integration-web-core--socle 1.4.2

package/cdp-due--authentication-module-master/src/main/java/com/adeo/authentication/services/PasswordService.java

@@ -0,0 +1,64 @@
+package com.adeo.authentication.services;
+
+import com.adeo.authentication.model.cookie.CookieTypeEnum;
+import com.adeo.authentication.model.password.ResetPasswordRequestDTO;
+import com.adeo.authentication.model.password.UpdatePasswordRequestDTO;
+import com.adeo.authentication.model.password.UpdatePasswordResponse;
+import com.adeo.ipnteam.autologin.AuthenticationMode;
+import com.adeo.ipnteam.autologin.AutoLoginHelper;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Service;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class PasswordService {
+
+    private final CiamService ciamService;
+
+    private final CookieService cookieService;
+
+    public Mono<UpdatePasswordResponse> updatePassword(final UpdatePasswordRequestDTO request, ServerWebExchange serverWebExchange) {
+
+        return ciamService.updatePassword(request)
+                .doOnSuccess(response -> addAutologinCookie(response, serverWebExchange, AuthenticationMode.UPDATE_PASSWORD_LOGIN));
+    }
+
+    public Mono<Void> resetPassword(final ResetPasswordRequestDTO request) {
+
+        return ciamService.forgotPassword(request.getLogin());
+    }
+
+    public Mono<String> decodeEmailMono(final String email) {
+
+        return Mono.fromCallable(() -> decodeEmail(email));
+    }
+
+    private String decodeEmail(final String email) {
+
+        String decodedEmail;
+        try {
+            decodedEmail = URLDecoder.decode(email, StandardCharsets.UTF_8.toString());
+        } catch (UnsupportedEncodingException e) {
+            log.error(e.getMessage(), e);
+            throw new IllegalArgumentException(e);
+        }
+        return decodedEmail;
+    }
+
+    public void addAutologinCookie(final UpdatePasswordResponse response, ServerWebExchange serverWebExchange, final AuthenticationMode authenticationMode) {
+
+        if (response != null && StringUtils.isNotEmpty(response.getAutologinToken())) {
+            cookieService.addCookieFromNamesAndDomains(serverWebExchange, CookieTypeEnum.AUTO_LOGIN_KEY, AutoLoginHelper.buildBase64Cookie(response.getAutologinToken(), authenticationMode), null, true, true);
+        }
+    }
+
+}

package/cdp-due--authentication-module-master/src/main/java/com/adeo/authentication/services/PingService.java

@@ -0,0 +1,133 @@
+package com.adeo.authentication.services;
+
+import com.adeo.authentication.clients.PingClient;
+import com.adeo.authentication.config.CookiesConfig;
+import com.adeo.authentication.config.clients.PingClientConfig;
+import com.adeo.authentication.model.AccessToken;
+import com.adeo.authentication.model.collab.PingAccessToken;
+import com.adeo.authentication.model.ping.PingUserInfos;
+import com.auth0.jwt.JWT;
+import com.auth0.jwt.interfaces.DecodedJWT;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Service;
+import reactor.core.publisher.Mono;
+
+import javax.annotation.PostConstruct;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.List;
+import java.util.stream.Collectors;
+
+
+@Slf4j
+@RequiredArgsConstructor
+@Service
+public class PingService {
+
+
+    private static final String OU_PREFIX = "ou=";
+
+    private static final String CN_PREFIX = "cn=";
+
+    private static final String LOGOUT_PATH = "/idp/startSLO.ping?TargetResource=";
+
+    private final ObjectMapper objectMapper;
+
+    private final PingClientConfig clientConfig;
+
+    private final PingClient pingClient;
+
+    private List<String> authorizedApplications;
+
+    private final CookiesConfig cookiesConfig;
+
+    @PostConstruct
+    private void setAuthorizedApplications() {
+        authorizedApplications = List.of(clientConfig.getApplicationList().split(";"));
+    }
+
+    public Mono<AccessToken> exchangeAuthorizationCode(final String code, final String redirectUri) {
+
+        return pingClient.exchangeAuthorizationCode(code, redirectUri);
