Examples with RAS_AUTH_CODE_SCOPES org.pmiops.workbench.ras.RasLinkConstants.RAS_AUTH_CODE_SCOPES used on opensource projects

Example 1 with RAS_AUTH_CODE_SCOPES

use of org.pmiops.workbench.ras.RasLinkConstants.RAS_AUTH_CODE_SCOPES in project workbench by all-of-us.

the class RasLinkService method linkRasLoginGovAccount.

/**
 * Links RAS login.gov account with AoU account.
 */
public DbUser linkRasLoginGovAccount(String authCode, String redirectUrl) {
    OpenIdConnectClient rasOidcClient = rasOidcClientProvider.get();
    JsonNode userInfoResponse;
    try {
        // Oauth dance to get id token and access token.
        TokenResponse tokenResponse = rasOidcClient.codeExchange(authCode, decodeUrl(redirectUrl), RAS_AUTH_CODE_SCOPES);
        // Validate IAL status.
        String acrClaim = decodedJwt(tokenResponse.get(Id_TOKEN_FIELD_NAME).toString()).getClaim(ACR_CLAIM).asString();
        if (!isIal2(acrClaim)) {
            log.warning(String.format("User does not have IAL2 enabled, acrClaim: %s", acrClaim));
            throw new ForbiddenException(String.format("User does not have IAL2 enabled, acrClaim: %s", acrClaim));
        }
        // Fetch user info.
        userInfoResponse = rasOidcClient.fetchUserInfo(tokenResponse.getAccessToken());
    } catch (IOException e) {
        log.log(Level.WARNING, "Failed to link RAS account", e);
        throw new ServerErrorException("Failed to link RAS account", e);
    }
    // If eRA is not already linked, check response from RAS see if RAS contains eRA Linking
    // information.
    DbUser user = userService.updateRasLinkLoginGovStatus(getLoginGovUsername(userInfoResponse));
    Optional<AccessModuleStatus> eRAModuleStatus = accessModuleService.getAccessModuleStatus(user).stream().filter(a -> a.getModuleName() == AccessModule.ERA_COMMONS).findFirst();
    if (eRAModuleStatus.isPresent() && (eRAModuleStatus.get().getCompletionEpochMillis() != null || eRAModuleStatus.get().getBypassEpochMillis() != null)) {
        return user;
    }
    Optional<String> eRaUserId = getEraUserId(userInfoResponse);
    if (eRaUserId.isPresent() && !eRaUserId.get().isEmpty()) {
        return userService.updateRasLinkEraStatus(eRaUserId.get());
    } else {
        log.info(String.format("User does not have valid eRA %s", userInfoResponse.get(FEDERATED_IDENTITIES)));
    }
    return user;
}