diff options
Diffstat (limited to 'src')
22 files changed, 383 insertions, 260 deletions
diff --git a/src/main/java/com/juick/config/SecurityConfig.java b/src/main/java/com/juick/config/SecurityConfig.java index d2030a62..d60abe00 100644 --- a/src/main/java/com/juick/config/SecurityConfig.java +++ b/src/main/java/com/juick/config/SecurityConfig.java @@ -25,20 +25,37 @@ import com.juick.service.security.HTTPSignatureAuthenticationFilter; import com.juick.service.security.HashParamAuthenticationFilter; import com.juick.service.security.JuickUserDetailsService; import com.juick.service.security.entities.JuickUser; +import com.nimbusds.jose.jwk.JWKSet; +import com.nimbusds.jose.jwk.RSAKey; +import com.nimbusds.jose.jwk.source.ImmutableJWKSet; +import com.nimbusds.jose.jwk.source.JWKSource; +import com.nimbusds.jose.proc.SecurityContext; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.core.Ordered; +import org.springframework.core.annotation.Order; import org.springframework.http.HttpMethod; +import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; +import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.oauth2.jwt.JwtDecoder; +import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository; +import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration; +import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer; +import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings; import org.springframework.security.web.AuthenticationEntryPoint; +import org.springframework.security.web.RedirectStrategy; import org.springframework.security.web.SecurityFilterChain; -import org.springframework.security.web.authentication.AuthenticationSuccessHandler; -import org.springframework.security.web.authentication.RememberMeServices; -import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler; +import org.springframework.security.web.authentication.*; import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices; import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint; import org.springframework.security.web.authentication.www.BasicAuthenticationFilter; @@ -48,8 +65,12 @@ import org.springframework.web.cors.CorsConfigurationSource; import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import javax.inject.Inject; +import java.io.IOException; +import java.security.interfaces.RSAPrivateKey; +import java.security.interfaces.RSAPublicKey; import java.util.Arrays; import java.util.Collections; +import java.util.UUID; /** * Created by aalexeev on 11/21/16. @@ -61,7 +82,8 @@ public class SecurityConfig { private UserService userService; @Inject private KeystoreManager keystoreManager; - + @Inject + private JdbcTemplate jdbcTemplate; private static final String COOKIE_NAME = "juick-remember-me"; @Bean UserDetailsService userDetailsService() { @@ -77,6 +99,7 @@ public class SecurityConfig { configuration.setAllowedHeaders(Collections.singletonList("*")); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); + source.registerCorsConfiguration("/oauth/**", configuration); source.registerCorsConfiguration("/api/**", configuration); source.registerCorsConfiguration("/u/**", configuration); source.registerCorsConfiguration("/n/**", configuration); @@ -124,14 +147,60 @@ public class SecurityConfig { services.setUseSecureCookie(false); // TODO set true if https is supports return services; } + @Bean + @Order(Ordered.HIGHEST_PRECEDENCE) + public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) + throws Exception { + OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http); + http.getConfigurer(OAuth2AuthorizationServerConfigurer.class) + .authorizationServerSettings(AuthorizationServerSettings.builder() + .authorizationEndpoint("/oauth/authorize") + .tokenEndpoint("/oauth/token") + .build()) + .oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0 + http + // Redirect to the login page when not authenticated from the + // authorization endpoint + .exceptionHandling((exceptions) -> exceptions + .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")) + ) + // Accept access tokens for User Info and/or Client Registration + .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt); + + return http.formLogin(Customizer.withDefaults()).build(); + } + @Bean + public RegisteredClientRepository registeredClientRepository() { + return new JdbcRegisteredClientRepository(jdbcTemplate); + } + + @Bean + public JWKSource<SecurityContext> jwkSource() { + RSAPublicKey publicKey = (RSAPublicKey) keystoreManager.getPublicKey(); + RSAPrivateKey privateKey = (RSAPrivateKey) keystoreManager.getPrivateKey(); + RSAKey rsaKey = new RSAKey.Builder(publicKey) + .privateKey(privateKey) + .keyID(UUID.randomUUID().toString()) + .build(); + JWKSet jwkSet = new JWKSet(rsaKey); + return new ImmutableJWKSet<>(jwkSet); + } + @Bean + public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) { + return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource); + } + @Bean + public AuthorizationServerSettings authorizationServerSettings() { + return AuthorizationServerSettings.builder().build(); + } @Bean + @Order(2) SecurityFilterChain apiChain(HttpSecurity http) throws Exception { http.securityMatcher("/api/**") .addFilterBefore(apiAuthenticationFilter(), BasicAuthenticationFilter.class) .addFilterBefore(new HTTPSignatureAuthenticationFilter(signatureManager, userService), BasicAuthenticationFilter.class) - .addFilterBefore(bearerTokenAuthenticationFilter(), BasicAuthenticationFilter.class) .authorizeHttpRequests(requests -> requests .requestMatchers(HttpMethod.OPTIONS).permitAll() .requestMatchers("/api/", "/api/messages", "/api/avatar", @@ -142,15 +211,16 @@ public class SecurityConfig { "/api/_vklogin", "/api/_tglogin", "/api/_google", "/api/_applelogin", "/api/signup", "/api/inbox", "/api/events", "/api/u/", - "/api/info/**", - "/api/nodeinfo/2.0") + "/api/info/**", "/api/v1/apps", "/api/v1/instance", + "/api/nodeinfo/2.0", "/oauth/**") .permitAll() - .anyRequest().hasRole("USER")) + .anyRequest().hasAnyAuthority("SCOPE_write", "ROLE_USER")) .anonymous(anonymous -> anonymous.principal(JuickUser.ANONYMOUS_USER) .authorities(JuickUser.ANONYMOUS_AUTHORITY)) .httpBasic(httpBasic -> httpBasic .authenticationEntryPoint(apiAuthenticationEntryPoint())) .cors(cors -> cors.configurationSource(corsConfigurationSource())) + .