Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: P4adev-1264 p4pa auth handle client credential piattaforma unitaria via env #104

Merged
merged 5 commits into from
Oct 25, 2024
Merged

fix: P4adev-1264 p4pa auth handle client credential piattaforma unitaria via env #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
58343f3
P4ADEV-1264-P4PA-AUTH-handle-client-credential-piattaforma-unitaria-v…
macacia Oct 23, 2024
5169718
P4ADEV-1264 fix typo
macacia Oct 24, 2024
fa80bd5
P4ADEV-1264 resolved change request
macacia Oct 24, 2024
64dd681
Merge branch 'develop' of https://github.com/pagopa/p4pa-auth into P4…
macacia Oct 24, 2024
1b1fb5d
P4ADEV-1264 resolved sonarcloud issue
macacia Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 17 additions & 21 deletions .../java/it/gov/pagopa/payhub/auth/service/a2a/AuthorizeClientCredentialsRequestService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,53 +3,49 @@
import it.gov.pagopa.payhub.auth.exception.custom.ClientUnauthorizedException;
import it.gov.pagopa.payhub.auth.mapper.ClientMapper;
import it.gov.pagopa.payhub.model.generated.ClientDTO;
import org.springframework.beans.factory.annotation.Value;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

@Service
@Slf4j
public class AuthorizeClientCredentialsRequestService {
private static final String ERROR = "Unauthorized client for client-credentials";
private static final String REGEX = "^(\\w+\\s*)(piattaforma-unitaria\\b)$";
private static final String PIATTAFORMA_UNITARIA_CLIENT_ID_PREFIX = "piattaforma-unitaria_";
private final ClientService clientService;
private final ClientMapper clientMapper;
private final String clientSecretEnv;
private final String piattaformaUnitariaClientSecret;

public AuthorizeClientCredentialsRequestService(
@Value("${piattaforma-unitaria-client-secret}") String clientSecretEnv,
ClientService clientService,
ClientMapper clientMapper) {
ClientMapper clientMapper,
@Value("${m2m.piattaforma-unitaria-client-secret}") String piattaformaUnitariaClientSecret) {
this.clientService = clientService;
this.clientMapper = clientMapper;
this.clientSecretEnv = clientSecretEnv;
this.piattaformaUnitariaClientSecret = piattaformaUnitariaClientSecret;
}

public ClientDTO authorizeCredentials(String clientId, String clientSecret) {
Matcher matcher = Pattern.compile(REGEX).matcher(clientId);
if (matcher.matches()) {
return retrieveByEnvProperties(clientId, matcher.group(1), matcher.group(2), clientSecret);
if (clientId.startsWith(PIATTAFORMA_UNITARIA_CLIENT_ID_PREFIX)) {
return authorizePiattaformaUnitariaCredentials(clientId, clientSecret);
}
return retrieveByCollection(clientId, clientSecret);
return authorizeSilCredentials(clientId, clientSecret);
}

private ClientDTO retrieveByCollection(String clientId, String clientSecret) {
private ClientDTO authorizeSilCredentials(String clientId, String clientSecret) {
return clientService.getClientByClientId(clientId)
.map(clientMapper::mapToDTO)
.filter(dto -> dto.getClientSecret().equals(clientSecret))
.orElseThrow(() -> new ClientUnauthorizedException(ERROR));
.orElseThrow(() -> new ClientUnauthorizedException("Unauthorized client with client-credentials grant type"));
}

private ClientDTO retrieveByEnvProperties(String clientId, String organizationIpaCode, String clientName, String clientSecret) {
if (!clientSecret.equals(clientSecretEnv))
throw new ClientUnauthorizedException(ERROR);
private ClientDTO authorizePiattaformaUnitariaCredentials(String clientId, String clientSecret) {
if (!clientSecret.equals(piattaformaUnitariaClientSecret))
throw new ClientUnauthorizedException("Unauthorized client for piattaforma-unitaria client-credentials");
String[] splittedClientId = clientId.split("_");
return ClientDTO.builder()
.clientId(clientId)
.clientName(clientName)
.organizationIpaCode(organizationIpaCode)
.clientName(splittedClientId[0])
.organizationIpaCode(splittedClientId[1])
.clientSecret(clientSecret)
.build();
}
Expand Down
3 changes: 2 additions & 1 deletion src/main/resources/application.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,4 +68,5 @@ data-chiper:
p4pa-auth-hash-key: "\${DATA_CIPHER_P4PA_AUTH_HASH_KEY:PEPPER}"
p4pa-auth-encrypt-psw: "\${DATA_CIPHER_P4PA_AUTH_ENCRYPT_PSW:PSW}"

piattaforma-unitaria-client-secret: "\${PIATTAFORMA_UNITARIA_CLIENT_SECRET:SECRET}"
m2m:
piattaforma-unitaria-client-secret: "\${PIATTAFORMA_UNITARIA_CLIENT_SECRET:SECRET}"
42 changes: 15 additions & 27 deletions ...a/it/gov/pagopa/payhub/auth/service/a2a/AuthorizeClientCredentialsRequestServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@

import java.util.Optional;
import java.util.UUID;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