+    }
+
+
+    public Mono<PingUserInfos> getUserInfos(final String accessToken) {
+
+        return pingClient.getUserInfos(accessToken)
+                .doOnNext(this::filterAuthorizations);
+    }
+
+    /**
+     * memberOf list contains a list of authorities by application,
+     * in this example "cn=FR-LM-ROLE-CUSTOMER-SPACE-ADMIN-SALES,ou=CUSTOMER-SPACE-ADMIN,ou=applicationRole,ou=role,ou=FR-LM,o=corp.leroymerlin.com"
+     * FR-LM-ROLE-CUSTOMER-SPACE-ADMIN-SALES is the authority an CUSTOMER-SPACE-ADMIN is the application name
+     */
+    private void filterAuthorizations(PingUserInfos pingUserInfosResponse) {
+
+        if (pingUserInfosResponse != null && pingUserInfosResponse.getMemberOf() != null) {
+            List<String> filteredAuthorizations = pingUserInfosResponse.getMemberOf().stream()
+                    .filter(this::isAuthorizedApplication)
+                    .map(this::extractAuthorizations)
+                    .collect(Collectors.toList());
+            pingUserInfosResponse.setMemberOf(filteredAuthorizations);
+        }
+    }
+
+    private boolean isAuthorizedApplication(String userRight) {
+
+        log.debug("authorizedApplications : {}", authorizedApplications);
+
+        return authorizedApplications.stream()
+                .anyMatch(application -> !application.isEmpty() && userRight.contains(OU_PREFIX.concat(application)));
+    }
+
+    private String extractAuthorizations(String member) {
+
+        return member.split(",")[0].replace(CN_PREFIX, "").replace(" ", "");
+    }
+
+    public Mono<AccessToken> computePingAccessToken(final String accessToken, final String idToken, final String refreshToken) {
+
+        return Mono.fromCallable(() -> decodeTokenToGetTokenInfos(accessToken, PingAccessToken.class))
+                .map(pingAccessToken ->
+                        AccessToken.builder()
+                                .accessToken(accessToken)
+                                .refreshToken(refreshToken)
+                                .idToken(idToken)
+                                .expiresIn(cookiesConfig.getKobiJwtEloExpiration())
+                                .scope(String.join(",", pingAccessToken.getScope()))
+                                .build()
+                );
+    }
+
+    private <T> T decodeTokenToGetTokenInfos(final String accessToken, final Class<T> clazz) throws JsonProcessingException {
+
+        DecodedJWT decodedJWT = JWT.decode(accessToken);
+        String jsonPayload = "";
+        try {
+            jsonPayload = new String(Base64.getUrlDecoder().decode(decodedJWT.getPayload().getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException e) {
+            log.error(e.getMessage());
+            log.error("Cannot decode base64 of the following token : {}", decodedJWT.getPayload());
+        }
+        return objectMapper.readValue(jsonPayload, clazz);
+    }
+
+    public Mono<String> getLogoutUrl(String targetUrl) {
+        return Mono.just(clientConfig.getBaseUrl() + LOGOUT_PATH + targetUrl);
+    }
+
+    public Mono<AccessToken> refreshToken(final String refreshToken) {
+
+        if (StringUtils.isEmpty(refreshToken)) {
+            return Mono.error(new IllegalArgumentException("Trying to refresh with an empty refresh token"));
+        }
+
+        return pingClient.refreshToken(refreshToken);
+    }
+}

package/cdp-due--authentication-module-master/src/main/java/com/adeo/authentication/services/ReachFiveService.java

@@ -0,0 +1,175 @@
+package com.adeo.authentication.services;
+
+import com.adeo.authentication.clients.ReachFiveClient;
+import com.adeo.authentication.helpers.AccessTokenManager;
+import com.adeo.authentication.model.AccessToken;
+import com.adeo.authentication.model.IntrospectedToken;
+import com.adeo.authentication.model.SocialLoginProviders;
+import com.adeo.authentication.model.user.ReachFiveUser;
+import com.auth0.jwt.JWTVerifier;
+import com.auth0.jwt.interfaces.DecodedJWT;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.http.client.utils.URIBuilder;