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt) .sessionManagement(sessionManagement -> sessionManagement .sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .exceptionHandling(exceptionHandling -> exceptionHandling @@ -159,14 +229,6 @@ public class SecurityConfig { .headers().defaultsDisabled().cacheControl(); return http.build(); } - - @Bean - AuthenticationSuccessHandler successHandler() { - SimpleUrlAuthenticationSuccessHandler handler = new SimpleUrlAuthenticationSuccessHandler(); - handler.setUseReferer(true); - return handler; - } - @Bean SecurityFilterChain h2ConsoFilterChain(HttpSecurity http) throws Exception { http.securityMatcher("/h2-console/**") @@ -182,7 +244,12 @@ public class SecurityConfig { .headers().defaultsDisabled().cacheControl(); return http.build(); } - + @Bean + AuthenticationSuccessHandler successHandler() { + var handler = new SavedRequestAwareAuthenticationSuccessHandler(); + handler.setUseReferer(true); + return handler; + } @Bean SecurityFilterChain wwwChain(HttpSecurity http) throws Exception { http.addFilterBefore(wwwAuthenticationFilter(), BasicAuthenticationFilter.class) @@ -197,9 +264,6 @@ public class SecurityConfig { .authorities(JuickUser.ANONYMOUS_AUTHORITY)) .cors(cors -> cors .configurationSource(corsConfigurationSource())) - .sessionManagement( - sessionManagement -> sessionManagement - .sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .logout(logout -> logout .logoutRequestMatcher(new AntPathRequestMatcher("/logout")) .invalidateHttpSession(true) diff --git a/src/main/java/com/juick/service/security/annotation/Visitor.java b/src/main/java/com/juick/service/security/annotation/Visitor.java deleted file mode 100644 index 2bad7e4b..00000000 --- a/src/main/java/com/juick/service/security/annotation/Visitor.java +++ /dev/null @@ -1,29 +0,0 @@ -/* - * Copyright (C) 2008-2020, Juick - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as - * published by the Free Software Foundation, either version 3 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see <http://www.gnu.org/licenses/>. - */ - -package com.juick.service.security.annotation; - -import org.springframework.security.core.annotation.AuthenticationPrincipal; - -import java.lang.annotation.*; - -@Target({ ElementType.PARAMETER, ElementType.TYPE }) -@Retention(RetentionPolicy.RUNTIME) -@Documented -@AuthenticationPrincipal(errorOnInvalidType = true, expression = "user") -public @interface Visitor { -} diff --git a/src/main/java/com/juick/www/SiteAttributesHandler.java b/src/main/java/com/juick/www/SiteAttributesHandler.java index e06a2070..4ead9d1e 100644 --- a/src/main/java/com/juick/www/SiteAttributesHandler.java +++ b/src/main/java/com/juick/www/SiteAttributesHandler.java @@ -17,6 +17,14 @@ package com.juick.www; +import com.juick.model.AnonymousUser; +import com.juick.model.User; +import com.juick.service.UserService; +import com.juick.service.security.entities.JuickUser; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.annotation.AuthenticationPrincipal; +import org.springframework.security.oauth2.jwt.Jwt; +import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.ModelAttribute; @@ -24,8 +32,12 @@ import org.springframework.web.servlet.support.ServletUriComponentsBuilder; import jakarta.servlet.http.HttpServletResponse; +import javax.inject.Inject; + @ControllerAdvice public class SiteAttributesHandler { + @Inject + private UserService userService; @ModelAttribute public void setVaryResponseHeader(HttpServletResponse response) { response.setHeader("Vary", "Accept-Language"); @@ -34,4 +46,17 @@ public class SiteAttributesHandler { public void setReturnPathAttribute(Model model) { model.addAttribute("retpath", ServletUriComponentsBuilder.fromCurrentRequestUri().toUriString()); } + @ModelAttribute + public User visitor(Model model, @AuthenticationPrincipal Object principal) { + if (principal != null) { + if (principal instanceof JuickUser) { + return ((JuickUser) principal).getUser(); + } + if (principal instanceof Jwt) { + var uname = (String) ((Jwt) principal).getClaims().get("sub"); + return userService.getUserByName(uname); + } + } + return AnonymousUser.INSTANCE; + } } diff --git a/src/main/java/com/juick/www/ad/SapeService.java b/src/main/java/com/juick/www/ad/SapeService.java index 3c35f320..7b398806 100644 --- a/src/main/java/com/juick/www/ad/SapeService.java +++ b/src/main/java/com/juick/www/ad/SapeService.java @@ -18,7 +18,6 @@ package com.juick.www.ad; import com.juick.model.User; -import com.juick.service.security.annotation.Visitor; import com.juick.www.controllers.Site; import org.apache.commons.lang3.StringUtils; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; @@ -47,7 +46,7 @@ public class SapeService { @ModelAttribute public void addSapeLinks( - @Visitor User visitor, + @ModelAttribute User visitor, @CookieValue(name = "sape_cookie", required = false, defaultValue = StringUtils.EMPTY) String sapeCookie, @RequestParam(required = false, defaultValue = "0") int before, @RequestParam(name = "show", required = false) String paramShow, diff --git a/src/main/java/com/juick/www/api/Mastodon.java b/src/main/java/com/juick/www/api/Mastodon.java new file mode 100644 index 00000000..69f0f4f6 --- /dev/null +++ b/src/main/java/com/juick/www/api/Mastodon.java @@ -0,0 +1,118 @@ +/* + * Copyright (C) 2008-2023, Juick + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +package com.juick.www.api; + +import com.fasterxml.jackson.annotation.JsonProperty; +import com.juick.model.User; +import com.juick.service.UserService; +import com.juick.www.WebApp; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.http.MediaType; +import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository; +import org.springframework.security.oauth2.server.authorization.settings.ClientSettings; +import org.springframework.web.bind.annotation.*; + +import javax.inject.Inject; +import java.util.Arrays; +import java.util.Collection; +import java.util.Collections; +import java.util.UUID; + +@RestController +public class Mastodon { + @Value("${web_domain:localhost}") + private String domain; + @Inject + WebApp webApp; + @Inject + UserService userService; + @Inject + RegisteredClientRepository registeredClientRepository; + + public record ApplicationRequest(@JsonProperty("client_name") String clientName, + @JsonProperty("redirect_uris") String redirectUris, + @JsonProperty("scopes") String scopes) { + } + + public record ApplicationResponse(String id, + @JsonProperty("client_name") String name, + @JsonProperty("redirect_uri") String redirectUri, + @JsonProperty("client_id") String clientId, + @JsonProperty("client_secret") String clientSecret) { + } + + public record CredentialAccount(String id, String username, String acct, + @JsonProperty("display_name") String displayName, + @JsonProperty("followers_count") Integer followersCount, + @JsonProperty("following_count") Integer followingCount, + String avatar) { + + } + private Collection<String> parseScopes(String s) { + return s != null ? Arrays.asList(s.split(" ")) : Collections.emptyList(); + } + + @PostMapping(value = "/api/v1/apps", consumes = { MediaType.APPLICATION_JSON_VALUE }) + public ApplicationResponse apps(@RequestBody ApplicationRequest application) { + return apps(application.clientName(), application.redirectUris(), application.scopes()); + } + + @PostMapping(value = "/api/v1/apps", consumes = { MediaType.APPLICATION_FORM_URLENCODED_VALUE, MediaType.MULTIPART_FORM_DATA_VALUE }) + public ApplicationResponse apps(@RequestParam("client_name") String clientName, + @RequestParam("redirect_uris") String redirectUris, + @RequestParam("scopes") String scopes) { + var secret = UUID.randomUUID().toString(); + RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString()) + .clientId(UUID.randomUUID().toString()) + .clientSecret("{noop}" + secret) + .clientName(clientName) + .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST) + .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE) + .redirectUri(redirectUris) + .scopes((coll) -> coll.addAll(parseScopes(scopes))) + .