working spring security config

7 files changed, 89 insertions, 35 deletions

diff --git a/juick-api/src/main/java/com/juick/api/configuration/ApiSecurityConfig.java b/juick-api/src/main/java/com/juick/api/configuration/ApiSecurityConfig.java
index 8d074f7c..d7904199 100644
--- a/juick-api/src/main/java/com/juick/api/configuration/ApiSecurityConfig.java
+++ b/juick-api/src/main/java/com/juick/api/configuration/ApiSecurityConfig.java
@@ -2,22 +2,16 @@ package com.juick.api.configuration;
 
 import com.juick.server.security.JuickAuthenticationEntryPoint;
 import com.juick.server.security.JuickAuthenticationProvider;
-import com.juick.server.security.entities.JuickUser;
 import com.juick.service.UserService;
-import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.PropertySource;
 import org.springframework.core.env.Environment;
 import org.springframework.http.HttpMethod;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
 
 import javax.inject.Inject;
 
@@ -40,32 +34,19 @@ public class ApiSecurityConfig extends WebSecurityConfigurerAdapter {
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http.authorizeRequests()
-                .antMatchers("/home").hasRole("USER")
                 .antMatchers(HttpMethod.OPTIONS).permitAll()
-                .and().httpBasic().authenticationEntryPoint(getBasicAuthEntryPoint())
+                .anyRequest().hasRole("USER")
+                .and().httpBasic().authenticationEntryPoint(getJuickAuthenticationEntryPoint())
+                .and().anonymous()
+                .and().servletApi()
                 .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
-                .and().exceptionHandling().authenticationEntryPoint(getBasicAuthEntryPoint())
-                .and().authenticationProvider(new JuickAuthenticationProvider());
+                .and().exceptionHandling().authenticationEntryPoint(getJuickAuthenticationEntryPoint())
+                .and().authenticationProvider(new JuickAuthenticationProvider(userService))
+                .headers().cacheControl();
     }
 
     @Bean
-    public JuickAuthenticationEntryPoint getBasicAuthEntryPoint() {
+    public JuickAuthenticationEntryPoint getJuickAuthenticationEntryPoint() {
         return new JuickAuthenticationEntryPoint();
     }
-
-    @Bean("userDetailsService")
-    @Override
-    public UserDetailsService userDetailsServiceBean() throws Exception {
-        return username -> {
-            if (StringUtils.isBlank(username))
-                throw new UsernameNotFoundException("Invalid user name " + username);
-
-            com.juick.User user = userService.getUserByName(username);
-
-            if (user != null)
-                return new JuickUser(user);
-
-            throw new UsernameNotFoundException("The username " + username + " is not found");
-        };
-    }
 }
diff --git a/juick-api/src/test/java/com/juick/api/tests/AuthSimpleTest.java b/juick-api/src/test/java/com/juick/api/tests/AuthSimpleTest.java
new file mode 100644
index 00000000..d22d3cf7
--- /dev/null
+++ b/juick-api/src/test/java/com/juick/api/tests/AuthSimpleTest.java
@@ -0,0 +1,8 @@
+package com.juick.api.tests;
+
+/**
+ * Created by aalexeev on 11/26/16.
+ */
+public class AuthSimpleTest {
+    private final String HEADER = "Authorization: Basic dXNlcjE6dXNlcjFQYXNz"; // user1:user1Pass
+}
diff --git a/juick-core/src/main/java/com/juick/User.java b/juick-core/src/main/java/com/juick/User.java
index 03805a65..364bc6ca 100644
--- a/juick-core/src/main/java/com/juick/User.java
+++ b/juick-core/src/main/java/com/juick/User.java
@@ -39,6 +39,7 @@ public class User {
     private String authHash;
     private boolean banned;
     private String credentials;
+    private String lang;
 
     public User() {
     }
@@ -52,6 +53,7 @@ public class User {
         this.messagesCount = u.getUnreadCount();
         this.authHash = u.getAuthHash();
         this.banned = u.isBanned();
+        this.credentials = u.getCredentials();
     }
 
     @Override
@@ -75,6 +77,7 @@ public class User {
                 .append("fullName", fullName)
                 .append("jid", jid)
                 .append("messagesCount", messagesCount)
+                .append("lang", lang)
                 .append("banned", banned)
                 .toString();
     }
@@ -164,4 +167,20 @@ public class User {
     public void setCredentials(String credentials) {
         this.credentials = credentials;
     }
+
+    public String getLang() {
+        return lang;
+    }
+
+    public void setLang(String lang) {
+        this.lang = lang;
+    }
+
+    public int getMessagesCount() {
+        return messagesCount;
+    }
+
+    public void setMessagesCount(int messagesCount) {
+        this.messagesCount = messagesCount;
+    }
 }
diff --git a/juick-server/src/main/java/com/juick/server/security/JuickAuthenticationProvider.java b/juick-server/src/main/java/com/juick/server/security/JuickAuthenticationProvider.java
index 8d0bfddb..87908950 100644
--- a/juick-server/src/main/java/com/juick/server/security/JuickAuthenticationProvider.java
+++ b/juick-server/src/main/java/com/juick/server/security/JuickAuthenticationProvider.java
@@ -1,16 +1,18 @@
 package com.juick.server.security;
 