+import org.springframework.stereotype.Service;
+import reactor.core.publisher.Mono;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import static io.netty.util.internal.StringUtil.EMPTY_STRING;
+import static com.adeo.authentication.commons.Constants.AUTH_TYPE_PASSWORD;
+
+@Service
+@Slf4j
+public class ReachFiveService {
+
+    private final ReachFiveClient reachFiveClient;
+
+    private final AccessTokenManager tokenManager;
+
+    private final JWTVerifier jwtVerifier;
+
+    private final ObjectMapper objectMapper;
+
+    public ReachFiveService(ReachFiveClient reachFiveClient, JwtService jwtService, ObjectMapper objectMapper, AccessTokenManager tokenManager) {
+
+        this.reachFiveClient = reachFiveClient;
+        this.jwtVerifier = jwtService.createJwtVerifier(15552000);
+        this.objectMapper = objectMapper;
+        this.tokenManager = tokenManager;
+    }
+
+    public Mono<AccessToken> refreshToken(final String refreshToken) {
+
+        if (StringUtils.isEmpty(refreshToken)) {
+            return Mono.error(new IllegalArgumentException("Trying to refresh with an empty refresh token"));
+        }
+
+        return reachFiveClient.refreshToken(refreshToken);
+    }
+
+    public Mono<AccessToken> exchangeAuthorizationCode(final String code, final String redirectUri) {
+
+        return reachFiveClient.exchangeAuthorizationCode(code, redirectUri);
+    }
+
+    public Mono<AccessToken> getManagementAccessToken() {
+
+        return tokenManager.getManagementToken();
+    }
+
+    public Mono<ReachFiveUser> getUserInfosMono(final String idToken) {
+
+        return Mono.fromCallable(() -> getUserInfos(idToken));
+    }
+
+
+    public Mono<String> logout(final String redirectTo) {
+
+        return Mono.fromCallable(() -> reachFiveClient.getLogoutURI(redirectTo));
+    }
+
+    public ReachFiveUser getUserInfos(final String idToken) throws JsonProcessingException {
+
+        DecodedJWT decodedJWT = this.jwtVerifier.verify(idToken);
+        String jsonPayload = "";
+        try {
+            jsonPayload = new String(Base64.getUrlDecoder().decode(decodedJWT.getPayload().getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException e) {
+            log.error(e.getMessage());
+            log.error("Cannot decode base64 the following id token : {}", decodedJWT.getPayload());
+        }
+        return this.objectMapper.readValue(jsonPayload, ReachFiveUser.class);
+    }
+
+    public Mono<ReachFiveUser> getUserInfo(final String accessToken)  {
+        return reachFiveClient.getUserInfo(accessToken);
+    }
+
+    public Mono<URI> getAutologinURI(
+            final String autologinToken,
+            final String state,
+            final String scopes,
+            final String redirectUri) {
+
+        return reachFiveClient.getAutologinUri(autologinToken, state, scopes, redirectUri);
+    }
+
+    public Mono<URI> getBySocialLogin(
+            final String state,
+            final String scopes,
+            final String provider,
+            final String redirectUri) {
+
+        return reachFiveClient.getBySocialLogin(state, scopes, provider, redirectUri);
+    }
+
+    public Mono<IntrospectedToken> introspect(final String token) {
+
+        return reachFiveClient.introspect(token);
+    }
+
+    public String getScopes() {
+
+        return reachFiveClient.getScopes();
+    }
+
+    public String getBaseUrl() {
+
+        return reachFiveClient.getBaseUrl();
+    }
+
+    public String getClientId() {
+
+        return reachFiveClient.getClientId();
+    }
+
+    public SocialLoginProviders getSocialLoginProviders() {
+        return reachFiveClient.getSocialLoginProviders();
+    }
+
+    public String getSocialLoginProviderOrEmpty(String loginProvider) {
+        return reachFiveClient.getSocialLoginProviders().getAvailableProviders().contains(loginProvider) ? loginProvider : EMPTY_STRING;
+    }
+
+    /**
+     * Builds the authorization URI.