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build()).build(); + registeredClientRepository.save(registeredClient); + return new ApplicationResponse( + registeredClient.getId(), + registeredClient.getClientName(), + String.join(",", registeredClient.getRedirectUris()), + registeredClient.getClientId(), + secret + ); + } + public record Instance(String domain) {} + @GetMapping("/api/v1/instance") + public Instance getInstance() { + return new Instance(domain); + } + @GetMapping("/api/v1/accounts/verify_credentials") + public CredentialAccount account(@ModelAttribute User visitor) { + return new CredentialAccount( + String.valueOf(visitor.getUid()), + visitor.getName(), + visitor.getName(), + visitor.getFullName(), + userService.getUserReaders(visitor.getUid()).size(), + userService.getUserFriends(visitor.getUid()).size(), + webApp.getAvatarUrl(visitor) + ); + } +} diff --git a/src/main/java/com/juick/www/api/Messages.java b/src/main/java/com/juick/www/api/Messages.java index 2993e805..c23976f4 100644 --- a/src/main/java/com/juick/www/api/Messages.java +++ b/src/main/java/com/juick/www/api/Messages.java @@ -30,14 +30,11 @@ import com.juick.service.MessagesService; import com.juick.service.TagService; import com.juick.service.UserService; import com.juick.service.component.SystemEvent; -import com.juick.service.security.annotation.Visitor; import org.apache.commons.io.IOUtils; -import org.apache.commons.lang3.tuple.Pair; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.ApplicationEventPublisher; import org.springframework.core.io.Resource; import org.springframework.http.MediaType; -import org.springframework.security.access.annotation.Secured; import org.springframework.util.StringUtils; import org.springframework.web.bind.annotation.*; @@ -70,9 +67,8 @@ public class Messages { // TODO: serialize image urls - @GetMapping("/api/home") - @Secured("ROLE_USER") - public List<Message> getHome(@Visitor User visitor, + @GetMapping({"/api/home"}) + public List<Message> getHome(@ModelAttribute User visitor, @RequestParam(defaultValue = "0") int before_mid) { int vuid = visitor.getUid(); List<Integer> mids = messagesService.getMyFeed(vuid, before_mid, true); @@ -82,7 +78,7 @@ public class Messages { } @GetMapping("/api/messages") - public List<Message> getMessages(@Visitor User visitor, + public List<Message> getMessages(@ModelAttribute User visitor, @RequestParam(required = false) String uname, @RequestParam(name = "before_mid", defaultValue = "0") Integer before, @RequestParam(required = false, defaultValue = "0") Integer daysback, @@ -140,7 +136,7 @@ public class Messages { } @DeleteMapping("/api/messages") - public CommandResult deleteMessage(@Visitor User visitor, @RequestParam int mid, + public CommandResult deleteMessage(@ModelAttribute User visitor, @RequestParam int mid, @RequestParam(required = false, defaultValue = "0") int rid) { if (rid > 0) { if (messagesService.deleteReply(visitor.getUid(), mid, rid)) { @@ -154,7 +150,7 @@ public class Messages { } @GetMapping("/api/messages/discussions") - public List<Message> getDiscussions(@Visitor User visitor, + public List<Message> getDiscussions(@ModelAttribute User visitor, @RequestParam(required = false, defaultValue = "0") Long to) { List<Message> msgs = messagesService.getMessages(visitor, messagesService.getDiscussions(visitor.getUid(), to)); msgs.forEach(m -> m.getUser().setAvatar(webApp.getAvatarUrl(m.getUser()))); @@ -162,7 +158,7 @@ public class Messages { } @GetMapping("/api/thread") - public List<Message> getThread(@Visitor User visitor, @RequestParam(defaultValue = "0") int mid, + public List<Message> getThread(@ModelAttribute User visitor, @RequestParam(defaultValue = "0") int mid, @RequestParam(defaultValue = "true") boolean showReplies) { Optional<Message> message = messagesService.getMessage(mid); if (message.isPresent()) { @@ -192,7 +188,7 @@ public class Messages { } @GetMapping(value = "/api/thread/mark_read/{mid}-{rid}.gif", produces = MediaType.IMAGE_GIF_VALUE) - public byte[] markThreadRead(@Visitor User visitor, @PathVariable int mid, @PathVariable int rid) + public byte[] markThreadRead(@ModelAttribute User visitor, @PathVariable int mid, @PathVariable int rid) throws IOException { if (!visitor.isAnonymous()) { messagesService.setLastReadComment(visitor, mid, rid); diff --git a/src/main/java/com/juick/www/api/Notifications.java b/src/main/java/com/juick/www/api/Notifications.java index 09dad9e2..32ba3dc1 100644 --- a/src/main/java/com/juick/www/api/Notifications.java +++ b/src/main/java/com/juick/www/api/Notifications.java @@ -17,36 +17,19 @@ package com.juick.www.api; -import java.util.Collections; -import java.util.List; -import java.util.stream.Collectors; - -import javax.inject.Inject; - -import com.juick.model.AnonymousUser; -import com.juick.model.ExternalToken; -import com.juick.model.Message; -import com.juick.model.Status; -import com.juick.model.User; -import com.juick.service.MessagesService; -import com.juick.service.PushQueriesService; -import com.juick.service.SubscriptionService; -import com.juick.service.TelegramService; -import com.juick.service.UserService; -import com.juick.service.security.annotation.Visitor; +import com.juick.model.*; +import com.juick.service.*; import com.juick.util.HttpBadRequestException; import com.juick.util.HttpForbiddenException; - +import io.swagger.v3.oas.annotations.Hidden; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.http.MediaType; -import org.springframework.web.bind.annotation.RequestBody; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.bind.annotation.*; -import io.swagger.v3.oas.annotations.Hidden; +import javax.inject.Inject; +import java.util.Collections; +import java.util.List; /** * Created by vitalyster on 24.10.2016. @@ -88,7 +71,7 @@ public class Notifications { @Hidden @RequestMapping(value = "/api/notifications", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public List<User> doGet( - @Visitor User visitor, + @ModelAttribute(binding = false) User visitor, @RequestParam(required = false, defaultValue = "0") int uid, @RequestParam(required = false, defaultValue = "0") int mid, @RequestParam(required = false, defaultValue = "0") int rid) { @@ -127,24 +110,17 @@ public class Notifications { @Hidden @RequestMapping(value = "/api/notifications", method = RequestMethod.DELETE, produces = MediaType.APPLICATION_JSON_VALUE) public Status doDelete( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestBody List<ExternalToken> list) { if (!visitor.equals(serviceUser)) { throw new HttpForbiddenException(); } list.forEach(t -> { switch (t.type()) { - case "gcm": - pushQueriesService.deleteGCMToken(t.token()); - break; - case "apns": - pushQueriesService.deleteAPNSToken(t.token()); - break; - case "mpns": - pushQueriesService.deleteMPNSToken(t.token()); - break; - default: - throw new HttpBadRequestException(); + case "gcm" -> pushQueriesService.deleteGCMToken(t.token()); + case "apns" -> pushQueriesService.deleteAPNSToken(t.token()); + case "mpns" -> pushQueriesService.deleteMPNSToken(t.token()); + default -> throw new HttpBadRequestException(); } }); @@ -153,24 +129,17 @@ public class Notifications { @Hidden @RequestMapping(value = "/api/notifications/delete", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE) public Status