nullability and sealing (#840)

* nullability and sealing * nullability and sealing * nullability and sealing * nullability and sealing
navikt · Jan 22, 2024 · e20f7d1 · e20f7d1
1 parent 093a28e
commit e20f7d1
Show file tree

Hide file tree

Showing 15 changed files with 69 additions and 57 deletions.
diff --git a/token-client-core/pom.xml b/token-client-core/pom.xml
@@ -33,7 +33,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <scope>test</scope>
+            <version>2.16.1</version>
         </dependency>
         <dependency>
             <groupId>ch.qos.logback</groupId>
@@ -44,7 +44,6 @@
             <groupId>com.fasterxml.jackson.module</groupId>
             <artifactId>jackson-module-kotlin</artifactId>
             <version>2.16.1</version>
-            <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.jetbrains.kotlin</groupId>

diff --git a/...client-core/src/main/kotlin/no/nav/security/token/support/client/core/ClientProperties.kt b/...client-core/src/main/kotlin/no/nav/security/token/support/client/core/ClientProperties.kt
@@ -7,6 +7,7 @@ import com.nimbusds.oauth2.sdk.GrantType.JWT_BEARER
 import com.nimbusds.oauth2.sdk.GrantType.TOKEN_EXCHANGE
 import com.nimbusds.oauth2.sdk.ParseException
 import com.nimbusds.oauth2.sdk.`as`.AuthorizationServerMetadata
+import com.nimbusds.oauth2.sdk.`as`.AuthorizationServerMetadata.*
 import java.io.IOException
 import java.net.URI
 
@@ -41,7 +42,7 @@ class ClientProperties @JvmOverloads constructor(var tokenEndpointUrl: URI? = nu
 
         private fun endpointUrlFromMetadata(wellKnown: URI?) =
             runCatching {
-                wellKnown?.let { AuthorizationServerMetadata.parse(DefaultResourceRetriever().retrieveResource(wellKnown.toURL()).content).tokenEndpointURI }
+                wellKnown?.let { parse(DefaultResourceRetriever().retrieveResource(wellKnown.toURL()).content).tokenEndpointURI }
                     ?: throw OAuth2ClientException("Well-known url cannot be null, please check your configuration")
             }.getOrElse {
                 when(it) {
@@ -73,8 +74,9 @@ class ClientProperties @JvmOverloads constructor(var tokenEndpointUrl: URI? = nu
     }
 
 
-    class TokenExchangeProperties @JvmOverloads constructor(val audience: String, var resource: String? = null) {
-
-        fun subjectTokenType() = "urn:ietf:params:oauth:token-type:jwt"
+    data class TokenExchangeProperties @JvmOverloads constructor(val audience: String, var resource: String? = null) {
+        companion object {
+            const val SUBJECT_TOKEN_TYPE_VALUE = "urn:ietf:params:oauth:token-type:jwt"
+        }
     }
 }
diff --git a/...ient-core/src/main/kotlin/no/nav/security/token/support/client/core/OAuth2CacheFactory.kt b/...ient-core/src/main/kotlin/no/nav/security/token/support/client/core/OAuth2CacheFactory.kt
@@ -18,7 +18,7 @@ object OAuth2CacheFactory {
     private fun <T> evictOnResponseExpiresIn(skewInSeconds : Long) : Expiry<T, OAuth2AccessTokenResponse> {
         return object : Expiry<T, OAuth2AccessTokenResponse> {
             override fun expireAfterCreate(key : T, response : OAuth2AccessTokenResponse, currentTime : Long) =
-                SECONDS.toNanos(if (response.expiresIn!! > skewInSeconds) response.expiresIn!! - skewInSeconds else response.expiresIn!!.toLong())
+                SECONDS.toNanos(if (response.expiresIn!! > skewInSeconds) response.expiresIn - skewInSeconds else response.expiresIn.toLong())
             override fun expireAfterUpdate(key : T, response : OAuth2AccessTokenResponse, currentTime : Long, currentDuration : Long) = currentDuration
             override fun expireAfterRead(key : T, response : OAuth2AccessTokenResponse, currentTime : Long, currentDuration : Long) = currentDuration
         }

