreshToken;

‎public/src/main/java/eu/solven/kumite/account/KumiteUser.java

-46
This file was deleted.

‎public/src/main/java/eu/solven/kumite/account/KumiteUserRaw.java ‎public/src/main/java/eu/solven/kumite/account/KumiteUserDetails.java

+10-9
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import java.net.URI;
44

5+
import eu.solven.kumite.account.internal.KumiteUser;
56
import lombok.Builder;
67
import lombok.NonNull;
78
import lombok.Value;
@@ -16,9 +17,9 @@
1617
@Value
1718
@Builder
1819
@Jacksonized
19-
public class KumiteUserRaw {
20-
@NonNull
21-
KumiteUserRawRaw rawRaw;
20+
public class KumiteUserDetails {
21+
// @NonNull
22+
// KumiteUserRawRaw rawRaw;
2223

2324
@NonNull
2425
String username;
@@ -35,9 +36,9 @@ public class KumiteUserRaw {
3536
String school;
3637
String company;
3738

38-
private KumiteUserRawBuilder preloadBuilder() {
39-
return KumiteUserRaw.builder()
40-
.rawRaw(rawRaw)
39+
private KumiteUserDetailsBuilder preloadBuilder() {
40+
return KumiteUserDetails.builder()
41+
// .rawRaw(rawRaw)
4142
.username(username)
4243
.name(name)
4344
.email(email)
@@ -47,15 +48,15 @@ private KumiteUserRawBuilder preloadBuilder() {
4748
.company(company);
4849
}
4950

50-
public KumiteUserRaw setCountryCode(String countryCode) {
51+
public KumiteUserDetails setCountryCode(String countryCode) {
5152
return preloadBuilder().countryCode(countryCode).build();
5253
}
5354

54-
public KumiteUserRaw setCompany(String company) {
55+
public KumiteUserDetails setCompany(String company) {
5556
return preloadBuilder().company(company).build();
5657
}
5758

58-
public KumiteUserRaw setSchool(String school) {
59+
public KumiteUserDetails setSchool(String school) {
5960
return preloadBuilder().school(school).build();
6061
}
6162
}

‎public/src/main/java/eu/solven/kumite/account/KumiteUserRawRaw.java

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package eu.solven.kumite.account;
22

3+
import eu.solven.kumite.account.internal.KumiteUser;
34
import lombok.Builder;
45
import lombok.NonNull;
56
import lombok.Value;

‎public/src/main/java/eu/solven/kumite/account/fake_player/FakePlayer.java

-14
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
import java.util.Set;
44
import java.util.UUID;
55

6-
import eu.solven.kumite.account.KumiteUser;
7-
import eu.solven.kumite.account.KumiteUserRaw;
8-
import eu.solven.kumite.account.KumiteUserRawRaw;
96
import eu.solven.kumite.player.KumitePlayer;
107
import lombok.extern.slf4j.Slf4j;
118

@@ -42,17 +39,6 @@ public static boolean isFakePlayer(UUID playerId) {
4239
}
4340
}
4441

45-
public static KumiteUser user() {
46-
KumiteUserRawRaw rawRaw = KumiteUserRawRaw.builder().providerId("kumite").sub("fakeSub").build();
47-
KumiteUserRaw raw = KumiteUserRaw.builder()
48-
.rawRaw(rawRaw)
49-
.username("fakeUsername")
50-
.email("fake@fake")
51-
.name("Fake User")
52-
.build();
53-
return KumiteUser.builder().accountId(ACCOUNT_ID).playerId(PLAYER_ID1).raw(raw).build();
54-
}
55-
5642
public static KumitePlayer fakePlayer() {
5743
return KumitePlayer.builder().playerId(PLAYER_ID1).accountId(ACCOUNT_ID).build();
5844
}

‎public/src/main/java/eu/solven/kumite/account/fake_player/FakeUser.java

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package eu.solven.kumite.account.fake_player;
2+
3+
import eu.solven.kumite.account.KumiteUserDetails;
4+
import eu.solven.kumite.account.KumiteUserRawRaw;
5+
import eu.solven.kumite.account.internal.KumiteUser;
6+
import eu.solven.kumite.account.internal.KumiteUserPreRegister;
7+
8+
public class FakeUser {
9+
10+
public static KumiteUserRawRaw rawRaw() {
11+
return KumiteUserRawRaw.builder().providerId("kumite").sub("fakeSub").build();
12+
}
13+
14+
public static KumiteUserPreRegister pre() {
15+
KumiteUserDetails details =
16+
KumiteUserDetails.builder().username("fakeUsername").email("fake@fake").name("Fake User").build();
17+
return KumiteUserPreRegister.builder().rawRaw(rawRaw()).details(details).build();
18+
}
19+
20+
public static KumiteUser user() {
21+
KumiteUserPreRegister pre = pre();
22+
return KumiteUser.builder()
23+
.accountId(FakePlayer.ACCOUNT_ID)
24+
.playerId(FakePlayer.PLAYER_ID1)
25+
.rawRaw(pre.getRawRaw())
26+
.details(pre.getDetails())
27+
.build();
28+
}
29+
30+
}

0 commit comments

Comments
 (0)