generator-jhipster 8.2.0 → 8.2.1

package/dist/generators/server/templates/src/main/java/package/security/SpringSecurityAuditorAware.java.ejs

@@ -1,38 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://www.jhipster.tech/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security;
-
-import <%= packageName %>.config.Constants;
-
-import java.util.Optional;
-
-import org.springframework.data.domain.AuditorAware;
-import org.springframework.stereotype.Component;
-
-/**
- * Implementation of {@link AuditorAware} based on Spring Security.
- */
-@Component
-public class SpringSecurityAuditorAware implements AuditorAware<String> {
-
-    @Override
-    public Optional<String> getCurrentAuditor() {
-        return Optional.of(SecurityUtils.getCurrentUserLogin().orElse(Constants.SYSTEM));
-    }
-}

package/dist/generators/server/templates/src/main/java/package/security/UserNotActivatedException.java.ejs

@@ -1,37 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://www.jhipster.tech/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security;
-
-import org.springframework.security.core.AuthenticationException;
-
-/**
- * This exception is thrown in case of a not activated user trying to authenticate.
- */
-public class UserNotActivatedException extends AuthenticationException {
-
-    private static final long serialVersionUID = 1L;
-
-    public UserNotActivatedException(String message) {
-        super(message);
-    }
-
-    public UserNotActivatedException(String message, Throwable t) {
-        super(message, t);
-    }
-}

package/dist/generators/server/templates/src/main/java/package/security/jwt/JWTRelayGatewayFilterFactory.java.ejs

@@ -1,64 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://www.jhipster.tech/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security.jwt;
-
-import static org.springframework.http.HttpHeaders.AUTHORIZATION;
-
-import org.springframework.cloud.gateway.filter.GatewayFilter;
-import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;
-import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
-import org.springframework.stereotype.Component;
-import org.springframework.util.StringUtils;
-import org.springframework.web.server.ServerWebExchange;
-
-@Component
-public class JWTRelayGatewayFilterFactory extends AbstractGatewayFilterFactory<Object> {
-
-    private static final String BEARER = "Bearer ";
-
-    private ReactiveJwtDecoder jwtDecoder;
-
-    public JWTRelayGatewayFilterFactory(ReactiveJwtDecoder jwtDecoder) {
-        this.jwtDecoder = jwtDecoder;
-    }
-
-    @Override
-    public GatewayFilter apply(Object config) {
-        return (exchange, chain) -> {
-            String bearerToken = exchange.getRequest().getHeaders().getFirst(AUTHORIZATION);
-            if (bearerToken == null) {
-                // Allow anonymous requests.
-                return chain.filter(exchange);
-            }
-            String token = this.extractToken(bearerToken);
-            return jwtDecoder.decode(token).thenReturn(withBearerAuth(exchange, token)).flatMap(chain::filter);
-        };
-    }
-
-    private String extractToken(String bearerToken) {
-        if (StringUtils.hasText(bearerToken) && bearerToken.length() > 7 && bearerToken.startsWith(BEARER)) {
-            return bearerToken.substring(7);
-        }
-        throw new IllegalArgumentException("Invalid token in Authorization header");
-    }
-
-    private ServerWebExchange withBearerAuth(ServerWebExchange exchange, String authorizeToken) {
-        return exchange.mutate().request(r -> r.headers(headers -> headers.setBearerAuth(authorizeToken))).build();
-    }
-}

package/dist/generators/server/templates/src/main/java/package/security/oauth2/AudienceValidator.java.ejs

@@ -1,51 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://www.jhipster.tech/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security.oauth2;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.security.oauth2.core.OAuth2Error;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.util.Assert;
-
-import java.util.List;
-
-public class AudienceValidator implements OAuth2TokenValidator<Jwt> {
-    private final Logger log = LoggerFactory.getLogger(AudienceValidator.class);
-    private final OAuth2Error error = new OAuth2Error("invalid_token", "The required audience is missing", null);
-
-    private final List<String> allowedAudience;
-
-    public AudienceValidator(List<String> allowedAudience) {
-        Assert.notEmpty(allowedAudience, "Allowed audience should not be null or empty.");
-        this.allowedAudience = allowedAudience;
-    }
-
-    public OAuth2TokenValidatorResult validate(Jwt jwt) {
-        List<String> audience = jwt.getAudience();
-        if (audience.stream().anyMatch(allowedAudience::contains)) {
-            return OAuth2TokenValidatorResult.success();
-        } else {
-            log.warn("Invalid audience: {}", audience);
-            return OAuth2TokenValidatorResult.failure(error);
-        }
-    }
-}

package/dist/generators/server/templates/src/main/java/package/security/oauth2/AuthorizationHeaderUtil.java.ejs

