diff --git a/README.md b/README.md index 40bafcb..73e4bfd 100644 --- a/README.md +++ b/README.md @@ -31,11 +31,11 @@ Create that file once on the server with the production values required by the app. The Gitea deploy step verifies that it exists, but it does not create or overwrite it. -Protected API routes require the shared API key from `ORG_BACKEND_API_KEY`. -Clients send it as: +Use `/api/auth/register` to create users and `/api/auth/login` to receive a JWT. +Protected API routes send that token as: ```text -X-Org-Api-Key: +Authorization: Bearer ``` The live systemd unit at `/etc/systemd/system/org-backend.service` is managed diff --git a/src/main/java/org/zaine/app/controller/AuthController.java b/src/main/java/org/zaine/app/controller/AuthController.java index f110a9c..e4e0f52 100644 --- a/src/main/java/org/zaine/app/controller/AuthController.java +++ b/src/main/java/org/zaine/app/controller/AuthController.java @@ -4,7 +4,6 @@ package org.zaine.app.controller; import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; import org.zaine.app.security.JwtUtil; -import org.zaine.app.security.RequiresAuth; import org.zaine.app.user.User; import org.zaine.app.user.UserRepository; import org.springframework.http.*; @@ -17,7 +16,6 @@ import java.util.Map; @RestController @RequestMapping("/api/auth") -@RequiresAuth @Tag(name = "Authentication") public class AuthController { diff --git a/src/main/java/org/zaine/app/controller/CommentsController.java b/src/main/java/org/zaine/app/controller/CommentsController.java index 7843f07..92dbb3b 100644 --- a/src/main/java/org/zaine/app/controller/CommentsController.java +++ b/src/main/java/org/zaine/app/controller/CommentsController.java @@ -22,6 +22,7 @@ import io.swagger.v3.oas.annotations.tags.Tag; @RestController @RequestMapping("/api/comments") +@RequiresAuth @Tag(name = "Comments", description = "Endpoints for managing comments") public class CommentsController { @@ -86,7 +87,6 @@ public class CommentsController { value = "", consumes = "application/json" ) - @RequiresAuth public void addComment(@RequestBody CreateCommentDTO dto) { if (dto.getContent() == null || dto.getContent().trim().isEmpty()) { diff --git a/src/main/java/org/zaine/app/security/ApiKeyAuthService.java b/src/main/java/org/zaine/app/security/ApiKeyAuthService.java deleted file mode 100644 index 3a4eed6..0000000 --- a/src/main/java/org/zaine/app/security/ApiKeyAuthService.java +++ /dev/null @@ -1,31 +0,0 @@ -package org.zaine.app.security; - -import java.nio.charset.StandardCharsets; -import java.security.MessageDigest; - -import org.springframework.beans.factory.annotation.Value; -import org.springframework.stereotype.Component; - -@Component -public class ApiKeyAuthService { - - private final String apiKey; - - public ApiKeyAuthService(@Value("${org.auth.api-key:}") String apiKey) { - this.apiKey = apiKey == null ? "" : apiKey.trim(); - } - - public boolean isConfigured() { - return !apiKey.isBlank(); - } - - public boolean isValid(String candidate) { - if (!isConfigured() || candidate == null || candidate.isBlank()) { - return false; - } - - byte[] expected = apiKey.getBytes(StandardCharsets.UTF_8); - byte[] provided = candidate.trim().getBytes(StandardCharsets.UTF_8); - return MessageDigest.isEqual(expected, provided); - } -} diff --git a/src/main/java/org/zaine/app/security/JwtAuthFilter.java b/src/main/java/org/zaine/app/security/JwtAuthFilter.java index 2c3f572..37d189d 100644 --- a/src/main/java/org/zaine/app/security/JwtAuthFilter.java +++ b/src/main/java/org/zaine/app/security/JwtAuthFilter.java @@ -19,14 +19,11 @@ import java.util.List; @Component public class JwtAuthFilter extends OncePerRequestFilter { - public static final String API_KEY_HEADER = "X-Org-Api-Key"; - - private final ApiKeyAuthService apiKeyAuthService; + private final JwtUtil jwtUtil; private final RequestMappingHandlerMapping requestMappingHandlerMapping; - public JwtAuthFilter(ApiKeyAuthService apiKeyAuthService, - RequestMappingHandlerMapping requestMappingHandlerMapping) { - this.apiKeyAuthService = apiKeyAuthService; + public JwtAuthFilter(JwtUtil jwtUtil, RequestMappingHandlerMapping requestMappingHandlerMapping) { + this.jwtUtil = jwtUtil; this.requestMappingHandlerMapping = requestMappingHandlerMapping; } @@ -39,17 +36,26 @@ public class JwtAuthFilter extends OncePerRequestFilter { return; } - String apiKey = request.getHeader(API_KEY_HEADER); - if (apiKeyAuthService.isValid(apiKey)) { - var auth = new