Examples with PowerAuth io.getlime.security.powerauth.rest.api.spring.annotation.PowerAuth used on opensource projects

Example 1 with PowerAuth

use of io.getlime.security.powerauth.rest.api.spring.annotation.PowerAuth in project powerauth-restful-integration by lime-company.

the class TokenController method removeToken.

@RequestMapping(value = "remove", method = RequestMethod.POST)
@PowerAuth(resourceId = "/pa/token/remove", signatureType = { PowerAuthSignatureTypes.POSSESSION, PowerAuthSignatureTypes.POSSESSION_KNOWLEDGE, PowerAuthSignatureTypes.POSSESSION_BIOMETRY, PowerAuthSignatureTypes.POSSESSION_KNOWLEDGE_BIOMETRY })
@ResponseBody
public ObjectResponse<TokenRemoveResponse> removeToken(@RequestBody ObjectRequest<TokenRemoveRequest> request, PowerAuthApiAuthentication authentication) throws PowerAuthAuthenticationException {
    try {
        if (authentication != null && authentication.getActivationId() != null) {
            // Fetch activation ID
            final String activationId = authentication.getActivationId();
            // Fetch token ID from the request
            final TokenRemoveRequest requestObject = request.getRequestObject();
            final String tokenId = requestObject.getTokenId();
            // Remove a token, ignore response, since the endpoint should quietly return
            powerAuthClient.removeToken(tokenId, activationId);
            // Prepare a response
            final TokenRemoveResponse responseObject = new TokenRemoveResponse();
            responseObject.setTokenId(requestObject.getTokenId());
            return new ObjectResponse<>(responseObject);
        } else {
            throw new PowerAuthAuthenticationException();
        }
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        throw new PowerAuthAuthenticationException(ex.getMessage());
    }
}

Example 2 with PowerAuth

use of io.getlime.security.powerauth.rest.api.spring.annotation.PowerAuth in project powerauth-restful-integration by lime-company.

the class PowerAuthAnnotationInterceptor method preHandle.

@Override
public boolean preHandle(@NonNull HttpServletRequest request, @NonNull HttpServletResponse response, @NonNull Object handler) {
    // requests before the actual requests.
    if (handler instanceof HandlerMethod) {
        final HandlerMethod handlerMethod = (HandlerMethod) handler;
        // Obtain annotations
        PowerAuth powerAuthSignatureAnnotation = handlerMethod.getMethodAnnotation(PowerAuth.class);
        PowerAuthToken powerAuthTokenAnnotation = handlerMethod.getMethodAnnotation(PowerAuthToken.class);
        PowerAuthEncryption powerAuthEncryptionAnnotation = handlerMethod.getMethodAnnotation(PowerAuthEncryption.class);
        // Check that either signature or token annotation is active
        if (powerAuthSignatureAnnotation != null && powerAuthTokenAnnotation != null) {
            logger.warn("You cannot use both @PowerAuth and @PowerAuthToken on same handler method. We are removing both.");
            powerAuthSignatureAnnotation = null;
            powerAuthTokenAnnotation = null;
        }
        // sign-then-encrypt sequence in case both authorization and encryption are used.
        if (powerAuthEncryptionAnnotation != null) {
            final Type requestType = resolveGenericParameterTypeForEcies(handlerMethod);
            try {
                encryptionProvider.decryptRequest(request, requestType, powerAuthEncryptionAnnotation.scope());
            // Encryption object is saved in HTTP servlet request by encryption provider, so that it is available for Spring
            } catch (PowerAuthEncryptionException ex) {
                logger.warn("Decryption failed, error: {}", ex.getMessage());
                logger.debug("Error details", ex);
            }
        }
        // Resolve @PowerAuth annotation
        if (powerAuthSignatureAnnotation != null) {
            try {
                final String resourceId = expandResourceId(powerAuthSignatureAnnotation.resourceId(), request, handlerMethod);
                final String header = request.getHeader(PowerAuthSignatureHttpHeader.HEADER_NAME);
                final List<PowerAuthSignatureTypes> signatureTypes = Arrays.asList(powerAuthSignatureAnnotation.signatureType());
                final PowerAuthApiAuthentication authentication = authenticationProvider.validateRequestSignatureWithActivationDetails(request, resourceId, header, signatureTypes);
                request.setAttribute(PowerAuthRequestObjects.AUTHENTICATION_OBJECT, authentication);
            } catch (PowerAuthAuthenticationException ex) {
                logger.warn("Invalid request signature, authentication object was removed");
                request.setAttribute(PowerAuthRequestObjects.AUTHENTICATION_OBJECT, null);
            }
        }
        // Resolve @PowerAuthToken annotation
        if (powerAuthTokenAnnotation != null) {
            try {
                final String header = request.getHeader(PowerAuthTokenHttpHeader.HEADER_NAME);
                final List<PowerAuthSignatureTypes> signatureTypes = Arrays.asList(powerAuthTokenAnnotation.signatureType());
                final PowerAuthApiAuthentication authentication = authenticationProvider.validateTokenWithActivationDetails(header, signatureTypes);
                request.setAttribute(PowerAuthRequestObjects.AUTHENTICATION_OBJECT, authentication);
            } catch (PowerAuthAuthenticationException ex) {
                logger.warn("Invalid token, authentication object was removed");
                request.setAttribute(PowerAuthRequestObjects.AUTHENTICATION_OBJECT, null);
            }
        }
    }
    return true;
}

Example 3 with PowerAuth

use of io.getlime.security.powerauth.rest.api.spring.annotation.PowerAuth in project powerauth-restful-integration by lime-company.

the class TokenController method createToken.

@RequestMapping(value = "create", method = RequestMethod.POST)
@PowerAuth(resourceId = "/pa/token/create", signatureType = { PowerAuthSignatureTypes.POSSESSION, PowerAuthSignatureTypes.POSSESSION_KNOWLEDGE, PowerAuthSignatureTypes.POSSESSION_BIOMETRY, PowerAuthSignatureTypes.POSSESSION_KNOWLEDGE_BIOMETRY })
@ResponseBody
public ObjectResponse<TokenCreateResponse> createToken(@RequestBody ObjectRequest<TokenCreateRequest> request, PowerAuthApiAuthentication authentication) throws PowerAuthAuthenticationException {
    try {
        if (authentication != null && authentication.getActivationId() != null) {
            // Fetch activation ID and signature type
            final String activationId = authentication.getActivationId();
            final PowerAuthSignatureTypes signatureFactors = authentication.getSignatureFactors();
            // Fetch data from the request
            final TokenCreateRequest requestObject = request.getRequestObject();
            final String ephemeralPublicKey = requestObject.getEphemeralPublicKey();
            // Prepare a signature type converter
            SignatureTypeConverter converter = new SignatureTypeConverter();
            // Create a token
            final CreateTokenResponse token = powerAuthClient.createToken(activationId, ephemeralPublicKey, converter.convertFrom(signatureFactors));
            // Prepare a response
            final TokenCreateResponse responseObject = new TokenCreateResponse();
            responseObject.setMac(token.getMac());
            responseObject.setEncryptedData(token.getEncryptedData());
            return new ObjectResponse<>(responseObject);
        } else {
            throw new PowerAuthAuthenticationException();
        }
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        throw new PowerAuthAuthenticationException(ex.getMessage());
    }
}