diff --git a/...lient/core/http/SimpleOAuth2HttpClient.kt → ...lient/core/http/SimpleOAuth2HttpClient.kt b/...lient/core/http/SimpleOAuth2HttpClient.kt → ...lient/core/http/SimpleOAuth2HttpClient.kt
@@ -22,10 +22,10 @@ class SimpleOAuth2HttpClient : OAuth2HttpClient {
             .sendRequest()
             .processResponse()
 
-    private fun HttpRequest.Builder.configureRequest(request: OAuth2HttpRequest): HttpRequest.Builder {
-        request.oAuth2HttpHeaders.headers.forEach { (key, values) -> values.forEach { header(key, it) } }
-        uri(request.tokenEndpointUrl)
-        POST(BodyPublishers.ofString(request.formParameters.toUrlEncodedString()))
+    private fun HttpRequest.Builder.configureRequest(req: OAuth2HttpRequest): HttpRequest.Builder {
+        req.oAuth2HttpHeaders.headers.forEach { (key, values) -> values.forEach { header(key, it) } }
+        uri(req.tokenEndpointUrl)
+        POST(BodyPublishers.ofString(req.formParameters.toUrlEncodedString()))
         return this
     }
 

diff --git a/...ain/kotlin/no/nav/security/token/support/client/core/oauth2/AbstractOAuth2GrantRequest.kt b/...ain/kotlin/no/nav/security/token/support/client/core/oauth2/AbstractOAuth2GrantRequest.kt
@@ -13,6 +13,8 @@ abstract class AbstractOAuth2GrantRequest(val grantType : GrantType, val clientP
         return grantType == that.grantType && clientProperties == that.clientProperties
     }
 
+    fun scopes() = clientProperties.scope.joinToString(" ")
+
     override fun hashCode() = Objects.hash(grantType, clientProperties)
     override fun toString() = "${javaClass.getSimpleName()} [oAuth2GrantType=$grantType, clientProperties=$clientProperties]"
 }
diff --git a/...main/kotlin/no/nav/security/token/support/client/core/oauth2/AbstractOAuth2TokenClient.kt b/...main/kotlin/no/nav/security/token/support/client/core/oauth2/AbstractOAuth2TokenClient.kt
@@ -23,7 +23,7 @@ import no.nav.security.token.support.client.core.http.OAuth2HttpClient
 import no.nav.security.token.support.client.core.http.OAuth2HttpHeaders
 import no.nav.security.token.support.client.core.http.OAuth2HttpRequest
 
-abstract class AbstractOAuth2TokenClient<T : AbstractOAuth2GrantRequest> internal constructor(private val oAuth2HttpClient : OAuth2HttpClient) {
+sealed class AbstractOAuth2TokenClient<T : AbstractOAuth2GrantRequest>(private val oAuth2HttpClient : OAuth2HttpClient) {
 
     protected abstract fun formParameters(grantRequest : T) : Map<String, String>
 
@@ -57,11 +57,11 @@ abstract class AbstractOAuth2TokenClient<T : AbstractOAuth2GrantRequest> interna
         }
 
     private fun defaultFormParameters(grantRequest : T) : MutableMap<String, String> =
-        with(grantRequest.clientProperties) {
-            defaultClientAuthenticationFormParameters(grantRequest).apply {
-                put(GRANT_TYPE,grantRequest.grantType.value)
+        with(grantRequest) {
+            defaultClientAuthenticationFormParameters(this).apply {
+                put(GRANT_TYPE,grantType.value)
                 if (TOKEN_EXCHANGE != grantType) {
-                    put(SCOPE,  join(" ", scope))
+                    put(SCOPE,  scopes())
                 }
             }
         }
@@ -92,6 +92,7 @@ abstract class AbstractOAuth2TokenClient<T : AbstractOAuth2GrantRequest> interna
             }
         }
 