doDeleteTokens( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestBody List<ExternalToken> list) { if (!visitor.equals(serviceUser)) { throw new HttpForbiddenException(); } list.forEach(t -> { switch (t.type()) { - case "gcm": - pushQueriesService.deleteGCMToken(t.token()); - break; - case "apns": - pushQueriesService.deleteAPNSToken(t.token()); - break; - case "mpns": - pushQueriesService.deleteMPNSToken(t.token()); - break; - default: - throw new HttpBadRequestException(); + case "gcm" -> pushQueriesService.deleteGCMToken(t.token()); + case "apns" -> pushQueriesService.deleteAPNSToken(t.token()); + case "mpns" -> pushQueriesService.deleteMPNSToken(t.token()); + default -> throw new HttpBadRequestException(); } }); @@ -180,21 +149,14 @@ public class Notifications { @Hidden @RequestMapping(value = "/api/notifications", method = RequestMethod.PUT, produces = MediaType.APPLICATION_JSON_VALUE) public Status doPut( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestBody List<ExternalToken> list) { list.forEach(t -> { switch (t.type()) { - case "gcm": - pushQueriesService.addGCMToken(visitor.getUid(), t.token()); - break; - case "apns": - pushQueriesService.addAPNSToken(visitor.getUid(), t.token()); - break; - case "mpns": - pushQueriesService.addMPNSToken(visitor.getUid(), t.token()); - break; - default: - throw new HttpBadRequestException(); + case "gcm" -> pushQueriesService.addGCMToken(visitor.getUid(), t.token()); + case "apns" -> pushQueriesService.addAPNSToken(visitor.getUid(), t.token()); + case "mpns" -> pushQueriesService.addMPNSToken(visitor.getUid(), t.token()); + default -> throw new HttpBadRequestException(); } }); return Status.OK; @@ -203,7 +165,7 @@ public class Notifications { @Deprecated @RequestMapping(value = "/api/android/register", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public Status doAndroidRegister( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(name = "regid") String regId) { pushQueriesService.addGCMToken(visitor.getUid(), regId); return Status.OK; @@ -212,7 +174,7 @@ public class Notifications { @Deprecated @RequestMapping(value = "/api/winphone/register", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public Status doWinphoneRegister( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(name = "url") String regId) { pushQueriesService.addMPNSToken(visitor.getUid(), regId); return Status.OK; diff --git a/src/main/java/com/juick/www/api/PM.java b/src/main/java/com/juick/www/api/PM.java index 96387dce..c4acd4b3 100644 --- a/src/main/java/com/juick/www/api/PM.java +++ b/src/main/java/com/juick/www/api/PM.java @@ -29,13 +29,9 @@ import com.juick.www.WebApp; import com.juick.service.ChatService; import com.juick.service.UserService; import com.juick.service.component.SystemEvent; -import com.juick.service.security.annotation.Visitor; import org.springframework.context.ApplicationEventPublisher; import org.springframework.http.MediaType; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.bind.annotation.*; import javax.inject.Inject; import java.util.Collections; @@ -57,7 +53,7 @@ public class PM { @RequestMapping(value = "/api/pm", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public List<Message> doGetPM( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(required = false) String uname) { int uid = 0; if (uname != null && uname.matches("^[a-zA-Z0-9\\-]{2,16}$")) { @@ -75,7 +71,7 @@ public class PM { @RequestMapping(value = "/api/pm", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE) public Message doPostPM( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam String uname, @RequestParam String body) { User userTo = AnonymousUser.INSTANCE; @@ -107,7 +103,7 @@ public class PM { } @RequestMapping(value = "/api/groups_pms", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public PrivateChats doGetGroupsPMs( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(defaultValue = "5") int cnt) { // TODO: ignore cnt param for now but make sure paging param will not be cnt diff --git a/src/main/java/com/juick/www/api/Post.java b/src/main/java/com/juick/www/api/Post.java index c840a590..2a92178d 100644 --- a/src/main/java/com/juick/www/api/Post.java +++ b/src/main/java/com/juick/www/api/Post.java @@ -37,7 +37,6 @@ import com.juick.service.MessagesService; import com.juick.service.StorageService; import com.juick.service.UserService; import com.juick.service.activities.UpdateEvent; -import com.juick.service.security.annotation.Visitor; import com.juick.util.HttpBadRequestException; import com.juick.util.HttpForbiddenException; import com.juick.util.HttpNotFoundException; @@ -49,13 +48,7 @@ import org.slf4j.LoggerFactory; import org.springframework.context.ApplicationEventPublisher; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.ResponseStatus; -import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.bind.annotation.*; import org.springframework.web.multipart.MultipartFile; /** @@ -81,7 +74,7 @@ public class Post { @RequestMapping(value = "/api/post", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE) @ResponseStatus(value = HttpStatus.OK) public CommandResult doPostMessage( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(required = false, defaultValue = StringUtils.EMPTY) String body, @RequestParam(required = false) String img, @RequestParam(required = false) MultipartFile attach) throws Exception { @@ -112,7 +105,7 @@ public class Post { @RequestMapping(value = "/api/comment", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE) public CommandResult doPostComment( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(defaultValue = "0") int mid, @RequestParam(defaultValue = "0") int rid, @RequestParam(required = false, defaultValue = StringUtils.EMPTY) final String body, @@ -164,7 +157,7 @@ public class Post { @PostMapping("/api/like") @ResponseStatus(value = HttpStatus.OK) - public Status doPostRecommendation(@Visitor User visitor, @RequestParam Integer mid) throws Exception { + public Status doPostRecommendation(@ModelAttribute User visitor, @RequestParam Integer mid) throws Exception { Optional<Message> message = messagesService.getMessage(mid); if (message.isEmpty()) { throw new HttpNotFoundException(); @@ -180,7 +173,7 @@ public class Post { @PostMapping("/api/subscribe") @ResponseStatus(value = HttpStatus.OK) - public Status doPostSubscribe(@Visitor User visitor, + public Status doPostSubscribe(@ModelAttribute User visitor, @RequestParam Integer mid) throws Exception { Optional<Message> message = messagesService.getMessage(mid); if (message.isEmpty()) { @@ -204,7 +197,7 @@ public class Post { @PostMapping("/api/react") @ResponseStatus(value = HttpStatus.OK) public Status doPostReact( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam Integer mid, @RequestParam @NotNull int reactionId, @RequestParam(required = false, defaultValue = "1") int count) { @@ -226,7 +219,7 @@ public class Post { } @PostMapping("/api/update") - public CommandResult updateMessage(@Visitor User visitor, + public CommandResult updateMessage(@ModelAttribute User visitor, @RequestParam Integer mid, @RequestParam(required = false, defaultValue = "0") Integer rid, @RequestParam String body) { diff --git a/src/main/java/com/juick/www/api/Service.java b/src/main/java/com/juick/www/api/Service.java index 3bb760ff..f4599a56 100644 --- a/src/main/java/com/juick/www/api/Service.java +++ b/src/main/java/com/juick/www/api/Service.java @@ -30,7 +30,6 @@ import com.juick.service.MessagesService; import com.juick.service.StorageService; import com.juick.service.UserService; import com.juick.service.component.AccountVerificationEvent; -import com.juick.service.security.annotation.Visitor; import io.swagger.v3.oas.annotations.Hidden; import jakarta.mail.Session; import jakarta.mail.internet.AddressException; @@ -49,10 +48,7 @@ import org.springframework.beans.factory.annotation.Value; import org.springframework.context.ApplicationEventPublisher; import org.springframework.http.HttpStatus; import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.ExceptionHandler; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.ResponseStatus; +import org.springframework.web.bind.annotation.