+import com.juick.User;
 import com.juick.server.security.entities.JuickUser;
 import com.juick.service.UserService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.LockedException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.util.Assert;
 
 import javax.inject.Inject;
-import java.util.Collections;
 
 /**
  * Created by vitalyster on 25.11.2016.
@@ -18,20 +20,27 @@ import java.util.Collections;
 public class JuickAuthenticationProvider implements AuthenticationProvider {
     private final Logger logger = LoggerFactory.getLogger(getClass());
 
+    private final UserService userService;
+
     @Inject
-    private UserService userService;
+    public JuickAuthenticationProvider(UserService userService) {
+        Assert.notNull(userService);
+        this.userService = userService;
+    }
 
     @Override
     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
         String name = authentication.getName();
         String password = authentication.getCredentials().toString();
 
-        boolean isAuthenticated = userService.checkPassword(name, password) > 0;
-
-        logger.info("user {} authenticated: {}", name, isAuthenticated);
+        User user = userService.getFullyUserByName(name);
+        if (user != null) {
+            if (user.isBanned())
+                throw new LockedException("Username \"" + name + "\" is banned");
 
-        return isAuthenticated ?
-                new UsernamePasswordAuthenticationToken(name, password, JuickUser.USER_AUTHORITY) : null;
+            return new UsernamePasswordAuthenticationToken(name, password, JuickUser.USER_AUTHORITY);
+        }
+        return null;
     }
 
     @Override
diff --git a/juick-server/src/main/java/com/juick/server/security/entities/JuickUser.java b/juick-server/src/main/java/com/juick/server/security/entities/JuickUser.java
index fd06b65b..3e413bf6 100644
--- a/juick-server/src/main/java/com/juick/server/security/entities/JuickUser.java
+++ b/juick-server/src/main/java/com/juick/server/security/entities/JuickUser.java
@@ -43,7 +43,7 @@ public class JuickUser implements UserDetails {
 
     @Override
     public boolean isAccountNonLocked() {
-        return false;
+        return true;
     }
 
     @Override
diff --git a/juick-server/src/main/java/com/juick/service/UserService.java b/juick-server/src/main/java/com/juick/service/UserService.java
index cfd5092a..4d7d09c9 100644
--- a/juick-server/src/main/java/com/juick/service/UserService.java
+++ b/juick-server/src/main/java/com/juick/service/UserService.java
@@ -28,6 +28,10 @@ public interface UserService {
 
     User getUserByName(String username);
 
+    User getFullyUserByName(String username);
+
+    List<User> getFullyUsersByNames(Collection<String> usernames);
+
     User getUserByJID(String jid);
 
     List<User> getUsersByName(Collection<String> unames);
diff --git a/juick-server/src/main/java/com/juick/service/UserServiceImpl.java b/juick-server/src/main/java/com/juick/service/UserServiceImpl.java
index 2bdc4d41..d1e4eff5 100644
--- a/juick-server/src/main/java/com/juick/service/UserServiceImpl.java
+++ b/juick-server/src/main/java/com/juick/service/UserServiceImpl.java
@@ -129,6 +129,39 @@ public class UserServiceImpl extends BaseJdbcService implements UserService {
         return result;
     }
 
+    @Override
+    // No need marks with @Transactional annotation
+    public User getFullyUserByName(final String username) {
+        if (StringUtils.isNotBlank(username)) {
+            List<User> list = getFullyUsersByNames(Collections.singletonList(username));
+            if (!list.isEmpty())
+                return list.get(0);
+        }
+        return null;
+    }
+
+    @Transactional(readOnly = true)
+    @Override
+    public List<User> getFullyUsersByNames(final Collection<String> usernames) {
+        if (CollectionUtils.isEmpty(usernames))
+            return Collections.emptyList();
+
+        return getNamedParameterJdbcTemplate().query(
+                "SELECT id, nick, passw, lang, banned FROM users WHERE nick in (:names)",
+                new MapSqlParameterSource("names", usernames),
+                (rs, rowNum) -> {
+                    User user = new User();
+
+                    user.setUid(rs.getInt(1));
+                    user.setName(rs.getString(2));
+                    user.setCredentials(rs.getString(3));
+                    user.setLang(rs.getString(4));
+                    user.setBanned(rs.getBoolean(5));
+
+                    return user;
+                });
+    }
+
     @Transactional(readOnly = true)
     @Override
     public User getUserByJID(final String jid) {