+
     override fun toString() = "${javaClass.getSimpleName()} [oAuth2HttpClient=$oAuth2HttpClient]"
 
 }
diff --git a/...n/kotlin/no/nav/security/token/support/client/core/oauth2/ClientCredentialsTokenClient.kt b/...n/kotlin/no/nav/security/token/support/client/core/oauth2/ClientCredentialsTokenClient.kt
@@ -6,6 +6,6 @@ import no.nav.security.token.support.client.core.http.OAuth2HttpClient
 class ClientCredentialsTokenClient(oAuth2HttpClient : OAuth2HttpClient) : AbstractOAuth2TokenClient<ClientCredentialsGrantRequest>(oAuth2HttpClient) {
 
     override fun formParameters(grantRequest : ClientCredentialsGrantRequest) = LinkedHashMap<String, String>().apply {
-        put(SCOPE, grantRequest.clientProperties.scope.joinToString(" "))
+        put(SCOPE, grantRequest.scopes())
     }
 }
diff --git a/...main/kotlin/no/nav/security/token/support/client/core/oauth2/OAuth2AccessTokenResponse.kt b/...main/kotlin/no/nav/security/token/support/client/core/oauth2/OAuth2AccessTokenResponse.kt
@@ -1,7 +1,7 @@
 package no.nav.security.token.support.client.core.oauth2
 
  data class OAuth2AccessTokenResponse (var access_token : String? = null,  var expires_at : Int? = null,  var expires_in : Int? = 60, private val additionalParameters : Map<String, Any> = emptyMap()) {
-     val accessToken get()  = access_token
-     val expiresAt get() = expires_at
-     val expiresIn get()  = expires_in
+     val accessToken   = access_token
+     val expiresAt  = expires_at
+     val expiresIn   = expires_in
 }
diff --git a/.../main/kotlin/no/nav/security/token/support/client/core/oauth2/OAuth2AccessTokenService.kt b/.../main/kotlin/no/nav/security/token/support/client/core/oauth2/OAuth2AccessTokenService.kt
@@ -20,13 +20,14 @@ class OAuth2AccessTokenService @JvmOverloads constructor(private val tokenResolv
 
 
 
-    fun getAccessToken(clientProperties : ClientProperties) : OAuth2AccessTokenResponse? {
-        log.trace("Getting access_token for grant={}", clientProperties.grantType)
-        return when (clientProperties.grantType) {
-            JWT_BEARER -> executeOnBehalfOf(clientProperties)
-            CLIENT_CREDENTIALS -> executeClientCredentials(clientProperties)
-            TOKEN_EXCHANGE -> executeTokenExchange(clientProperties)
-            else -> throw OAuth2ClientException("Invalid grant-type ${clientProperties.grantType.value} from OAuth2ClientConfig.OAuth2Client. grant-type not in supported grant-types ($SUPPORTED_GRANT_TYPES)")
+    fun getAccessToken(p : ClientProperties) : OAuth2AccessTokenResponse {
+        return when (p.grantType) {
+            JWT_BEARER -> executeOnBehalfOf(p)
+            CLIENT_CREDENTIALS -> executeClientCredentials(p)
+            TOKEN_EXCHANGE -> executeTokenExchange(p)
+            else -> throw OAuth2ClientException("Invalid grant-type ${p.grantType.value} from OAuth2ClientConfig.OAuth2Client. grant-type not in supported grant-types ($SUPPORTED_GRANT_TYPES)")
+        }.also {
+            log.debug("Got access_token for grant={}", p.grantType)
         }
     }
 