@@ -1,175 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://www.jhipster.tech/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security.oauth2;
-
-import java.net.URI;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Optional;
-
-import <%= packageName %>.security.oauth2.OAuthIdpTokenResponseDTO;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.boot.web.client.RestTemplateBuilder;
-import org.springframework.http.MediaType;
-import org.springframework.http.RequestEntity;
-import org.springframework.http.ResponseEntity;
-import org.springframework.http.converter.FormHttpMessageConverter;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
-import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
-import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
-import org.springframework.security.oauth2.client.http.OAuth2ErrorResponseErrorHandler;
-import org.springframework.security.oauth2.core.*;
-import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
-import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
-import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
-import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
-import org.springframework.stereotype.Component;
-import org.springframework.util.LinkedMultiValueMap;
-import org.springframework.util.MultiValueMap;
-import org.springframework.web.client.RestTemplate;
-
-import java.util.regex.Pattern;
-import java.util.stream.Collectors;
-
-@Component
-public class AuthorizationHeaderUtil {
-
-    private final OAuth2AuthorizedClientService clientService;
-    private final RestTemplateBuilder restTemplateBuilder;
-    private final Logger log = LoggerFactory.getLogger(AuthorizationHeaderUtil.class);
-
-    public AuthorizationHeaderUtil(OAuth2AuthorizedClientService clientService, RestTemplateBuilder restTemplateBuilder) {
-        this.clientService = clientService;
-        this.restTemplateBuilder = restTemplateBuilder;
-    }
-
-    public Optional<String> getAuthorizationHeader() {
-        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-        if (authentication instanceof OAuth2AuthenticationToken) {
-            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
-            String name = oauthToken.getName();
-            String registrationId = oauthToken.getAuthorizedClientRegistrationId();
-            OAuth2AuthorizedClient client = clientService.loadAuthorizedClient(
-                registrationId,
-                name);
-
-            if (null == client) {
-                throw new OAuth2AuthorizationException(new OAuth2Error("access_denied", "The token is expired", null));
-            }
-            OAuth2AccessToken accessToken = client.getAccessToken();
-
-            if (accessToken != null) {
-                String tokenType = accessToken.getTokenType().getValue();
-                String accessTokenValue = accessToken.getTokenValue();
-                if (isExpired(accessToken)) {
-                    log.info("AccessToken expired, refreshing automatically");
-                    accessTokenValue = refreshToken(client, oauthToken);
-                    if (null == accessTokenValue) {
-                        SecurityContextHolder.getContext().setAuthentication(null);
-                        throw new OAuth2AuthorizationException(new OAuth2Error("access_denied", "The token is expired", null));
-                    }
-                }
-                String authorizationHeaderValue = String.format("%s %s", tokenType, accessTokenValue);
-                return Optional.of(authorizationHeaderValue);
-            }
-
-        } else if (authentication instanceof JwtAuthenticationToken) {
-            JwtAuthenticationToken accessToken = (JwtAuthenticationToken) authentication;
-            String tokenValue = accessToken.getToken().getTokenValue();
-            String authorizationHeaderValue = String.format("%s %s", OAuth2AccessToken.TokenType.BEARER.getValue(), tokenValue);