@ExtendWith(MockitoExtension.class)
class AuthorizeClientCredentialsRequestServiceTest {
Expand All @@ -26,11 +24,9 @@ class AuthorizeClientCredentialsRequestServiceTest {
private ClientMapper clientMapperMock;
private AuthorizeClientCredentialsRequestService service;

private static final String REGEX = "^(\\w+\\s*)(piattaforma-unitaria\\b)$";

@BeforeEach
void init() {
service = new AuthorizeClientCredentialsRequestService("SECRET", clientServiceMock, clientMapperMock);
service = new AuthorizeClientCredentialsRequestService(clientServiceMock, clientMapperMock, "SECRET");
}

@Test
Expand All @@ -51,7 +47,7 @@ void givenRightCredentialsWhenAuthorizeCredentialsThenOk() {

Mockito.when(clientServiceMock.getClientByClientId(clientId)).thenReturn(Optional.of(mockClient));
Mockito.when(clientMapperMock.mapToDTO(mockClient)).thenReturn(expectedClientDTO);
Assertions.assertFalse(Pattern.compile(REGEX).matcher(clientId).matches());

// When
ClientDTO actualClientDTO = service.authorizeCredentials(clientId, clientSecretMock);
// Then
Expand All @@ -64,7 +60,6 @@ void givenUnexpectedClientIdCredentialsWhenAuthorizeCredentialsThenClientUnautho
String clientId = "UNEXPECTED_CLIENT_ID";
String clientSecretMock = UUID.randomUUID().toString();

Assertions.assertFalse(Pattern.compile(REGEX).matcher(clientId).matches());
Mockito.when(clientServiceMock.getClientByClientId(clientId)).thenThrow(new ClientUnauthorizedException("error"));
// When, Then
Assertions.assertThrows(ClientUnauthorizedException.class, () -> service.authorizeCredentials(clientId, clientSecretMock));
Expand All @@ -86,7 +81,6 @@ void givenUnexpectedClientSecretCredentialsWhenAuthorizeCredentialsThenClientUna
.clientSecret(UUID.randomUUID().toString())
.build();

Assertions.assertFalse(Pattern.compile(REGEX).matcher(clientId).matches());
Mockito.when(clientServiceMock.getClientByClientId(clientId)).thenReturn(Optional.of(mockClient));
Mockito.when(clientMapperMock.mapToDTO(mockClient)).thenReturn(expectedClientDTO);

Expand All @@ -97,32 +91,26 @@ void givenUnexpectedClientSecretCredentialsWhenAuthorizeCredentialsThenClientUna
@Test
void givenSystemUserWhenMatcherThenAssertionOk() {
// Given
String clientId = "IPA_TEST_2piattaforma-unitaria";
String clientSecretEnv = "SECRET";
Matcher matcher = Pattern.compile(REGEX).matcher(clientId);
String clientId = "piattaforma-unitaria_IPA_TEST";
String clientSecret = "SECRET";
String[] splitted = clientId.split("_");

// When
ClientDTO actualClientDTO = service.authorizeCredentials(clientId, clientSecretEnv);
Assertions.assertTrue(matcher.matches());
ClientDTO actualClientDTO = service.authorizeCredentials(clientId, clientSecret);
// Then
Assertions.assertEquals(
ClientDTO.builder()
.clientId(clientId)
.organizationIpaCode(matcher.group(1))
.clientName(matcher.group(2))
.clientSecret(clientSecretEnv)
.build()
, actualClientDTO);
ClientDTO.builder()
.clientId(clientId)
.clientName(splitted[0])
.organizationIpaCode(splitted[1])
.clientSecret(clientSecret)
.build(), actualClientDTO);
}

@Test
void givenSystemUserWhenMatcherThenClientUnauthorizedException() {
// Given
String clientId = "IPA_TEST_2piattaforma-unitaria";
Matcher matcher = Pattern.compile(REGEX).matcher(clientId);

// When, Then
Assertions.assertTrue(matcher.matches());
Assertions.assertThrows(ClientUnauthorizedException.class, () -> service.authorizeCredentials(clientId, "UNEXPECTED_SECRET"));
// Given, When, Then
Assertions.assertThrows(ClientUnauthorizedException.class,
() -> service.authorizeCredentials("piattaforma-unitaria_IPA_TEST", "UNEXPECTED_SECRET"));
}
}
Loading