@@ -51,7 +52,7 @@ class OAuth2AccessTokenService @JvmOverloads constructor(private val tokenResolv
         private val SUPPORTED_GRANT_TYPES = listOf(JWT_BEARER, CLIENT_CREDENTIALS, TOKEN_EXCHANGE
                                                          )
         private val log = LoggerFactory.getLogger(OAuth2AccessTokenService::class.java)
-        private fun <T : AbstractOAuth2GrantRequest?> getFromCacheIfEnabled(grantRequest : T, cache : Cache<T, OAuth2AccessTokenResponse>?, client : Function<T, OAuth2AccessTokenResponse?>) =
+        private fun <T : AbstractOAuth2GrantRequest?> getFromCacheIfEnabled(grantRequest : T, cache : Cache<T, OAuth2AccessTokenResponse>?, client : Function<T, OAuth2AccessTokenResponse>) =
             cache?.let {
                 log.debug("Cache is enabled so attempt to get from cache or update cache if not present.")
                 cache[grantRequest, client]

diff --git a/...src/main/kotlin/no/nav/security/token/support/client/core/oauth2/OnBehalfOfTokenClient.kt b/...src/main/kotlin/no/nav/security/token/support/client/core/oauth2/OnBehalfOfTokenClient.kt
@@ -11,7 +11,7 @@ class OnBehalfOfTokenClient(oAuth2HttpClient : OAuth2HttpClient) : AbstractOAuth
         LinkedHashMap<String, String>().apply {
             put(ASSERTION, grantRequest.assertion)
             put(REQUESTED_TOKEN_USE,REQUESTED_TOKEN_USE_VALUE)
-            put(SCOPE, grantRequest.clientProperties.scope.joinToString(" "))
+            put(SCOPE, grantRequest.scopes())
 
         }
 

diff --git a/...e/src/main/kotlin/no/nav/security/token/support/client/core/oauth2/TokenExchangeClient.kt b/...e/src/main/kotlin/no/nav/security/token/support/client/core/oauth2/TokenExchangeClient.kt
@@ -1,20 +1,27 @@
 package no.nav.security.token.support.client.core.oauth2
 
+import com.nimbusds.oauth2.sdk.GrantType
+import no.nav.security.token.support.client.core.ClientProperties.TokenExchangeProperties.Companion.SUBJECT_TOKEN_TYPE_VALUE
+import no.nav.security.token.support.client.core.OAuth2ClientException
+import no.nav.security.token.support.client.core.OAuth2ParameterNames
 import no.nav.security.token.support.client.core.OAuth2ParameterNames.AUDIENCE
 import no.nav.security.token.support.client.core.OAuth2ParameterNames.RESOURCE
+import no.nav.security.token.support.client.core.OAuth2ParameterNames.SCOPE
 import no.nav.security.token.support.client.core.OAuth2ParameterNames.SUBJECT_TOKEN
 import no.nav.security.token.support.client.core.OAuth2ParameterNames.SUBJECT_TOKEN_TYPE
 import no.nav.security.token.support.client.core.http.OAuth2HttpClient
 
 class TokenExchangeClient(oAuth2HttpClient : OAuth2HttpClient) : AbstractOAuth2TokenClient<TokenExchangeGrantRequest>(oAuth2HttpClient) {
 
