From 701c2b7cd3d9426fafdef7c9c7361db397ed8ca3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dominik=20S=C3=A4ume?= <Dominik.Saeume@hmmh.de>
Date: Fri, 27 Sep 2024 12:15:35 +0200
Subject: [PATCH 1/3] PMT-14: Refactor Generator Config and Setup

---
 .run/Run.run.xml                                    |  2 +-
 build.gradle.kts                                    | 11 ++++++-----
 src/main/java/de/hmmh/pmt/ApiController.java        |  2 +-
 .../hmmh/pmt/ProjectManagementToolApplication.java  | 13 -------------
 src/main/resources/.codegen-ignore                  |  4 +++-
 src/main/resources/checkstyle-ignore.xml            |  1 +
 src/main/resources/gen-config.json                  |  4 ++--
 src/main/resources/spotbugs-exclude.xml             |  4 ++--
 8 files changed, 16 insertions(+), 25 deletions(-)
 delete mode 100644 src/main/java/de/hmmh/pmt/ProjectManagementToolApplication.java

diff --git a/.run/Run.run.xml b/.run/Run.run.xml
index 057162a..b431422 100644
--- a/.run/Run.run.xml
+++ b/.run/Run.run.xml
@@ -1,7 +1,7 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="Run" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
     <module name="Project_Management_Tool.main" />
-    <option name="SPRING_BOOT_MAIN_CLASS" value="de.hmmh.pmt.ProjectManagementToolApplication" />
+    <option name="SPRING_BOOT_MAIN_CLASS" value="de.hmmh.pmt.OpenAPISpringBoot" />
     <method v="2">
       <option name="Make" enabled="true" />
       <option name="RunConfigurationTask" enabled="false" run_configuration_name="Postgres" run_configuration_type="docker-deploy" />
diff --git a/build.gradle.kts b/build.gradle.kts
index f3730f2..858086b 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -10,7 +10,7 @@ repositories {
 plugins {
     java
     checkstyle
-    id("com.github.spotbugs") version "6.0.22"
+    id("com.github.spotbugs") version "6.0.23"
     id("org.springframework.boot") version "3.3.3"
     id("io.spring.dependency-management") version "1.1.6"
     id("org.hidetake.swagger.generator") version "2.19.2"
@@ -44,17 +44,17 @@ configurations {
 }
 
 dependencies {
-    //Spring
+    // Spring
     implementation("org.springframework.boot:spring-boot-starter-data-jpa")
     implementation("org.springframework.boot:spring-boot-starter-validation")
     implementation("org.springframework.boot:spring-boot-starter-web")
     runtimeOnly("org.postgresql:postgresql")
 
-    //Lombok
+    // Lombok
     compileOnly("org.projectlombok:lombok")
     annotationProcessor("org.projectlombok:lombok")
 
-    //Test
+    // Test
     testImplementation("org.springframework.boot:spring-boot-starter-test")
     testImplementation("org.springframework.boot:spring-boot-testcontainers")
     testImplementation("org.testcontainers:junit-jupiter")
@@ -64,6 +64,7 @@ dependencies {
     //OAS
     swaggerCodegen("io.swagger.codegen.v3:swagger-codegen-cli:3.0.61")
     implementation("io.swagger.core.v3:swagger-annotations:2.2.22")
+    implementation("jakarta.xml.bind:jakarta.xml.bind-api") //Needed for XML/HTML Validation
 }
 