UsernamePasswordAuthenticationToken("api-key", null, List.of()); - auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); - SecurityContextHolder.getContext().setAuthentication(auth); - filterChain.doFilter(request, response); + String authHeader = request.getHeader("Authorization"); + + if (authHeader == null || !authHeader.startsWith("Bearer ")) { + response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Missing or invalid Authorization header"); return; } - response.sendError(HttpServletResponse.SC_UNAUTHORIZED, - "Missing or invalid " + API_KEY_HEADER + " header"); + String token = authHeader.substring(7); + + if (!jwtUtil.isTokenValid(token)) { + response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid or expired token"); + return; + } + + String username = jwtUtil.extractUsername(token); + var auth = new UsernamePasswordAuthenticationToken(username, null, List.of()); + auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); + SecurityContextHolder.getContext().setAuthentication(auth); + + filterChain.doFilter(request, response); } private boolean endpointRequiresAuth(HttpServletRequest request) { diff --git a/src/test/java/org/zaine/app/security/ApiKeyAuthServiceTest.java b/src/test/java/org/zaine/app/security/ApiKeyAuthServiceTest.java deleted file mode 100644 index 27d1022..0000000 --- a/src/test/java/org/zaine/app/security/ApiKeyAuthServiceTest.java +++ /dev/null @@ -1,27 +0,0 @@ -package org.zaine.app.security; - -import static org.junit.jupiter.api.Assertions.assertFalse; -import static org.junit.jupiter.api.Assertions.assertTrue; - -import org.junit.jupiter.api.Test; - -class ApiKeyAuthServiceTest { - - @Test - void rejectsAllKeysWhenNoApiKeyIsConfigured() { - ApiKeyAuthService service = new ApiKeyAuthService(""); - - assertFalse(service.isConfigured()); - assertFalse(service.isValid("anything")); - } - - @Test - void acceptsOnlyConfiguredApiKey() { - ApiKeyAuthService service = new ApiKeyAuthService("secret-key"); - - assertTrue(service.isConfigured()); - assertTrue(service.isValid("secret-key")); - assertFalse(service.isValid("wrong-key")); - assertFalse(service.isValid(null)); - } -} diff --git a/src/test/java/org/zaine/app/security/JwtAuthFilterTest.java b/src/test/java/org/zaine/app/security/JwtAuthFilterTest.java index 1eeccc6..86fb05e 100644 --- a/src/test/java/org/zaine/app/security/JwtAuthFilterTest.java +++ b/src/test/java/org/zaine/app/security/JwtAuthFilterTest.java @@ -6,6 +6,7 @@ import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletResponse; +import org.springframework.test.util.ReflectionTestUtils; import org.springframework.web.method.HandlerMethod; import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping; @@ -23,11 +24,14 @@ class JwtAuthFilterTest { @BeforeEach void setUp() { handlerMapping = new TestHandlerMapping(); - filter = new JwtAuthFilter(new ApiKeyAuthService("secret-key"), handlerMapping); + JwtUtil jwtUtil = new JwtUtil(); + ReflectionTestUtils.setField(jwtUtil, "secret", "test-secret-key-that-is-at-least-32-characters"); + ReflectionTestUtils.setField(jwtUtil, "expirationMs", 86_400_000L); + filter = new JwtAuthFilter(jwtUtil, handlerMapping); } @Test - void rejectsProtectedEndpointWithoutApiKey() throws Exception { + void rejectsProtectedEndpointWithoutBearerToken() throws Exception { MockHttpServletRequest request = new MockHttpServletRequest("GET", "/secure"); MockHttpServletResponse response = new MockHttpServletResponse(); AtomicBoolean chainCalled = new AtomicBoolean(false); @@ -40,9 +44,12 @@ class JwtAuthFilterTest { } @Test - void allowsProtectedEndpointWithValidApiKey() throws Exception { + void allowsProtectedEndpointWithValidBearerToken() throws Exception { MockHttpServletRequest request = new MockHttpServletRequest("GET", "/secure"); - request.addHeader(JwtAuthFilter.API_KEY_HEADER, "secret-key"); + JwtUtil jwtUtil = new JwtUtil(); + ReflectionTestUtils.setField(jwtUtil, "secret", "test-secret-key-that-is-at-least-32-characters"); + ReflectionTestUtils.setField(jwtUtil, "expirationMs", 86_400_000L); + request.addHeader("Authorization", "Bearer " + jwtUtil.generateToken("zaine")); MockHttpServletResponse response = new MockHttpServletResponse(); AtomicBoolean chainCalled = new AtomicBoolean(false); handlerMapping.setHandler(handlerFor("secure")); @@ -54,7 +61,7 @@ class JwtAuthFilterTest { } @Test - void allowsPublicEndpointWithoutApiKey() throws Exception { + void allowsPublicEndpointWithoutBearerToken() throws Exception { MockHttpServletRequest request = new MockHttpServletRequest("GET", "/public"); MockHttpServletResponse response = new MockHttpServletResponse(); AtomicBoolean chainCalled = new AtomicBoolean(false);