*; import org.springframework.web.context.request.async.AsyncRequestTimeoutException; import org.springframework.web.servlet.mvc.method.annotation.SseEmitter; @@ -92,7 +88,7 @@ public class Service { @Hidden @PostMapping("/api/mail") @ResponseStatus(value = HttpStatus.OK) - public void processMail(@Visitor User current, InputStream data) throws Exception { + public void processMail(@ModelAttribute User current, InputStream data) throws Exception { if (current.equals(serviceUser)) { MimeMessage msg = new MimeMessage(session, data); String[] returnPaths = msg.getHeader("Return-Path"); @@ -207,7 +203,7 @@ public class Service { @Hidden @PostMapping("/api/mail/unsubscribe") @ResponseStatus(value = HttpStatus.OK) - public void processMailUnsubscribe(@Visitor User current, InputStream data) throws Exception { + public void processMailUnsubscribe(@ModelAttribute User current, InputStream data) throws Exception { if (current.equals(serviceUser)) { MimeMessage msg = new MimeMessage(session, data); String from = msg.getFrom() == null || msg.getFrom().length > 1 @@ -231,7 +227,7 @@ public class Service { } @GetMapping("/api/events") - public SseEmitter handle(@Visitor User visitor) { + public SseEmitter handle(@ModelAttribute User visitor) { logger.info("{} connected", visitor.getName()); if (!visitor.isAnonymous()) { userService.updateLastSeen(visitor); diff --git a/src/main/java/com/juick/www/api/Tags.java b/src/main/java/com/juick/www/api/Tags.java index 7d934f38..2b6405ac 100644 --- a/src/main/java/com/juick/www/api/Tags.java +++ b/src/main/java/com/juick/www/api/Tags.java @@ -20,12 +20,8 @@ package com.juick.www.api; import com.juick.model.User; import com.juick.model.TagStats; import com.juick.service.TagService; -import com.juick.service.security.annotation.Visitor; import org.springframework.http.MediaType; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.bind.annotation.*; import javax.inject.Inject; import java.util.List; @@ -40,7 +36,7 @@ public class Tags { @RequestMapping(value = "/api/tags", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public List<TagStats> tags( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(required = false, defaultValue = "0") int user_id ) { if (user_id > 0) { diff --git a/src/main/java/com/juick/www/api/Users.java b/src/main/java/com/juick/www/api/Users.java index dd620380..f7c24d8d 100644 --- a/src/main/java/com/juick/www/api/Users.java +++ b/src/main/java/com/juick/www/api/Users.java @@ -36,7 +36,6 @@ import com.juick.service.TelegramService; import com.juick.service.UserService; import com.juick.service.activities.UpdateUserEvent; import com.juick.service.component.MailVerificationEvent; -import com.juick.service.security.annotation.Visitor; import com.juick.util.HttpBadRequestException; import com.juick.util.HttpNotFoundException; import com.juick.util.HttpUtils; @@ -48,13 +47,7 @@ import org.apache.commons.lang3.RandomStringUtils; import org.apache.commons.lang3.StringUtils; import org.springframework.context.ApplicationEventPublisher; import org.springframework.http.MediaType; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.bind.annotation.*; import org.springframework.web.multipart.MultipartFile; /** @@ -80,13 +73,13 @@ public class Users { private ApplicationEventPublisher applicationEventPublisher; @RequestMapping(value = "/api/auth", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) - public String getAuthToken(@Visitor User visitor) { + public String getAuthToken(@ModelAttribute User visitor) { return userService.getHashByUID(visitor.getUid()); } @RequestMapping(value = "/api/users", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public List<User> doGetUsers( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(value = "uname", required = false) List<String> unames) { List<User> users = new ArrayList<>(); @@ -108,7 +101,7 @@ public class Users { } @GetMapping("/api/me") - public SecureUser getMe(@Visitor User visitor) { + public SecureUser getMe(@ModelAttribute User visitor) { SecureUser me = new SecureUser(); me.setUid(visitor.getUid()); me.setName(visitor.getName()); @@ -127,7 +120,7 @@ public class Users { return (SecureUser)userService.getUserInfo(me); } @PostMapping("/api/me") - public void updateMe(@Visitor User visitor, + public void updateMe(@ModelAttribute User visitor, @RequestParam(required = false) String password, @RequestParam(value = "jid-del", required = false) String jidForDeletion, @RequestParam(value = "email-add", required = false) String newEmail, @@ -171,12 +164,12 @@ public class Users { } } @PostMapping("/api/me/subscribe") - public void subscribeMe(@Visitor User visitor, String email) { + public void subscribeMe(@ModelAttribute User visitor, String email) { // TODO: check status emailService.setNotificationsEmail(visitor.getUid(), email); } @PostMapping("/api/me/upload") - public void updateInfo(@Visitor User visitor, + public void updateInfo(@ModelAttribute User visitor, @RequestParam MultipartFile avatar) throws IOException { String avatarTmpPath = HttpUtils.receiveMultiPartFile(avatar, storageService.getTemporaryDirectory()).getHost(); if (StringUtils.isNotEmpty(avatarTmpPath)) { @@ -187,7 +180,7 @@ public class Users { @RequestMapping(value = "/api/users/read", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public List<User> doGetUserRead( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam String uname) { int uid = 0; if (uname == null) { @@ -211,7 +204,7 @@ public class Users { @RequestMapping(value = "/api/users/readers", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE) public List<User> doGetUserReaders( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam String uname) { int uid = 0; if (uname == null) { @@ -234,7 +227,7 @@ public class Users { } @GetMapping("/api/info/{uname}") - public User getUserInfo(@Visitor User visitor, @PathVariable String uname) { + public User getUserInfo(@ModelAttribute User visitor, @PathVariable String uname) { User user = userService.getUserByName(uname); if (!user.isBanned()) { user.setRead(doGetUserRead(visitor, uname)); diff --git a/src/main/java/com/juick/www/api/activity/Profile.java b/src/main/java/com/juick/www/api/activity/Profile.java index 404e0734..7a3fdf29 100644 --- a/src/main/java/com/juick/www/api/activity/Profile.java +++ b/src/main/java/com/juick/www/api/activity/Profile.java @@ -48,7 +48,6 @@ import com.juick.service.activities.DirectMessageEvent; import com.juick.service.activities.FollowEvent; import com.juick.service.activities.UndoAnnounceEvent; import com.juick.service.activities.UndoFollowEvent; -import com.juick.service.security.annotation.Visitor; import com.overzealous.remark.Remark; import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.StringUtils; @@ -61,11 +60,7 @@ import org.springframework.core.convert.ConversionService; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.bind.annotation.