 swaggerSources {
@@ -73,7 +74,6 @@ swaggerSources {
         val validationTask = validation
         code(delegateClosureOf<GenerateSwaggerCode> {
             language = "spring"
-            components = listOf("models", "apis")
             code.rawOptions =
                 listOf("--ignore-file-override=" + file("${rootDir}/src/main/resources/.codegen-ignore").absolutePath)
             dependsOn(validationTask)
@@ -90,6 +90,7 @@ tasks {
         }
     }
     withType<SpotBugsTask> {
+        
         excludeFilter.set(file("${rootDir}/src/main/resources/spotbugs-exclude.xml"))
     }
     processResources {
diff --git a/src/main/java/de/hmmh/pmt/ApiController.java b/src/main/java/de/hmmh/pmt/ApiController.java
index 550e965..d210430 100644
--- a/src/main/java/de/hmmh/pmt/ApiController.java
+++ b/src/main/java/de/hmmh/pmt/ApiController.java
@@ -2,7 +2,7 @@ package de.hmmh.pmt;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import de.hmmh.pmt.oas.DefaultApi;
-import de.hmmh.pmt.oas.models.HelloOut;
+import de.hmmh.pmt.dtos.HelloOut;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
diff --git a/src/main/java/de/hmmh/pmt/ProjectManagementToolApplication.java b/src/main/java/de/hmmh/pmt/ProjectManagementToolApplication.java
deleted file mode 100644
index 0e72b54..0000000
--- a/src/main/java/de/hmmh/pmt/ProjectManagementToolApplication.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package de.hmmh.pmt;
-
-import org.springframework.boot.SpringApplication;
-import org.springframework.boot.autoconfigure.SpringBootApplication;
-
-@SpringBootApplication
-public class ProjectManagementToolApplication {
-
-    public static void main(String[] args) {
-        SpringApplication.run(ProjectManagementToolApplication.class, args);
-    }
-
-}
diff --git a/src/main/resources/.codegen-ignore b/src/main/resources/.codegen-ignore
index f71569b..e7d0efa 100644
--- a/src/main/resources/.codegen-ignore
+++ b/src/main/resources/.codegen-ignore
@@ -1,2 +1,4 @@
 **/*ApiController.java
-**/org/openapitools/configuration/
\ No newline at end of file
+**/*application.properties
+**/io/swagger/configuration/HomeController.java
+**/io/swagger/configuration/SwaggerUiConfiguration.java
\ No newline at end of file
diff --git a/src/main/resources/checkstyle-ignore.xml b/src/main/resources/checkstyle-ignore.xml
index 392fd6e..dd2974f 100644
--- a/src/main/resources/checkstyle-ignore.xml
+++ b/src/main/resources/checkstyle-ignore.xml
@@ -6,4 +6,5 @@
 
 <suppressions>
     <suppress files="[\\/]de[\\/]hmmh[\\/]pmt[\\/]oas" checks="."/>
+    <suppress files="[\\/]de[\\/]hmmh[\\/]pmt[\\/]dtos" checks="."/>
 </suppressions>
diff --git a/src/main/resources/gen-config.json b/src/main/resources/gen-config.json
index a87080c..c2d6f24 100644
--- a/src/main/resources/gen-config.json
+++ b/src/main/resources/gen-config.json
@@ -1,7 +1,7 @@
 {
-    "modelPackage": "de.hmmh.pmt.oas.models",
+    "modelPackage": "de.hmmh.pmt.dtos",
     "apiPackage": "de.hmmh.pmt.oas",
-    "invokerPackage": "de.hmmh.pmt.oas",
+    "invokerPackage": "de.hmmh.pmt",
     "java8": false,
     "java11": true,
     "dateLibrary": "java11",
diff --git a/src/main/resources/spotbugs-exclude.xml b/src/main/resources/spotbugs-exclude.xml
index af8fb41..2bf8281 100644
--- a/src/main/resources/spotbugs-exclude.xml
+++ b/src/main/resources/spotbugs-exclude.xml
@@ -1,5 +1,5 @@
-<FindBugsFilter>
+<FindBugsFilter xmlns="https://raw.githubusercontent.com/spotbugs/spotbugs/4.8.6/spotbugs/etc/findbugsfilter.xsd">
     <Match>
-        <Package name="de.hmmh.pmt.oas"/>
+        <Class name="de.hmmh.pmt.OpenAPISpringBoot$ExitException"/>
     </Match>
 </FindBugsFilter>