+     *
+     * @param responseType the response type
+     * @param scope the scope
+     * @param clientId the client ID
+     * @param redirectUri the redirect URI
+     * @param state the state
+     * @return the authorization URI
+     */
+    public Mono<URI> buildAuthorizationUri(String baseUrl, String responseType, String scope, String clientId, String redirectUri, String state) {
+        try {
+            URIBuilder uriBuilder = new URIBuilder(baseUrl + "/oauth/authorize");
+            uriBuilder.addParameter("response_type", responseType);
+            uriBuilder.addParameter("scope", scope);
+            uriBuilder.addParameter("client_id", clientId);
+            uriBuilder.addParameter("redirect_uri", redirectUri);
+            uriBuilder.addParameter("state", state);
+            return Mono.just(uriBuilder.build());
+        } catch (URISyntaxException e) {
+            return Mono.error(e);
+        }
+    }
+
+    public Mono<String> getLoginProvider(ReachFiveUser reachFiveUser, AccessToken accessToken) {
+        if (StringUtils.isNotEmpty(reachFiveUser.getAuthType()) && reachFiveUser.getAuthType().equals("refresh")) {
+            return getUserInfo(accessToken.getAccessToken())
+                    .map(user -> user.getLastLoginProvider() != null ? user.getLastLoginProvider() : AUTH_TYPE_PASSWORD);
+        }
+        return Mono.just(StringUtils.isNotEmpty(reachFiveUser.getAuthType()) ? reachFiveUser.getAuthType() : AUTH_TYPE_PASSWORD);
+    }
+
+    public Mono<String> getSocialLoginProviderKey(ReachFiveUser reachFiveUser, AccessToken accessToken) {
+        return getLoginProvider(reachFiveUser, accessToken)
+                .map(this::getSocialLoginProviderOrEmpty);
+    }
+}

package/cdp-due--authentication-module-master/src/main/java/com/adeo/authentication/services/RefreshService.java

@@ -0,0 +1,165 @@
+package com.adeo.authentication.services;
+
+import com.adeo.authentication.config.CookiesConfig;
+import com.adeo.authentication.helpers.CookieHelper;
+import com.adeo.authentication.model.AccessToken;
+import com.adeo.authentication.model.cookie.CookieTypeEnum;
+import com.adeo.authentication.model.refresh.RefreshTokenResponse;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import io.kobi.security.common.KobiUser;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.ArrayUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Service;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+import java.io.IOException;
+import java.sql.Timestamp;
+import java.time.LocalDateTime;
+import java.util.Date;
+
+@Service
+@Slf4j
+@RequiredArgsConstructor
+public class RefreshService {
+
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    private static final Integer DELAY_IN_SECONDS = 10;
+
+    private final ReachFiveService reachFiveService;
+
+    private final JwtService jwtService;
+
+    private final CookieService cookieService;
+
+    private final CookiesConfig cookiesConfig;
+
+    /**
+     * Return a kobiJwt with a new access token
+     *
+     * @param kobiJwt
+     * @return
+     * @throws IOException
+     */
+    public Mono<RefreshTokenResponse> refreshKobiJWT(
+            final String kobiJwt,
+            final String idToken,
+            ServerWebExchange serverWebExchange) throws IOException {
+
+        final KobiUser user = new KobiUser(kobiJwt, objectMapper);
+
+        if (isRefreshNeeded(user)) {
+
+            if (ArrayUtils.contains(user.getRoles(), JwtService.ROLE_COLLAB)) {
+
+                // If user is collab , we just remove his tokens & update his roles