     override fun formParameters(grantRequest : TokenExchangeGrantRequest) =
-        LinkedHashMap<String, String>().apply {
-            grantRequest.clientProperties.tokenExchange.run {
-                put(SUBJECT_TOKEN_TYPE, this!!.subjectTokenType())
-                put(SUBJECT_TOKEN,grantRequest.subjectToken)
-                put(AUDIENCE, audience)
-                resource?.takeIf { it.isNotEmpty() }?.let { put(RESOURCE, it) }
+        with(grantRequest)  {
+            HashMap<String, String>().apply {
+                clientProperties.tokenExchange?.run {
+                    put(SUBJECT_TOKEN_TYPE, SUBJECT_TOKEN_TYPE_VALUE)
+                    put(SUBJECT_TOKEN,subjectToken)
+                    put(AUDIENCE, audience)
+                    resource?.takeIf { it.isNotEmpty() }?.let { put(RESOURCE, it) }
+                }
             }
         }
 }
diff --git a/...t/kotlin/no/nav/security/token/support/client/core/oauth2/OAuth2AccessTokenServiceTest.kt b/...t/kotlin/no/nav/security/token/support/client/core/oauth2/OAuth2AccessTokenServiceTest.kt
@@ -65,7 +65,7 @@ internal class OAuth2AccessTokenServiceTest {
             val res = oAuth2AccessTokenService.getAccessToken(onBehalfOfProperties())
             verify(onBehalfOfTokenResponseClient).getTokenResponse(reifiedAny( OnBehalfOfGrantRequest::class.java))
             assertThat(res).hasNoNullFieldsOrProperties()
-            assertThat(res!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res.accessToken).isEqualTo("first_access_token")
         }
 
     @Test
@@ -76,7 +76,7 @@ internal class OAuth2AccessTokenServiceTest {
             val res = oAuth2AccessTokenService.getAccessToken(clientCredentialsProperties())
             verify(clientCredentialsTokenResponseClient).getTokenResponse(reifiedAny(ClientCredentialsGrantRequest::class.java))
             assertThat(res).hasNoNullFieldsOrProperties()
-            assertThat(res!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res.accessToken).isEqualTo("first_access_token")
         }
 
     @Test
@@ -98,13 +98,13 @@ internal class OAuth2AccessTokenServiceTest {
             val res = oAuth2AccessTokenService.getAccessToken(clientProperties)
             verify(onBehalfOfTokenResponseClient).getTokenResponse(reifiedAny(OnBehalfOfGrantRequest::class.java))
             assertThat(res).hasNoNullFieldsOrProperties()
-            assertThat(res!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res.accessToken).isEqualTo("first_access_token")
 
             //should get response from cache and NOT invoke client
             reset(onBehalfOfTokenResponseClient)
             val res2 = oAuth2AccessTokenService.getAccessToken(clientProperties)
             verify(onBehalfOfTokenResponseClient, never()).getTokenResponse(reifiedAny(OnBehalfOfGrantRequest::class.java))
-            assertThat(res2!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res2.accessToken).isEqualTo("first_access_token")
 
             //another user/token but same clientconfig, should invoke client and populate cache
             reset(assertionResolver)
@@ -115,7 +115,7 @@ internal class OAuth2AccessTokenServiceTest {
                 .thenReturn(accessTokenResponse(secondAccessToken, 60))
             val res3 = oAuth2AccessTokenService.getAccessToken(clientProperties)
             verify(onBehalfOfTokenResponseClient).getTokenResponse(reifiedAny(OnBehalfOfGrantRequest::class.java))
-            assertThat(res3!!.accessToken).isEqualTo(secondAccessToken)
+            assertThat(res3.accessToken).isEqualTo(secondAccessToken)
         }
 
     @Test
@@ -130,14 +130,14 @@ internal class OAuth2AccessTokenServiceTest {
             val res1 = oAuth2AccessTokenService.getAccessToken(clientProperties)
             verify(clientCredentialsTokenResponseClient).getTokenResponse(reifiedAny(ClientCredentialsGrantRequest::class.java))
             assertThat(res1).hasNoNullFieldsOrProperties()
-            assertThat(res1!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res1.accessToken).isEqualTo("first_access_token")
 
             //should get response from cache and NOT invoke client
             reset(clientCredentialsTokenResponseClient)
             val res2 = oAuth2AccessTokenService.getAccessToken(clientProperties)
             verify(clientCredentialsTokenResponseClient, never()).getTokenResponse(reifiedAny(
                 ClientCredentialsGrantRequest::class.java))
-            assertThat(res2!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res2.accessToken).isEqualTo("first_access_token")
 
