com.erigir.wrench.ape.service.TokenService Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of wrench-ape Show documentation
A library to simplify API construction atop Spring MVC
There is a newer version: 2.2.16+16
package com.erigir.wrench.ape.service;

import com.erigir.wrench.CrockfordBase32;
import com.erigir.wrench.QuietObjectMapper;
import com.erigir.wrench.ZipUtils;
import com.erigir.wrench.ape.exception.InvalidTokenException;
import com.erigir.wrench.ape.model.CustomerToken;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.SecretKeySpec;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.Objects;

/**
 * As of version 1.2.0, you may specify more than one key for the token service - it accepts a list
 * If you do so, any new tokens are encrypted with the first key, but the other keys are checked for
 * decrypting tokens.  This is to simplify the process of key rotation - just add a new key to the start
 * of the list and restart the server.  After the expiration time has passed any old keys can
 * be removed from the list as they will be invalid anyway.
 * Created by cweiss on 7/18/15.
 */
public class TokenService {
    private static final Logger LOG = LoggerFactory.getLogger(TokenService.class);
    private static final String CIPHER = "AES/ECB/PKCS5Padding";
    private List encryptionKeys;
    private QuietObjectMapper objectMapper;
    private CrockfordBase32 base32 = new CrockfordBase32();

    public String createToken(String keyValue, Long expires, Map otherData) {
        LOG.debug("Creating token {} / {} / {}", keyValue, expires, otherData);
        Objects.requireNonNull(keyValue);
        Objects.requireNonNull(expires);

        // We always encrypt with the first key
        String encryptionKey = encryptionKeys.get(0);
        CustomerToken token = new CustomerToken(keyValue, expires, otherData);
        String raw = objectMapper.writeValueAsString(token);
        byte[] compressed = ZipUtils.zipData(raw.getBytes());

        try {
            byte[] encrypted = cipher(Cipher.ENCRYPT_MODE, encryptionKey).doFinal(compressed);
            String rval = base32.encodeToString(encrypted);
            return rval;
        } catch (Exception e) {
            throw new IllegalStateException("Shouldnt happen, error on encode: (key size was " + encryptionKey.length() + " and msg size was " + raw.length() + ") " + e, e);
        }
    }

    public void validateToken(CustomerToken token)
            throws InvalidTokenException {
        if (token == null) {
            throw new InvalidTokenException("Supplied string was not a valid token");
        }
        if (token.getExpires() == null || System.currentTimeMillis() > token.getExpires()) {
            throw new InvalidTokenException("Token expired at " + token.getExpires() + " and it is " + System.currentTimeMillis());
        }
    }

    private Cipher cipher(int mode, String key) {
        try {
            SecretKeySpec keySpec = new SecretKeySpec(key.getBytes(), CIPHER.substring(0, 3));
            Cipher nCipher = Cipher.getInstance(CIPHER);
            //IvParameterSpec iv = new IvParameterSpec("0000000000000000".getBytes());
            nCipher.init(mode, keySpec);//,iv);
            return nCipher;
        } catch (InvalidKeyException | NoSuchAlgorithmException | NoSuchPaddingException e) {
            // Like these would be handled at runtime... right?
            throw new RuntimeException("Error creating cipher", e);
        }
    }

    public CustomerToken extractAndValidateToken(String tokenString)
            throws InvalidTokenException {
        CustomerToken token = extractToken(tokenString);
        validateToken(token);
        return token;
    }

    public CustomerToken extractToken(String tokenString) {
        CustomerToken rval = null;
        for (int i = 0; i < encryptionKeys.size() && rval == null; i++) {
            rval = innerExtractToken(tokenString, encryptionKeys.get(i));
        }
        return rval;
    }

    private CustomerToken innerExtractToken(String tokenString, String key) {
        try {
            byte[] zippedData;
            byte[] encryptedText = base32.decode(tokenString.getBytes());
            zippedData = cipher(Cipher.DECRYPT_MODE, key).doFinal(encryptedText);
            byte[] unzippedData = ZipUtils.unzipData(zippedData);
            CustomerToken output = objectMapper.readValue(unzippedData, CustomerToken.class);
            return output;
        } catch (Exception e) {
            LOG.trace("Unable to decrypt token with this key");
            return null;
        }
    }

    public void setEncryptionKeys(List encryptionKeys) {
        this.encryptionKeys = encryptionKeys;
    }

    /**
     * Here for backwards compatibility with previous versions
     *
     * @param encryptionKey A single key that tokenservice will decrypt with
     */
    public void setEncryptionKey(String encryptionKey) {
        this.encryptionKeys = (encryptionKey == null) ? null : Collections.singletonList(encryptionKey);
    }

    public void setObjectMapper(QuietObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

}