+                return handleRefreshTokenExpired(idToken)
+                        .map(accessToken -> updateKobiUser(accessToken, user))
+                        .map(this::toJwtToken)
+                        .map(RefreshTokenResponse::new);
+            }
+            else {
+                return reachFiveService.refreshToken(user.getRefreshToken())
+                        .onErrorResume(t -> handleRefreshTokenExpired(idToken))
+                        .flatMap(accessToken -> Mono.zip(
+                                        Mono.just(updateKobiUser(accessToken, user)),
+                                        Mono.just(accessToken.getIdToken()),
+                                        computeCookieDuration(accessToken)
+                                )
+                                .doOnSuccess(tuple -> addRefreshCookies(tuple.getT1(), tuple.getT2(), tuple.getT3(), serverWebExchange))
+                                .map(tuple -> toJwtToken(tuple.getT1())))
+                        .map(RefreshTokenResponse::new);
+            }
+        }
+
+        return Mono.just(new RefreshTokenResponse(kobiJwt));
+    }
+
+    private Mono<Long> computeCookieDuration(AccessToken accessToken) {
+        final String refreshToken = accessToken.getRefreshToken();
+        if (refreshToken == null || accessToken.isRefreshTokenExpired()) {
+            return Mono.just(cookiesConfig.getWeakAuthentDuration().getSeconds());
+        }
+        return reachFiveService.introspect(refreshToken)
+                .map(CookieHelper::computeTokenDuration);
+
+    }
+
+    private void addRefreshCookies(final KobiUser kobiUser, final String idToken, final Long cookieDuration, ServerWebExchange serverWebExchange) {
+
+        cookieService.addSyncAuthCookie(serverWebExchange, "true");
+        jwtService.buildKobiJwtCookie(serverWebExchange, kobiUser, cookieDuration);
+        cookieService.addCookieFromNamesAndDomains(serverWebExchange, CookieTypeEnum.ID_TOKEN_KEY, idToken,
+                cookieDuration, true, true);
+    }
+
+    private Mono<AccessToken> handleRefreshTokenExpired(final String idToken) {
+
+        AccessToken result = new AccessToken();
+        result.setRefreshTokenExpired(true);
+        result.setIdToken(idToken);
+        return Mono.just(result);
+    }
+
+    private KobiUser updateKobiUser(final AccessToken accessToken, final KobiUser user) {
+
+        long expiresIn = accessToken.getExpiresIn() != null ? accessToken.getExpiresIn() : 0;
+        LocalDateTime expiration = LocalDateTime.now().plusSeconds(expiresIn);
+        if (accessToken.isRefreshTokenExpired()) {
+            // If refresh token is expired , user is weakly authenticated for 6 months
+            expiration = expiration.plus(cookiesConfig.getWeakAuthentDuration());
+        }
+        KobiUser refreshedUser = KobiUser.KobiUserBuilder.refreshToken(user, accessToken.getAccessToken(), Timestamp.valueOf(expiration));
+
+        return new KobiUser.KobiUserBuilder(refreshedUser.getIssuer(), refreshedUser.getAudience(), refreshedUser.getTokenExpiration())
+                .withAccessToken(refreshedUser.getAccessToken())
+                .withIdToken(refreshedUser.getIdToken())
+                .withRefreshToken(accessToken.isRefreshTokenExpired() ? null : accessToken.getRefreshToken())
+                .withAttributes(refreshedUser.getAttributes())
+                .withUserId(refreshedUser.getUserId())
+                .withRoles(updateUserRoles(user, accessToken))
+                .build();
+    }
+
+    private String toJwtToken(final KobiUser newUser) {
+