*; import org.springframework.web.servlet.support.ServletUriComponentsBuilder; import org.springframework.web.util.UriComponentsBuilder; @@ -136,8 +131,8 @@ public class Profile { @GetMapping(value = "/u/{userName}/blog", produces = { Context.LD_JSON_MEDIA_TYPE, Context.ACTIVITYSTREAMS_PROFILE_MEDIA_TYPE }) - public OrderedCollectionPage getOutboxPage(@Visitor User visitor, @PathVariable String userName, - @RequestParam(required = false, defaultValue = "0") int before) { + public OrderedCollectionPage getOutboxPage(@ModelAttribute User visitor, @PathVariable String userName, + @RequestParam(required = false, defaultValue = "0") int before) { User user = userService.getUserByName(userName); if (!user.isAnonymous() && !user.isBanned()) { UriComponentsBuilder uri = UriComponentsBuilder.fromUriString(baseUri); @@ -273,7 +268,7 @@ public class Profile { @CacheEvict(cacheNames = "profiles", key = "{ #visitor.uri }") @PostMapping(value = "/api/inbox", consumes = { Context.LD_JSON_MEDIA_TYPE, Context.ACTIVITYSTREAMS_PROFILE_MEDIA_TYPE }) - public ResponseEntity<CommandResult> processInbox(@Visitor User visitor, InputStream inboxData) throws Exception { + public ResponseEntity<CommandResult> processInbox(@ModelAttribute User visitor, InputStream inboxData) throws Exception { String inbox = IOUtils.toString(inboxData, StandardCharsets.UTF_8); Activity activity = jsonMapper.readValue(inbox, Activity.class); if ((StringUtils.isNotEmpty(visitor.getUri().toString()) diff --git a/src/main/java/com/juick/www/controllers/Help.java b/src/main/java/com/juick/www/controllers/Help.java index ae1dafbe..ae7ba9d1 100644 --- a/src/main/java/com/juick/www/controllers/Help.java +++ b/src/main/java/com/juick/www/controllers/Help.java @@ -20,13 +20,13 @@ package com.juick.www.controllers; import com.juick.model.User; import com.juick.util.HttpNotFoundException; import com.juick.service.HelpService; -import com.juick.service.security.annotation.Visitor; import com.juick.www.WebApp; import org.commonmark.parser.Parser; import org.commonmark.renderer.html.HtmlRenderer; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.ModelAttribute; import org.springframework.web.bind.annotation.PathVariable; import javax.inject.Inject; @@ -49,7 +49,7 @@ public class Help { @GetMapping({"/help/", "/help", "/help/{langOrPage}", "/help/{lang}/{page}"}) public String showHelp( - @Visitor User visitor, + @ModelAttribute User visitor, Locale locale, @PathVariable(required = false, name = "lang") String lang, @PathVariable(required = false, name = "page") String page, diff --git a/src/main/java/com/juick/www/controllers/Settings.java b/src/main/java/com/juick/www/controllers/Settings.java index b990bf41..4d7deece 100644 --- a/src/main/java/com/juick/www/controllers/Settings.java +++ b/src/main/java/com/juick/www/controllers/Settings.java @@ -35,7 +35,6 @@ import com.juick.service.TagService; import com.juick.service.TelegramService; import com.juick.service.UserService; import com.juick.service.activities.UpdateUserEvent; -import com.juick.service.security.annotation.Visitor; import com.juick.util.HttpBadRequestException; import com.juick.util.HttpUtils; import com.juick.www.WebApp; @@ -58,6 +57,7 @@ import org.springframework.context.ApplicationEventPublisher; import org.springframework.stereotype.Controller; import org.springframework.ui.ModelMap; import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.ModelAttribute; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.multipart.MultipartFile; @@ -89,7 +89,7 @@ public class Settings { @GetMapping("/settings") protected String doGet( - @Visitor User visitor, + @ModelAttribute User visitor, Locale locale, @RequestParam(required = false, defaultValue = "main") String page, @RequestParam(required = false) String code, ModelMap model) throws IOException { @@ -126,7 +126,7 @@ public class Settings { @PostMapping("/settings") protected String doPost( - @Visitor User visitor, + @ModelAttribute User visitor, HttpServletRequest request, HttpServletResponse response, @RequestParam(required = false) MultipartFile avatar, ModelMap model) @@ -272,7 +272,7 @@ public class Settings { } @PostMapping("/settings/unsubscribe") public String unsubscribeOneClick( - @Visitor User user, + @ModelAttribute User user, @RequestParam(name = "List-Unsubscribe") String unsubscribe, ModelMap model) { if (!user.isAnonymous()) { diff --git a/src/main/java/com/juick/www/controllers/SignUp.java b/src/main/java/com/juick/www/controllers/SignUp.java index 9fc04dd5..8318dabd 100644 --- a/src/main/java/com/juick/www/controllers/SignUp.java +++ b/src/main/java/com/juick/www/controllers/SignUp.java @@ -23,13 +23,13 @@ import com.juick.util.UsernameTakenException; import com.juick.www.WebApp; import com.juick.service.EmailService; import com.juick.service.UserService; -import com.juick.service.security.annotation.Visitor; import com.juick.service.security.entities.JuickUser; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Controller; import org.springframework.ui.ModelMap; import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.ModelAttribute; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; @@ -52,7 +52,7 @@ public class SignUp { @GetMapping("/signup") protected String doGet( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam String type, @RequestParam String hash, ModelMap model) { if (hash.length() > 36 || !type.matches("^[a-zA-Z0-9\\-]+$") || !hash.matches("^[a-zA-Z0-9\\-]+$")) { @@ -91,7 +91,7 @@ public class SignUp { @PostMapping("/signup") protected String doPost( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam String type, @RequestParam String hash, @RequestParam String action, diff --git a/src/main/java/com/juick/www/controllers/Site.java b/src/main/java/com/juick/www/controllers/Site.java index f45fe8f2..e8acc650 100644 --- a/src/main/java/com/juick/www/controllers/Site.java +++ b/src/main/java/com/juick/www/controllers/Site.java @@ -30,7 +30,6 @@ import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpSession; import com.juick.service.*; -import com.juick.service.security.annotation.Visitor; import com.juick.util.MessageUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; @@ -43,12 +42,7 @@ import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.WebAttributes; import org.springframework.stereotype.Controller; import org.springframework.ui.ModelMap; -import org.springframework.web.bind.annotation.CookieValue; -import org.springframework.web.bind.annotation.ExceptionHandler; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.RequestHeader; -import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.