             //another clientconfig, should invoke client and populate cache
             clientProperties = clientCredentialsProperties("scope3")
@@ -147,7 +147,7 @@ internal class OAuth2AccessTokenServiceTest {
                 .thenReturn(accessTokenResponse(secondAccessToken, 60))
             val res3 = oAuth2AccessTokenService.getAccessToken(clientProperties)
             verify(clientCredentialsTokenResponseClient).getTokenResponse(reifiedAny(ClientCredentialsGrantRequest::class.java))
-            assertThat(res3!!.accessToken).isEqualTo(secondAccessToken)
+            assertThat(res3.accessToken).isEqualTo(secondAccessToken)
         }
 
     @Test
@@ -163,7 +163,7 @@ internal class OAuth2AccessTokenServiceTest {
         val res1 = oAuth2AccessTokenService.getAccessToken(clientProperties)
         verify(onBehalfOfTokenResponseClient).getTokenResponse(reifiedAny(OnBehalfOfGrantRequest::class.java))
         assertThat(res1).hasNoNullFieldsOrProperties()
-        assertThat(res1!!.accessToken).isEqualTo("first_access_token")
+        assertThat(res1.accessToken).isEqualTo("first_access_token")
         Thread.sleep(1000)
 
         //entry should be missing from cache due to expiry
@@ -173,7 +173,7 @@ internal class OAuth2AccessTokenServiceTest {
             .thenReturn(accessTokenResponse(secondAccessToken, 1))
         val res2 = oAuth2AccessTokenService.getAccessToken(clientProperties)
         verify(onBehalfOfTokenResponseClient).getTokenResponse(reifiedAny(OnBehalfOfGrantRequest::class.java))
-        assertThat(res2!!.accessToken).isEqualTo(secondAccessToken)
+        assertThat(res2.accessToken).isEqualTo(secondAccessToken)
     }
 
     @Test
@@ -188,7 +188,7 @@ internal class OAuth2AccessTokenServiceTest {
             verify(exchangeTokeResponseClient, times(1)).getTokenResponse(reifiedAny(
                 TokenExchangeGrantRequest::class.java))
             assertThat(res1).hasNoNullFieldsOrProperties()
-            assertThat(res1!!.accessToken).isEqualTo("first_access_token")
+            assertThat(res1.accessToken).isEqualTo("first_access_token")
         }
 
     companion object {

diff --git a/...lient-kotlin-demo/src/main/kotlin/no/nav/security/token/support/ktor/oauth/OAuth2Cache.kt b/...lient-kotlin-demo/src/main/kotlin/no/nav/security/token/support/ktor/oauth/OAuth2Cache.kt
@@ -13,7 +13,7 @@ data class OAuth2CacheConfig(val enabled: Boolean, val maximumSize: Long = 1000,
         Caffeine.newBuilder()
             .expireAfter(evictOnResponseExpiresIn(evictSkew))
             .maximumSize(maximumSize)
-            .buildAsync { key: GrantRequest, _ ->
+            .buildAsync { key, _ ->
                 cacheContext.future {
                     loader(key)
                 }

diff --git a/...tlin/no/nav/security/token/support/client/spring/oauth2/OAuth2ClientRequestInterceptor.kt b/...tlin/no/nav/security/token/support/client/spring/oauth2/OAuth2ClientRequestInterceptor.kt
@@ -24,7 +24,7 @@ class OAuth2ClientRequestInterceptor(private val properties: ClientConfiguration
                                      private val matcher: ClientConfigurationPropertiesMatcher) : ClientHttpRequestInterceptor {
     override fun intercept(req: HttpRequest, body: ByteArray, execution: ClientHttpRequestExecution): ClientHttpResponse {
         matcher.findProperties(properties, req.uri)?.let {
-            service.getAccessToken(it)?.accessToken?.let { token -> req.headers.setBearerAuth(token) }
+            service.getAccessToken(it).accessToken?.let { token -> req.headers.setBearerAuth(token) }
         }
         return execution.execute(req, body)
     }