From 1e65f834f5f24c71b22f55887705787001e68e3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dominik=20S=C3=A4ume?= <Dominik.Saeume@hmmh.de>
Date: Fri, 27 Sep 2024 12:16:41 +0200
Subject: [PATCH 2/3] PMT-14: Add Spring Security with Oauth2

---
 build.gradle.kts                          |  6 ++++++
 src/main/resources/application.properties | 13 ++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index 858086b..d8e2076 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -48,6 +48,11 @@ dependencies {
     implementation("org.springframework.boot:spring-boot-starter-data-jpa")
     implementation("org.springframework.boot:spring-boot-starter-validation")
     implementation("org.springframework.boot:spring-boot-starter-web")
+    implementation("org.springframework.boot:spring-boot-starter-security")
+    implementation("org.springframework.boot:spring-boot-starter-oauth2-client")
+    implementation("org.springframework.boot:spring-boot-starter-oauth2-resource-server")
+
+    // Postgres
     runtimeOnly("org.postgresql:postgresql")
 
     // Lombok
@@ -57,6 +62,7 @@ dependencies {
     // Test
     testImplementation("org.springframework.boot:spring-boot-starter-test")
     testImplementation("org.springframework.boot:spring-boot-testcontainers")
+    testImplementation("org.springframework.security:spring-security-test")
     testImplementation("org.testcontainers:junit-jupiter")
     testImplementation("org.testcontainers:postgresql")
     testRuntimeOnly("org.junit.platform:junit-platform-launcher")
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 676a110..4fc64fe 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -6,4 +6,15 @@ server.port=8080
 spring.datasource.url=jdbc:postgresql://localhost:5432/pmt
 spring.datasource.username=pmt_user
 spring.datasource.password=pmt123
-spring.jpa.hibernate.ddl-auto=create-drop
\ No newline at end of file
+spring.jpa.hibernate.ddl-auto=create-drop
+
+# JWT Auth
+spring.security.oauth2.client.registration.keycloak.client-id=employee-management-service
+spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
+spring.security.oauth2.client.registration.keycloak.scope=openid
+spring.security.oauth2.client.provider.keycloak.issuer-uri=https://keycloak.szut.dev/auth/realms/szut
+spring.security.oauth2.client.provider.keycloak.user-name-attribute=preferred_username
+spring.security.oauth2.resourceserver.jwt.issuer-uri=https://keycloak.szut.dev/auth/realms/szut
+
+# Debugging
+logging.level.org.springframework.security=DEBUG
\ No newline at end of file

From ead0bccfe7f42c257700b013d378ff332ab81618 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dominik=20S=C3=A4ume?= <Dominik.Saeume@hmmh.de>
Date: Fri, 27 Sep 2024 12:17:17 +0200
Subject: [PATCH 3/3] PMT-14: Implement JWT Auth

---
 .../java/de/hmmh/pmt/auth/AuthConfig.java     | 57 +++++++++++++++
 src/main/java/de/hmmh/pmt/auth/JWT.java       | 69 +++++++++++++++++++
 src/main/resources/api.yml                    |  7 ++
 3 files changed, 133 insertions(+)
 create mode 100644 src/main/java/de/hmmh/pmt/auth/AuthConfig.java
 create mode 100644 src/main/java/de/hmmh/pmt/auth/JWT.java