*; import javax.inject.Inject; import java.net.URLEncoder; @@ -99,7 +93,7 @@ public class Site { } @GetMapping("/login") - public String getloginForm(@Visitor User visitor, + public String getloginForm(@ModelAttribute User visitor, @RequestParam(name = "retpath", required = false, defaultValue = "/") String retPath, HttpSession session, ModelMap model) { @@ -125,7 +119,7 @@ public class Site { } @GetMapping("/") - protected String doGet(@Visitor User visitor, Locale locale, @RequestParam(required = false) String tag, + protected String doGet(@ModelAttribute User visitor, Locale locale, @RequestParam(required = false) String tag, @RequestParam(name = "show", required = false) String paramShow, @RequestParam(name = "search", required = false) String paramSearch, @RequestParam(name = "before", required = false, defaultValue = "0") Integer paramBefore, @@ -217,7 +211,7 @@ public class Site { } @GetMapping(path = "/{uname}/", headers = "Connection!=Upgrade") - protected String doGetBlog(@Visitor User visitor, @RequestParam(required = false, name = "show") String paramShow, + protected String doGetBlog(@ModelAttribute User visitor, @RequestParam(required = false, name = "show") String paramShow, @RequestParam(required = false, name = "tag") String paramTagStr, @RequestParam(required = false, name = "search") String paramSearch, @RequestParam(required = false, name = "page", defaultValue = "0") Integer page, @PathVariable String uname, @@ -324,7 +318,7 @@ public class Site { } @GetMapping("/{uname}/tags") - protected String doGetTags(@Visitor User visitor, @PathVariable String uname, ModelMap model) { + protected String doGetTags(@ModelAttribute User visitor, @PathVariable String uname, ModelMap model) { User user = userService.getUserByName(uname); if (visitor.isBanned()) { throw new HttpNotFoundException(); @@ -344,7 +338,7 @@ public class Site { } @GetMapping("/{uname}/friends") - protected String doGetFriends(@Visitor User visitor, @PathVariable String uname, ModelMap model) { + protected String doGetFriends(@ModelAttribute User visitor, @PathVariable String uname, ModelMap model) { User user = userService.getUserByName(uname); if (visitor.isBanned()) { throw new HttpNotFoundException(); @@ -360,7 +354,7 @@ public class Site { } @GetMapping("/{uname}/readers") - protected String doGetReaders(@Visitor User visitor, @PathVariable String uname, ModelMap model) { + protected String doGetReaders(@ModelAttribute User visitor, @PathVariable String uname, ModelMap model) { User user = userService.getUserByName(uname); visitor.setAvatar(webApp.getAvatarWebPath(visitor)); model.addAttribute("title", "Читатели " + user.getName()); @@ -373,7 +367,7 @@ public class Site { } @GetMapping("/{uname}/bl") - protected String doGetBL(@Visitor User visitor, @PathVariable String uname, ModelMap model) { + protected String doGetBL(@ModelAttribute User visitor, @PathVariable String uname, ModelMap model) { User user = userService.getUserByName(uname); if (visitor.getUid() != user.getUid()) { throw new HttpForbiddenException(); @@ -389,7 +383,7 @@ public class Site { } @GetMapping("/tag/{tagName}") - protected String tagAction(@Visitor User visitor, HttpServletRequest request, @PathVariable String tagName, + protected String tagAction(@ModelAttribute User visitor, HttpServletRequest request, @PathVariable String tagName, @RequestParam(required = false, defaultValue = "0") int before, ModelMap model) { visitor.setAvatar(webApp.getAvatarWebPath(visitor)); String paramTagStr = StringEscapeUtils.unescapeHtml4(tagName); @@ -452,7 +446,7 @@ public class Site { } @GetMapping("/pm/inbox") - protected String doGetInbox(@Visitor User visitor, ModelMap model) { + protected String doGetInbox(@ModelAttribute User visitor, ModelMap model) { visitor.setAvatar(webApp.getAvatarWebPath(visitor)); String title = "PM: Inbox"; List<Message> msgs = chatService.getInbox(visitor.getUid()); @@ -466,7 +460,7 @@ public class Site { } @GetMapping("/pm/sent") - protected String doGetSent(@Visitor User visitor, @RequestParam(required = false) String uname, ModelMap model) { + protected String doGetSent(@ModelAttribute User visitor, @RequestParam(required = false) String uname, ModelMap model) { visitor.setAvatar(webApp.getAvatarWebPath(visitor)); String title = "PM: Sent"; List<Message> msgs = chatService.getOutbox(visitor.getUid()); @@ -485,7 +479,7 @@ public class Site { @GetMapping(value = "/{uname}/{mid}", produces = { MediaType.TEXT_HTML_VALUE, Context.ACTIVITY_MEDIA_TYPE, Context.LD_JSON_MEDIA_TYPE }) - protected String threadAction(@Visitor User visitor, ModelMap model, @PathVariable String uname, + protected String threadAction(@ModelAttribute User visitor, ModelMap model, @PathVariable String uname, @PathVariable int mid, @RequestHeader(name = HttpHeaders.ACCEPT, required = false) String acceptHeader, @CookieValue(name = "sape_cookie", required = false, defaultValue = StringUtils.EMPTY) String sapeCookie) { @@ -589,7 +583,7 @@ public class Site { } @GetMapping("/post") - protected String postAction(@Visitor User visitor, @RequestParam(required = false) String body, ModelMap model) { + protected String postAction(@ModelAttribute User visitor, @RequestParam(required = false) String body, ModelMap model) { fillUserModel(model, visitor, visitor); visitor.setAvatar(webApp.getAvatarWebPath(visitor)); model.addAttribute("title", "Написать"); diff --git a/src/main/java/com/juick/www/controllers/SocialLogin.java b/src/main/java/com/juick/www/controllers/SocialLogin.java index c9611543..24bf97f6 100644 --- a/src/main/java/com/juick/www/controllers/SocialLogin.java +++ b/src/main/java/com/juick/www/controllers/SocialLogin.java @@ -27,7 +27,6 @@ import com.juick.model.ext.vk.UsersResponse; import com.juick.service.EmailService; import com.juick.service.TelegramService; import com.juick.service.UserService; -import com.juick.service.security.annotation.Visitor; import com.juick.util.HttpBadRequestException; import jakarta.annotation.PostConstruct; @@ -46,11 +45,7 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.CookieValue; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.RequestHeader; -import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.*; import org.springframework.web.util.UriComponentsBuilder; import javax.inject.Inject; @@ -191,8 +186,8 @@ public class SocialLogin { } @GetMapping("/_twitter") - protected void doTwitterLogin(@Visitor com.juick.model.User user, HttpServletRequest request, - HttpServletResponse response) throws IOException, ExecutionException, InterruptedException { + protected void doTwitterLogin(@ModelAttribute com.juick.model.User user, HttpServletRequest request, + HttpServletResponse response) throws IOException, ExecutionException, InterruptedException { String hash = StringUtils.EMPTY, request_token = StringUtils.EMPTY, request_token_secret = StringUtils.EMPTY; String verifier = request.getParameter("oauth_verifier"); Cookie[] cookies = request.getCookies(); diff --git a/src/main/java/com/juick/www/rss/Feeds.java b/src/main/java/com/juick/www/rss/Feeds.java index 8111f2df..41b006a6 100644 --- a/src/main/java/com/juick/www/rss/Feeds.java +++ b/src/main/java/com/juick/www/rss/Feeds.java @@ -21,16 +21,12 @@ import com.juick.model.User; import com.juick.util.HttpNotFoundException; import com.juick.service.MessagesService; import com.juick.service.UserService; -import com.juick.service.security.annotation.Visitor; import org.springframework.core.convert.ConversionFailedException; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.ExceptionHandler; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.