fix security modules

README.md

@@ -148,3 +148,14 @@ token.refresh:
   prefix: RT-
   timeToLive: PT2H # 2 hours
 ```
+
+Генерация ключей:
+
+```bash
+openssl genrsa -out private.pem 4096
+openssl rsa -in private.pem -pubout -out public.pem
+openssl pkcs8 -topk8 -inform PEM -outform DER -in private.pem  -nocrypt > pkcs8_key
+
+cat pkcs8_key | base64
+cat public.pem
+```

auth-core/src/main/kotlin/ru/touchin/auth/core/configurations/AuthCoreConfiguration.kt

@@ -8,7 +8,7 @@ import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
 import org.springframework.security.crypto.password.PasswordEncoder
 
 @ComponentScan("ru.touchin.auth.core")
-@ConfigurationPropertiesScan
+@ConfigurationPropertiesScan("ru.touchin.auth.core")
 class AuthCoreConfiguration {
 
     @Bean

auth-jwt-core/src/main/kotlin/ru/touchin/auth/core/configurations/AuthTokenConfiguration.kt

@@ -2,10 +2,8 @@ package ru.touchin.auth.core.configurations
 
 import org.springframework.boot.context.properties.ConfigurationPropertiesScan
 import org.springframework.context.annotation.ComponentScan
-import org.springframework.context.annotation.Configuration
 import org.springframework.context.annotation.Import
 
-@Configuration
 @Import(AuthCoreConfiguration::class)
 @ComponentScan("ru.touchin.auth.core.tokens")
 @ConfigurationPropertiesScan("ru.touchin.auth.core.tokens")

auth-jwt-core/src/main/kotlin/ru/touchin/auth/core/configurations/AuthTokenDatabaseConfiguration.kt

@@ -4,7 +4,6 @@ import org.springframework.boot.autoconfigure.domain.EntityScan
 import org.springframework.context.annotation.Configuration
 import org.springframework.context.annotation.Import
 
-@Configuration
 @Import(AuthCoreDatabaseConfiguration::class)
 @EntityScan("ru.touchin.auth.core.tokens")
 class AuthTokenDatabaseConfiguration

auth-jwt-core/src/main/kotlin/ru/touchin/auth/core/tokens/access/services/AccessTokenCoreService.kt

@@ -3,7 +3,7 @@ package ru.touchin.auth.core.tokens.access.services
 import ru.touchin.auth.core.tokens.access.dto.AccessToken
 import ru.touchin.auth.core.tokens.access.dto.AccessTokenRequest
 
-interface AccessTokenService {
+interface AccessTokenCoreService {
 
     fun create(accessTokenRequest: AccessTokenRequest): AccessToken
 

auth-jwt-core/src/main/kotlin/ru/touchin/auth/core/tokens/access/services/JwtAccessTokenCoreServiceImpl.kt

@@ -13,10 +13,10 @@ import java.time.ZoneId
 import java.util.*
 
 @Service
-class JwtAccessTokenServiceImpl(
+class JwtAccessTokenCoreServiceImpl(
     private val accessTokenProperties: AccessTokenProperties,
     private val accessTokenSigningAlgorithm: Algorithm
-) : AccessTokenService {
+) : AccessTokenCoreService {
 
     private fun sign(builder: JWTCreator.Builder) = builder.sign(accessTokenSigningAlgorithm)
 

auth-jwt-core/src/main/kotlin/ru/touchin/auth/core/tokens/refresh/services/RefreshTokenCoreService.kt

@@ -3,7 +3,7 @@ package ru.touchin.auth.core.tokens.refresh.services
 import ru.touchin.auth.core.tokens.refresh.dto.RefreshToken
 import ru.touchin.auth.core.tokens.refresh.services.dto.NewRefreshToken
 
-interface RefreshTokenService {
+interface RefreshTokenCoreService {
 
     fun get(value: String): RefreshToken
     fun create(token: NewRefreshToken): RefreshToken

auth-jwt-core/src/main/kotlin/ru/touchin/auth/core/tokens/refresh/services/RefreshTokenCoreServiceImpl.kt

@@ -20,13 +20,13 @@ import ru.touchin.common.random.SecureRandomStringGenerator
 import java.time.ZonedDateTime
 
 @Service
-class RefreshTokenServiceImpl(
+class RefreshTokenCoreServiceImpl(
     private val refreshTokenProperties: RefreshTokenProperties,
     private val refreshTokenRepository: RefreshTokenRepository,