diff --git a/src/main/java/de/hmmh/pmt/auth/AuthConfig.java b/src/main/java/de/hmmh/pmt/auth/AuthConfig.java
new file mode 100644
index 0000000..268a9ec
--- /dev/null
+++ b/src/main/java/de/hmmh/pmt/auth/AuthConfig.java
@@ -0,0 +1,57 @@
+package de.hmmh.pmt.auth;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.session.SessionRegistry;
+import org.springframework.security.core.session.SessionRegistryImpl;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
+import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
+import org.springframework.security.web.session.HttpSessionEventPublisher;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+public class AuthConfig {
+
+    private final JWT jwt;
+
+    AuthConfig(JWT jwt) {
+        this.jwt = jwt;
+    }
+
+    @Bean
+    public SessionRegistry sessionRegistry() {
+        return new SessionRegistryImpl();
+    }
+
+    @Bean
+    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
+        return new RegisterSessionAuthenticationStrategy(sessionRegistry());
+    }
+
+    @Bean
+    public HttpSessionEventPublisher httpSessionEventPublisher() {
+        return new HttpSessionEventPublisher();
+    }
+
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest()
+                        .authenticated()
+                )
+                .oauth2ResourceServer(resourceServer -> resourceServer
+                        .jwt(jwt -> jwt
+                                .jwtAuthenticationConverter(this.jwt.jwtAuthenticationConverter())
+                        )
+                );
+        return http.build();
+    }
+}
diff --git a/src/main/java/de/hmmh/pmt/auth/JWT.java b/src/main/java/de/hmmh/pmt/auth/JWT.java
new file mode 100644
index 0000000..5360d62
--- /dev/null
+++ b/src/main/java/de/hmmh/pmt/auth/JWT.java
@@ -0,0 +1,69 @@
+package de.hmmh.pmt.auth;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.RestTemplate;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+@Component
+public class JWT implements LogoutHandler {
+    private static final String REALM_ACCESS_CLAIM = "realm_access";
+    private static final String ROLES_CLAIM = "roles";
+    private static final String ROLE_PREFIX = "ROLE_";
+    private static final String OIDC_LOGOUT_ROUTE = "/protocol/openid-connect/logout";
+    private static final String OIDC_TOKEN_HINT_QUERY_PARAMETER = "id_token_hin";
+
+    private final RestTemplate template = new RestTemplate();
+
+    @Override
+    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
+        OidcUser user = (OidcUser) authentication.getPrincipal();
+        String endSessionEndpoint = user.getIssuer() + OIDC_LOGOUT_ROUTE;
+        UriComponentsBuilder builder = UriComponentsBuilder
+                .fromUriString(endSessionEndpoint)
+                .queryParam(OIDC_TOKEN_HINT_QUERY_PARAMETER, user.getIdToken().getTokenValue());
+
+        ResponseEntity<String> logoutResponse = template.getForEntity(builder.toUriString(), String.class);
+        if (logoutResponse.getStatusCode().is2xxSuccessful()) {
+            System.out.println("Logged out successfully");
+        } else {
+            System.out.println("Failed to logout");
+        }
+    }
+
+    public JwtAuthenticationConverter jwtAuthenticationConverter() {
+        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
+        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwt -> {
+            List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
+
+            Map<String, Object> realmAccess = jwt.getClaim(REALM_ACCESS_CLAIM);
+            if (realmAccess == null || !realmAccess.containsKey(ROLES_CLAIM)) {
+                return grantedAuthorities;
+            }
+
+            Object rolesClaim = realmAccess.get(ROLES_CLAIM);
+            if (!(rolesClaim instanceof List<?>)) {
+                return grantedAuthorities;
+            }
+            for (Object role : (List<?>) rolesClaim) {
+                assert role instanceof String;
+                grantedAuthorities.add(new SimpleGrantedAuthority(ROLE_PREFIX + role));
+            }
+
+            return grantedAuthorities;
+        });
+        return jwtAuthenticationConverter;
+    }
+}
diff --git a/src/main/resources/api.yml b/src/main/resources/api.yml
index 7e46e48..06e99b1 100644
--- a/src/main/resources/api.yml
+++ b/src/main/resources/api.yml
@@ -5,8 +5,15 @@ info:
   version: 1.0.0
 servers:
   - url: /api/v1
+security:
+  - JWTAuth: []
     
 components:
+  securitySchemes:
+    JWTAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
   schemas: 
     HelloOut:
       description: "A Test Schema"