-            return Optional.of(authorizationHeaderValue);
-        }
-        return Optional.empty();
-    }
-
-    private String refreshToken(OAuth2AuthorizedClient client, OAuth2AuthenticationToken oauthToken) {
-        OAuth2AccessTokenResponse atr = refreshTokenClient(client);
-        if (atr == null || atr.getAccessToken() == null) {
-            log.info("Failed to refresh token for user");
-            return null;
-        }
-
-        OAuth2RefreshToken refreshToken = atr.getRefreshToken() != null ? atr.getRefreshToken(): client.getRefreshToken();
-        OAuth2AuthorizedClient updatedClient = new OAuth2AuthorizedClient(
-            client.getClientRegistration(),
-            client.getPrincipalName(),
-            atr.getAccessToken(),
-            refreshToken
-        );
-
-        clientService.saveAuthorizedClient(updatedClient, oauthToken);
-        return atr.getAccessToken().getTokenValue();
-    }
-
-    private OAuth2AccessTokenResponse refreshTokenClient(OAuth2AuthorizedClient currentClient) {
-
-        MultiValueMap<String, String> formParameters = new LinkedMultiValueMap<>();
-        formParameters.add(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.REFRESH_TOKEN.getValue());
-        formParameters.add(OAuth2ParameterNames.REFRESH_TOKEN, currentClient.getRefreshToken().getTokenValue());
-        formParameters.add(OAuth2ParameterNames.CLIENT_ID, currentClient.getClientRegistration().getClientId());
-        RequestEntity requestEntity = RequestEntity
-            .post(URI.create(currentClient.getClientRegistration().getProviderDetails().getTokenUri()))
-            .contentType(MediaType.APPLICATION_FORM_URLENCODED)
-            .body(formParameters);
-        try {
-            RestTemplate r = restTemplate(currentClient.getClientRegistration().getClientId(), currentClient.getClientRegistration().getClientSecret());
-            ResponseEntity<OAuthIdpTokenResponseDTO> responseEntity = r.exchange(requestEntity, OAuthIdpTokenResponseDTO.class);
-            return toOAuth2AccessTokenResponse(responseEntity.getBody());
-        } catch (OAuth2AuthorizationException e) {
-            log.error("Unable to refresh token", e);
-            throw new OAuth2AuthenticationException(e.getError(), e);
-        }
-    }
-
-    private OAuth2AccessTokenResponse toOAuth2AccessTokenResponse(OAuthIdpTokenResponseDTO oAuthIdpResponse) {
-        Map<String, Object> additionalParameters = new HashMap<>();
-        additionalParameters.put("id_token", oAuthIdpResponse.getIdToken());
-        additionalParameters.put("not-before-policy", oAuthIdpResponse.getNotBefore());
-        additionalParameters.put("refresh_expires_in", oAuthIdpResponse.getRefreshExpiresIn());
-        additionalParameters.put("session_state", oAuthIdpResponse.getSessionState());
-        return OAuth2AccessTokenResponse.withToken(oAuthIdpResponse.getAccessToken())
-            .expiresIn(oAuthIdpResponse.getExpiresIn())
-            .refreshToken(oAuthIdpResponse.getRefreshToken())
-            .scopes(Pattern.compile("\\s").splitAsStream(oAuthIdpResponse.getScope()).collect(Collectors.toSet()))
-            .tokenType(OAuth2AccessToken.TokenType.BEARER)
-            .additionalParameters(additionalParameters)
-            .build();
-    }
-
-    private RestTemplate restTemplate(String clientId, String clientSecret) {
-        return restTemplateBuilder
-            .additionalMessageConverters(
-                new FormHttpMessageConverter(),
-                new OAuth2AccessTokenResponseHttpMessageConverter())
-            .errorHandler(new OAuth2ErrorResponseErrorHandler())
-            .basicAuthentication(clientId, clientSecret)
-            .build();
-    }
-
-    private boolean isExpired(OAuth2AccessToken accessToken) {
-        Instant now = Instant.now();
-        Instant expiresAt = accessToken.getExpiresAt();
-        return now.isAfter(expiresAt.minus(Duration.ofMinutes(1L)));
-    }
-}