     private val userRepository: UserRepository,
     private val deviceRepository: DeviceRepository,
     private val scopeRepository: ScopeRepository,
-) : RefreshTokenService {
+) : RefreshTokenCoreService {
 
     @Transactional(readOnly = true)
     override fun get(value: String): RefreshToken {

auth-jwt/build.gradle.kts

@@ -0,0 +1,13 @@
+plugins {
+    id("kotlin")
+    id("kotlin-spring")
+}
+
+dependencies {
+    implementation(project(":auth-jwt-core"))
+
+    implementation(project(":common-spring-security"))
+
+    implementation("org.springframework.security:spring-security-oauth2-jose")
+    implementation("org.springframework.boot:spring-boot-starter-oauth2-resource-server")
+}

auth-jwt/src/main/kotlin/ru/touchin/auth/security/jwt/configurations/JwtConfiguration.kt

@@ -0,0 +1,6 @@
+package ru.touchin.auth.security.jwt.configurations
+
+import org.springframework.context.annotation.ComponentScan
+
+@ComponentScan("ru.touchin.auth.security.jwt.http.configurators")
+class JwtConfiguration

auth-jwt/src/main/kotlin/ru/touchin/auth/security/jwt/http/configurators/JwtHttpSecurityConfigurator.kt

@@ -0,0 +1,36 @@
+package ru.touchin.auth.security.jwt.http.configurators
+
+import org.springframework.beans.factory.annotation.Qualifier
+import org.springframework.core.annotation.Order
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.oauth2.jwt.JwtDecoder
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder
+import org.springframework.stereotype.Component
+import ru.touchin.auth.core.tokens.access.properties.AccessTokenProperties
+import ru.touchin.common.spring.Ordered
+import ru.touchin.common.spring.security.http.configurators.HttpSecurityConfigurator
+import java.security.interfaces.RSAPublicKey
+
+@Order(Ordered.HIGH)
+@Component
+class JwtHttpSecurityConfigurator(
+    @Qualifier("accessTokenPublicKey")
+    private val accessTokenPublicKey: RSAPublicKey,
+    private val accessTokenProperties: AccessTokenProperties
+) : HttpSecurityConfigurator {
+
+    override fun configure(http: HttpSecurity) {
+        http.oauth2ResourceServer {
+            it.jwt { jwt ->
+                jwt.decoder(getJwtDecoder())
+            }
+        }
+    }
+
+    private fun getJwtDecoder(): JwtDecoder {
+        return NimbusJwtDecoder.withPublicKey(accessTokenPublicKey)
+            .signatureAlgorithm(accessTokenProperties.signatureAlgorithm)
+            .build()
+    }
+
+}

common-spring-security/src/main/kotlin/ru/touchin/common/spring/security/configurations/DefaultSecurityConfiguration.kt

@@ -5,26 +5,21 @@ import org.springframework.context.annotation.Configuration
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-import ru.touchin.common.spring.security.url.interceptors.UrlExpressionRegistryInterceptor
+import ru.touchin.common.spring.security.http.configurators.HttpSecurityConfigurator
 
 @Configuration
-@ComponentScan("ru.touchin.common.spring.security.url.interceptors")
+@ComponentScan(
+    "ru.touchin.common.spring.security.url.interceptors",
+    "ru.touchin.common.spring.security.http.configurators",
+)
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 class DefaultSecurityConfiguration(
-    private val urlExpressionRegistryInterceptors: List<UrlExpressionRegistryInterceptor>,
+    private val httpSecurityConfigurators: List<HttpSecurityConfigurator>,
 ) : WebSecurityConfigurerAdapter() {
 
     override fun configure(http: HttpSecurity) {
-        http
-            .cors().disable()
-            .csrf().disable()
-            .httpBasic().disable()
-            .authorizeRequests { urlExpressionRegistry ->