*; import org.springframework.web.servlet.ModelAndView; import javax.inject.Inject; @@ -53,7 +49,7 @@ public class Feeds { } @GetMapping("/rss/{userName}/{feedType}") - public ModelAndView getBlog(@Visitor User visitor, @PathVariable String userName, @PathVariable FeedType feedType) { + public ModelAndView getBlog(@ModelAttribute User visitor, @PathVariable String userName, @PathVariable FeedType feedType) { User user = userService.getUserByName(userName); if (!user.isAnonymous() && !user.isBanned()) { List<Integer> mids = feedType == FeedType.blog ? messagesService.getUserBlog(user.getUid(), 0, 0) : messagesService.getUserBlogWithRecommendations(user, visitor, 0, 0); @@ -69,7 +65,7 @@ public class Feeds { @GetMapping("/rss/") public ModelAndView getLast( - @Visitor User visitor, + @ModelAttribute User visitor, @RequestParam(value = "hours", required = false, defaultValue = "0") Integer hours) { List<Integer> mids = messagesService.getLastMessages(hours); ModelAndView modelAndView = new ModelAndView(); diff --git a/src/main/java/com/juick/www/rss/MessagesView.java b/src/main/java/com/juick/www/rss/MessagesView.java index 71d63754..d6edeb28 100644 --- a/src/main/java/com/juick/www/rss/MessagesView.java +++ b/src/main/java/com/juick/www/rss/MessagesView.java @@ -93,37 +93,39 @@ public class MessagesView extends AbstractRssFeedView { String feedType = (String) model.get("feedType"); if (userObj != null) { User user = (User) userObj; - feed.setDescription(String.format("The latest messages by @%s at Juick", user.getName())); - String title = String.format("%s - Juick", user.getName()); - feed.setTitle(title); - String link = String.format("https://juick.com/%s/", user.getName()); - feed.setLink(link); - try { - Attachment avatar = storageService.getAvatarMetadata(user); - Image rssImage = new Image(); - rssImage.setUrl(webApp.getAvatarUrl(user)); - rssImage.setTitle(title); - rssImage.setLink(link); - rssImage.setHeight(avatar.getHeight()); - rssImage.setWidth(avatar.getWidth()); - feed.setImage(rssImage); - } catch (IOException e) { - logger.warn("Feed avatar not found for {}", user.getName()); + if (!user.isAnonymous()) { + feed.setDescription(String.format("The latest messages by @%s at Juick", user.getName())); + String title = String.format("%s - Juick", user.getName()); + feed.setTitle(title); + String link = String.format("https://juick.com/%s/", user.getName()); + feed.setLink(link); + try { + Attachment avatar = storageService.getAvatarMetadata(user); + Image rssImage = new Image(); + rssImage.setUrl(webApp.getAvatarUrl(user)); + rssImage.setTitle(title); + rssImage.setLink(link); + rssImage.setHeight(avatar.getHeight()); + rssImage.setWidth(avatar.getWidth()); + feed.setImage(rssImage); + } catch (IOException e) { + logger.warn("Feed avatar not found for {}", user.getName()); + } + + String href = String.format("https://rss.juick.com/%s/%s", user.getName(), feedType); + AtomLinkModule atomLinkModule = new AtomLinkModuleImpl(); + Link atomLink = new Link(); + atomLink.setHref(href); + atomLink.setType("application/rss+xml"); + atomLink.setRel("self"); + atomLinkModule.setLinks(Collections.singletonList(atomLink)); + + feed.getModules().add(atomLinkModule); + } else { + feed.setDescription("The latest messages at Juick"); + feed.setLink("https://juick.com/"); + feed.setTitle("Juick"); } - - String href = String.format("https://rss.juick.com/%s/%s", user.getName(), feedType); - AtomLinkModule atomLinkModule = new AtomLinkModuleImpl(); - Link atomLink = new Link(); - atomLink.setHref(href); - atomLink.setType("application/rss+xml"); - atomLink.setRel("self"); - atomLinkModule.setLinks(Collections.singletonList(atomLink)); - - feed.getModules().add(atomLinkModule); - } else { - feed.setDescription("The latest messages at Juick"); - feed.setLink("https://juick.com/"); - feed.setTitle("Juick"); } MediaModule mediaModule = new MediaModuleImpl(); diff --git a/src/main/resources/db/migration/V1.29__oauth_clients.sql b/src/main/resources/db/migration/V1.29__oauth_clients.sql new file mode 100644 index 00000000..17bec0b3 --- /dev/null +++ b/src/main/resources/db/migration/V1.29__oauth_clients.sql @@ -0,0 +1,15 @@ +CREATE TABLE oauth2_registered_client ( + id varchar(100) NOT NULL, + client_id varchar(100) NOT NULL, + client_id_issued_at timestamp DEFAULT CURRENT_TIMESTAMP NOT NULL, + client_secret varchar(200) DEFAULT NULL, + client_secret_expires_at timestamp DEFAULT NULL, + client_name varchar(200) NOT NULL, + client_authentication_methods varchar(1000) NOT NULL, + authorization_grant_types varchar(1000) NOT NULL, + redirect_uris varchar(1000) DEFAULT NULL, + scopes varchar(1000) NOT NULL, + client_settings varchar(2000) NOT NULL, + token_settings varchar(2000) NOT NULL, + PRIMARY KEY (id) +);
\ No newline at end of file diff --git a/src/test/java/com/juick/server/tests/ServerTests.java b/src/test/java/com/juick/server/tests/ServerTests.java index 957da377..5eeeab3d 100644 --- a/src/test/java/com/juick/server/tests/ServerTests.java +++ b/src/test/java/com/juick/server/tests/ServerTests.java @@ -90,11 +90,13 @@ import org.springframework.core.io.Resource; import org.springframework.http.*; import org.springframework.http.client.ClientHttpRequestFactory; import org.springframework.jdbc.core.JdbcTemplate; +import org.springframework.mock.web.MockHttpSession; import org.springframework.mock.web.MockMultipartFile; import org.springframework.test.context.TestPropertySource; import org.springframework.test.web.client.MockRestServiceServer; import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MvcResult; +import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; import org.springframework.transaction.annotation.Transactional; import org.springframework.util.DigestUtils; @@ -2718,6 +2720,19 @@ public class ServerTests { } @Test + public void givenAccessSecuredResource_whenAuthenticated_thenRedirectedBack() throws Exception { + MockHttpServletRequestBuilder securedResourceAccess = get("/settings"); + MvcResult unauthenticatedResult = mockMvc.perform(securedResourceAccess).andExpect(status().is3xxRedirection()) + .andReturn(); + MockHttpSession session = (MockHttpSession) unauthenticatedResult.getRequest().getSession(); + String loginUrl = unauthenticatedResult.getResponse().getRedirectedUrl(); + mockMvc.perform(post(loginUrl).param("username", ugnichName).param("password", ugnichPassword) + .session(session).with(csrf())).andExpect(status().is3xxRedirection()) + .andExpect(redirectedUrlPattern("**/settings?continue")).andReturn(); + mockMvc.perform(securedResourceAccess.session(session)).andExpect(status().isOk()); + } +/* + @Test public void tokenAuth() throws Exception { var token = keystoreManager.generateToken(ugnich); mockMvc.perform(get("/api/me") @@ -2732,4 +2747,6 @@ public class ServerTests { .header("Authorization", "Bearer " + token)) .andExpect(status().isUnauthorized()); } + + */ } |