@@ -3,12 +3,14 @@ package io.openfuture.api.config.filter
3
3
import com.fasterxml.jackson.databind.ObjectMapper
4
4
import com.fasterxml.jackson.module.kotlin.jacksonObjectMapper
5
5
import io.openfuture.api.config.propety.AuthorizationProperties
6
- import org.springframework.http.HttpStatus.UNAUTHORIZED
7
6
import io.openfuture.api.domain.exception.ExceptionResponse
8
7
import io.openfuture.api.domain.key.WalletApiCreateRequest
9
8
import io.openfuture.api.domain.state.WalletApiStateRequest
9
+ import io.openfuture.api.entity.application.Application
10
10
import io.openfuture.api.service.ApplicationService
11
11
import io.openfuture.api.util.*
12
+ import org.springframework.http.HttpStatus.NOT_FOUND
13
+ import org.springframework.http.HttpStatus.UNAUTHORIZED
12
14
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
13
15
import org.springframework.security.core.authority.SimpleGrantedAuthority
14
16
import org.springframework.security.core.context.SecurityContextHolder
@@ -36,44 +38,54 @@ class PublicApiAuthorizationFilter(
36
38
val accessKey = request.getHeader(" X-API-KEY" )
37
39
val signature = request.getHeader(" X-API-SIGNATURE" )
38
40
39
- val application = applicationService.getByAccessKey(accessKey)
40
-
41
- if (request.method == " POST" ) {
42
-
43
- val requestWrapper = CustomHttpRequestWrapper (request)
44
- val walletApiCreateRequest =
45
- mapper.readValue(requestWrapper.bodyInStringFormat, WalletApiCreateRequest ::class .java)
46
- val mapper = jacksonObjectMapper()
47
- val str = mapper.writeValueAsString(walletApiCreateRequest)
48
-
49
- if (! checkHash(accessKey, signature, walletApiCreateRequest.timestamp.toLong(), str)) {
50
- val exceptionResponse =
51
- ExceptionResponse (UNAUTHORIZED .value(), " Signature mismatch or request timeout" )
52
- response.status = exceptionResponse.status
53
- response.writer.write(mapper.writeValueAsString(exceptionResponse))
41
+ try {
42
+ val application = applicationService.getByAccessKey(accessKey)
43
+
44
+ if (request.method == " POST" ) {
45
+
46
+ val requestWrapper = CustomHttpRequestWrapper (request)
47
+ val walletApiCreateRequest =
48
+ mapper.readValue(requestWrapper.bodyInStringFormat, WalletApiCreateRequest ::class .java)
49
+ val mapper = jacksonObjectMapper()
50
+ val str = mapper.writeValueAsString(walletApiCreateRequest)
51
+
52
+ if (! checkHash(application, signature, str, walletApiCreateRequest.timestamp.toLong())) {
53
+ println (" Signature mismatch or request timeout" )
54
+ val exceptionResponse =
55
+ ExceptionResponse (UNAUTHORIZED .value(), " Signature mismatch or request timeout" )
56
+ response.status = exceptionResponse.status
57
+ response.writer.write(mapper.writeValueAsString(exceptionResponse))
58
+ return
59
+ }
60
+
61
+ val token = UsernamePasswordAuthenticationToken (
62
+ application.user,
63
+ null ,
64
+ listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" ))
65
+ )
66
+ SecurityContextHolder .getContext().authentication = token
67
+
68
+ chain.doFilter(requestWrapper, response)
69
+ return
70
+ } else {
71
+ val token = UsernamePasswordAuthenticationToken (
72
+ application.user,
73
+ null ,
74
+ listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" ))
75
+ )
76
+ SecurityContextHolder .getContext().authentication = token
77
+
78
+ chain.doFilter(request, response)
54
79
return
55
80
}
56
81
57
- val token = UsernamePasswordAuthenticationToken (
58
- application.user,
59
- null ,
60
- listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" ))
61
- )
62
- SecurityContextHolder .getContext().authentication = token
63
-
64
- chain.doFilter(requestWrapper, response)
65
- return
82
+ } catch (exception: RuntimeException ) {
83
+ println (" Exception thrown" )
84
+ response.setContentType(" application/json" )
85
+ response.setStatus(NOT_FOUND .value())
66
86
}
67
- else {
68
- val token = UsernamePasswordAuthenticationToken (application.user, null , listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" )))
69
- SecurityContextHolder .getContext().authentication = token
70
87
71
- chain.doFilter(request, response)
72
- return
73
- }
74
- }
75
-
76
- else if (request.requestURI.startsWith(" /public" ) && request.getHeader(" OPEN-API-KEY" ) != null ) {
88
+ } /* else if (request.requestURI.startsWith("/public") && request.getHeader("OPEN-API-KEY") != null) {
77
89
78
90
val accessKey = request.getHeader("OPEN-API-KEY")
79
91
val signature = request.getHeader("OPEN-API-SIGNATURE")
@@ -86,19 +98,23 @@ class PublicApiAuthorizationFilter(
86
98
87
99
val application = applicationService.getByAccessKey(accessKey)
88
100
89
- if (! checkHash(accessKey , signature, walletApiStateRequest.timestamp.toLong(), str )) {
101
+ if (!checkHash(application , signature, str, walletApiStateRequest.timestamp.toLong())) {
90
102
val exceptionResponse = ExceptionResponse(UNAUTHORIZED.value(), "Signature mismatch or request timeout")
91
103
response.status = exceptionResponse.status
92
104
response.writer.write(mapper.writeValueAsString(exceptionResponse))
93
105
return
94
106
}
95
107
96
- val token = UsernamePasswordAuthenticationToken (application.user, null , listOf (SimpleGrantedAuthority (" ROLE_APPLICATION" )))
108
+ val token = UsernamePasswordAuthenticationToken(
109
+ application.user,
110
+ null,
111
+ listOf(SimpleGrantedAuthority("ROLE_APPLICATION"))
112
+ )
97
113
SecurityContextHolder.getContext().authentication = token
98
114
99
115
chain.doFilter(requestWrapper, response)
100
116
return
101
- }
117
+ }*/
102
118
103
119
chain.doFilter(request, response)
104
120
}
@@ -107,16 +123,18 @@ class PublicApiAuthorizationFilter(
107
123
// Do nothing
108
124
}
109
125
110
- private fun checkHash (accessKey : String , signature : String , timestamp : Long , str : String ): Boolean {
126
+ private fun checkHash (application : Application , signature : String , str : String , timestamp : Long ): Boolean {
127
+
111
128
val diffMinutes = differenceEpochs(currentEpochs(), timestamp)
112
129
val expirePeriod = properties.expireApi!!
113
130
114
- val application = applicationService.getByAccessKey(accessKey)
115
-
116
131
val hmacSha256 = application.let {
117
132
KeyGeneratorUtils .calcHmacSha256(it.apiSecretKey, str)
118
133
}
119
-
134
+ println (hmacSha256)
135
+ println (signature)
136
+ println (" HASH ${hmacSha256 != signature} " )
137
+ println (" PERIOD ${diffMinutes > expirePeriod} " )
120
138
if (hmacSha256 != signature || diffMinutes > expirePeriod) {
121
139
return false
122
140
}
0 commit comments