+        try {
+            return newUser.getJwtToken(jwtService.getAlgorithm(), objectMapper);
+        } catch (IOException e) {
+            log.error(e.getMessage(), e);
+            return "";
+        }
+    }
+
+    private String[] updateUserRoles(final KobiUser user, final AccessToken accessToken) {
+
+        String[] roles = user.getRoles();
+        if (accessToken.isRefreshTokenExpired()) {
+            // If refresh token is expired, remove ROLE_USER and ROLE_CUSTOMER from array
+            roles = removeRole(roles, JwtService.ROLE_USER);
+            roles = removeRole(roles, JwtService.ROLE_CUSTOMER);
+            roles = removeRole(roles, JwtService.ROLE_COLLAB);
+        }
+        return roles;
+    }
+
+    private String[] removeRole(String[] roles, String roleToRemove) {
+
+        final int index = ArrayUtils.indexOf(roles, roleToRemove);
+        if (index >= 0) {
+            return ArrayUtils.remove(roles, index);
+        }
+        return roles;
+    }
+
+    private boolean isRefreshNeeded(final KobiUser user) {
+
+        LocalDateTime nowWithDelay = LocalDateTime.now().plusSeconds(DELAY_IN_SECONDS);
+        Date nowWithDelayDate = Timestamp.valueOf(nowWithDelay);
+        return StringUtils.isNotEmpty(user.getUserId()) && user.getTokenExpiration().before(nowWithDelayDate);
+    }
+
+}

package/cdp-due--authentication-module-master/src/main/java/com/adeo/authentication/services/RequestSavingService.java

@@ -0,0 +1,60 @@
+package com.adeo.authentication.services;
+
+import com.adeo.authentication.config.CookiesConfig;
+import com.adeo.authentication.model.LoginRequest;
+import com.adeo.authentication.model.cookie.CookieTypeEnum;
+import com.adeo.authentication.model.login.SavedLoginRequest;
+import com.adeo.authentication.rest.resources.SavedLoginCookieNotFoundException;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpCookie;
+import org.springframework.stereotype.Service;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+import javax.annotation.PostConstruct;
+
+import static com.adeo.authentication.commons.Constants.Cookie.DEFAULT_SAVED_LOGIN_REQUEST_COOKIE_NAME;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class RequestSavingService {
+
+    private String loginRequestCookieName;
+
+    private final CookiesConfig cookiesConfig;
+
+    private final CookieService cookieService;
+
+    @PostConstruct
+    private void setCookie() {
+        loginRequestCookieName = cookiesConfig.getCookieName(CookieTypeEnum.LOGIN_REQUEST_KEY, DEFAULT_SAVED_LOGIN_REQUEST_COOKIE_NAME);
+    }
+
+    public void saveRequest(
+            ServerWebExchange serverWebExchange,
+            final String state,
+            final String targetUri) {
+
+        SavedLoginRequest savedLoginRequest = new SavedLoginRequest(state, targetUri);
+        cookieService.addCookieFromNamesAndDomains(serverWebExchange, CookieTypeEnum.LOGIN_REQUEST_KEY, savedLoginRequest.encode(),  true, true);
+    }
+
+    /**
+     * Extract the saved request from cookies
+     *
+     * @param serverWebExchange
+     * @return a {@link Mono} of {@link LoginRequest}
+     */
+    public Mono<SavedLoginRequest> getSavedRequest(ServerWebExchange serverWebExchange) {
+
+        HttpCookie savedLoginCookie = serverWebExchange.getRequest().getCookies().getFirst(loginRequestCookieName);
+
+        if (savedLoginCookie != null) {
+            return Mono.just(new SavedLoginRequest(savedLoginCookie.getValue()));
+        }
+
+        return Mono.error(new SavedLoginCookieNotFoundException("Cookie savedLoginRequest is not present"));
+    }
+}