-                urlExpressionRegistryInterceptors.forEach {
-                    it.invoke(urlExpressionRegistry)
-                }
-
-                urlExpressionRegistry.anyRequest().authenticated()
+            httpSecurityConfigurators.forEach {
+                it.configure(http)
             }
     }
 

common-spring-security/src/main/kotlin/ru/touchin/common/spring/security/http/configurators/AuthorizeRequestsHttpSecurityConfigurator.kt

@@ -0,0 +1,25 @@
+package ru.touchin.common.spring.security.http.configurators
+
+import org.springframework.core.annotation.Order
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.stereotype.Component
+import ru.touchin.common.spring.Ordered
+import ru.touchin.common.spring.security.url.interceptors.UrlExpressionRegistryInterceptor
+
+@Order(Ordered.NORMAL)
+@Component
+class AuthorizeRequestsHttpSecurityConfigurator(
+    private val urlExpressionRegistryInterceptors: List<UrlExpressionRegistryInterceptor>,
+) : HttpSecurityConfigurator {
+
+    override fun configure(http: HttpSecurity) {
+        http.authorizeRequests { urlExpressionRegistry ->
+            urlExpressionRegistryInterceptors.forEach {
+                it.invoke(urlExpressionRegistry)
+            }
+
+            urlExpressionRegistry.anyRequest().authenticated()
+        }
+    }
+
+}

common-spring-security/src/main/kotlin/ru/touchin/common/spring/security/http/configurators/BasicHttpSecurityConfigurator.kt

@@ -0,0 +1,17 @@
+package ru.touchin.common.spring.security.http.configurators
+
+import org.springframework.core.annotation.Order
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.stereotype.Component
+import ru.touchin.common.spring.Ordered
+
+@Order(Ordered.LOW)
+@Component
+class BasicHttpSecurityConfigurator : HttpSecurityConfigurator {
+
+    override fun configure(http: HttpSecurity) {
+        // TODO: user properties
+        http.httpBasic().disable()
+    }
+
+}

common-spring-security/src/main/kotlin/ru/touchin/common/spring/security/http/configurators/CorsHttpSecurityConfigurator.kt

@@ -0,0 +1,17 @@
+package ru.touchin.common.spring.security.http.configurators
+
+import org.springframework.core.annotation.Order
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.stereotype.Component
+import ru.touchin.common.spring.Ordered
+
+@Order(Ordered.LOW)
+@Component
+class CorsHttpSecurityConfigurator : HttpSecurityConfigurator {
+
+    override fun configure(http: HttpSecurity) {
+        // TODO: user properties
+        http.cors().disable()
+    }
+
+}

common-spring-security/src/main/kotlin/ru/touchin/common/spring/security/http/configurators/CsrfHttpSecurityConfigurator.kt

@@ -0,0 +1,17 @@
+package ru.touchin.common.spring.security.http.configurators
+
+import org.springframework.core.annotation.Order
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.stereotype.Component
+import ru.touchin.common.spring.Ordered
+
+@Order(Ordered.LOW)
+@Component
+class CsrfHttpSecurityConfigurator : HttpSecurityConfigurator {
+
+    override fun configure(http: HttpSecurity) {
+        // TODO: use properties
+        http.csrf().disable()
+    }
+
+}

common-spring-security/src/main/kotlin/ru/touchin/common/spring/security/http/configurators/HttpSecurityConfigurator.kt

@@ -0,0 +1,9 @@
+package ru.touchin.common.spring.security.http.configurators
+
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+
+interface HttpSecurityConfigurator {
+
+    fun configure(http: HttpSecurity)
+
+}

settings.gradle.kts

@@ -41,3 +41,4 @@ include("response-wrapper-spring-web")
 include("settings-spring-jpa")
 include("auth-core")
 include("auth-jwt-core")
+include("auth-jwt")