package/dist/generators/server/templates/src/main/java/package/security/oauth2/CustomClaimConverter.java.ejs

@@ -1,133 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://jhipster.github.io/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security.oauth2;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import com.github.benmanes.caffeine.cache.Cache;
-import com.github.benmanes.caffeine.cache.Caffeine;
-import <%= packageName %>.security.SecurityUtils;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.http.HttpEntity;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpMethod;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.jwt.MappedJwtClaimSetConverter;
-import org.springframework.security.oauth2.server.resource.web.BearerTokenResolver;
-import org.springframework.security.oauth2.server.resource.web.DefaultBearerTokenResolver;
-import org.springframework.web.client.RestTemplate;
-import org.springframework.web.context.request.RequestAttributes;
-import org.springframework.web.context.request.RequestContextHolder;
-import org.springframework.web.context.request.ServletRequestAttributes;
-
-import java.time.Duration;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.StreamSupport;
-
-/**
- * Claim converter to add custom claims by retrieving the user from the userinfo endpoint.
- */
-public class CustomClaimConverter implements Converter<Map<String, Object>, Map<String, Object>> {
-    private final BearerTokenResolver bearerTokenResolver = new DefaultBearerTokenResolver();
-
-    private final MappedJwtClaimSetConverter delegate = MappedJwtClaimSetConverter.withDefaults(Collections.emptyMap());
-
-    private final RestTemplate restTemplate;
-
-    private final ClientRegistration registration;
-
-    // See https://github.com/jhipster/generator-jhipster/issues/18868
-    // We don't use a distributed cache or the user selected cache implementation here on purpose
-    private final Cache<String, ObjectNode> users = Caffeine.newBuilder()
-        .maximumSize(10_000)
-        .expireAfterWrite(Duration.ofHours(1))
-        .recordStats()
-        .build();
-
-    public CustomClaimConverter(ClientRegistration registration, RestTemplate restTemplate) {
-        this.registration = registration;
-        this.restTemplate = restTemplate;
-    }
-
-    public Map<String, Object> convert(Map<String, Object> claims) {
-        Map<String, Object> convertedClaims = this.delegate.convert(claims);
-        // Only look up user information if identity claims are missing
-        if (claims.containsKey("given_name") && claims.containsKey("family_name")) {
-            return convertedClaims;
-        }
-        RequestAttributes attributes = RequestContextHolder.getRequestAttributes();
-        if (attributes instanceof ServletRequestAttributes) {
-            // Retrieve and set the token
-            String token = bearerTokenResolver.resolve(((ServletRequestAttributes) attributes).getRequest());
-            HttpHeaders headers = new HttpHeaders();
-            headers.set("Authorization", buildBearer(token));
-
-            // Retrieve user info from OAuth provider if not already loaded
-            ObjectNode user = users.get(claims.get("sub").toString(), s -> {
-                ResponseEntity<ObjectNode> userInfo = restTemplate.exchange(registration.getProviderDetails().getUserInfoEndpoint().getUri(), HttpMethod.GET, new HttpEntity<String>(headers), ObjectNode.class);
-                return userInfo.getBody();
-            });
-
-            // Add custom claims
-            if (user != null) {
-                convertedClaims.put("preferred_username", user.get("preferred_username").asText());
-                if (user.has("given_name")) {
-                    convertedClaims.put("given_name", user.get("given_name").asText());
-                }
-                if (user.has("family_name")) {
-                    convertedClaims.put("family_name", user.get("family_name").asText());
-                }
-                if (user.has("email")) {
-                    convertedClaims.put("email", user.get("email").asText());
-                }
-                // Allow full name in a name claim - happens with Auth0
-                if (user.has("name")) {
-                    String[] name = user.get("name").asText().split("\\s+");
-                    if (name.length > 0) {
-                        convertedClaims.put("given_name", name[0]);
-                        convertedClaims.put("family_name",
-                            String.join(" ", Arrays.copyOfRange(name, 1, name.length)));
-                    }
-                }
-                if (user.has("groups")) {
-                    List<String> groups = StreamSupport.stream(user.get("groups").spliterator(), false)
-                        .map(JsonNode::asText)
-                        .toList();
-                    convertedClaims.put("groups", groups);
-                }
-                if (user.has(SecurityUtils.CLAIMS_NAMESPACE + "roles")) {
-                    List<String> roles = StreamSupport
-                        .stream(user.get(SecurityUtils.CLAIMS_NAMESPACE + "roles").spliterator(), false)
-                        .map(JsonNode::asText)
-                        .toList();
-                    convertedClaims.put("roles", roles);
-                }
-            }
-        }
-        return convertedClaims;
-    }
-
-    private String buildBearer(String token) {
-        return "Bearer " + token;
-    }
-}

package/dist/generators/server/templates/src/main/java/package/security/oauth2/JwtGrantedAuthorityConverter.java.ejs

@@ -1,40 +0,0 @@
-<%#
- Copyright 2013-2023 the original author or authors from the JHipster project.
-
- This file is part of the JHipster project, see https://www.jhipster.tech/
- for more information.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      https://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--%>
-package <%= packageName %>.security.oauth2;
-
-import <%= packageName %>.security.SecurityUtils;
-import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.jwt.Jwt;
-import org.springframework.stereotype.Component;
-
-import java.util.Collection;
-
-@Component
-public class JwtGrantedAuthorityConverter implements Converter<Jwt, Collection<GrantedAuthority>> {
-
-    public JwtGrantedAuthorityConverter() {
-        // Bean extracting authority.
-    }
-
-    @Override
-    public Collection<GrantedAuthority> convert(Jwt jwt) {
-        return SecurityUtils.extractAuthorityFromClaims(jwt.getClaims());
-    }
-}