23 create security config file Add API key management, role-based security, and Google OIDC integration

.github/workflows/ci.yml

@@ -9,6 +9,11 @@ on:
 jobs:
   builds:
     runs-on: ubuntu-latest
+    env:
+      MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
+      SECRET_KEY: ${{ secrets.SECRET_KEY }}
+      GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+      GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
 
     steps:
       - name: Checkout
@@ -21,6 +26,14 @@ jobs:
           java-version: 24
           cache: 'maven'
 
+      - name: Check Maven version
+        run: mvn --version
+
+      - name: Check Java version
+        run: java -version
+
+
+
       - name: Compile with Maven
         run: mvn -B --no-transfer-progress compile --file pom.xml
 

.gitignore

@@ -31,4 +31,4 @@ build/
 
 ### VS Code ###
 .vscode/
-.env
+.env

pom.xml

@@ -58,6 +58,23 @@
             <groupId>org.flywaydb</groupId>
             <artifactId>flyway-database-postgresql</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.thymeleaf.extras</groupId>
+            <artifactId>thymeleaf-extras-springsecurity6</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-client</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>

src/main/java/org/storkforge/barkr/ai/controller/MistralAiController.java

@@ -5,6 +5,7 @@
 import org.springframework.ai.mistralai.MistralAiChatModel;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -24,6 +25,7 @@ public MistralAiController(MistralAiChatModel chatModel) {
         this.chatModel = chatModel;
     }
 
+    @PreAuthorize("hasRole('PREMIUM')")
     @GetMapping("/ai/generate")
     public ResponseEntity<Map<String, String>> generate() {
         try {
@@ -35,4 +37,4 @@ public ResponseEntity<Map<String, String>> generate() {
             return ResponseEntity.internalServerError().body(Map.of(genKey, "Sorry, I couldn't generate a response. Please try again later."));
         }
     }
-}
+}

src/main/java/org/storkforge/barkr/api/controller/ApiKeyController.java

@@ -0,0 +1,114 @@
+package org.storkforge.barkr.api.controller;
+
+import org.springframework.format.annotation.DateTimeFormat;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+import org.storkforge.barkr.domain.IssuedApiKeyService;
+import org.storkforge.barkr.dto.apiKeyDto.GenerateApiKeyRequest;
+import org.storkforge.barkr.dto.apiKeyDto.ResponseApiKeyOnce;
+import org.storkforge.barkr.dto.apiKeyDto.UpdateApiKey;
+import org.storkforge.barkr.mapper.ApiKeyMapper;
+
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.time.temporal.ChronoUnit;
+import java.util.UUID;
+
+
+@Controller
+@RequestMapping("/apikeys")
+public class ApiKeyController {
+    private final IssuedApiKeyService issuedApiKeyService;
+
+    public ApiKeyController(IssuedApiKeyService issuedApiKeyService) {
+        this.issuedApiKeyService = issuedApiKeyService;
+    }
+
+    @GetMapping("/apikeyform")
+    @PreAuthorize("hasRole('USER')")
+    public String showApiKeyForm(Model model) {
+        String now = LocalDateTime.now().truncatedTo(ChronoUnit.MINUTES)
+                .format(DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm"));
+        model.addAttribute("now", now);
+        return "apikeys";
+    }
+
+
+    @GetMapping("/result")
+    @PreAuthorize("hasRole('USER')")
+    public String showGeneratedApiKey(@ModelAttribute("response") ResponseApiKeyOnce response, Model model) {
+        if (response == null || response.value() == null) {
+            return "redirect:/apikeys/apikeyform";
+        }
+
+        model.addAttribute("response", response);
+        return "apikeys/result";
+    }
+
+
+    @PostMapping("/generate")
+    @PreAuthorize("hasRole('USER')")
+    public String generateApiKey(
+            @RequestParam String apiKeyName,
+            @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME
+            ) LocalDateTime expiresAt,
+            RedirectAttributes redirectAttributes
+            ) throws NoSuchAlgorithmException, InvalidKeyException {
+        GenerateApiKeyRequest inputRequest = new GenerateApiKeyRequest(apiKeyName, expiresAt);
+        GenerateApiKeyRequest request = ApiKeyMapper.normalizeExpiresAt(inputRequest);
+
+        String apiKey;
+        String hashedApiKey;
+
+        do{
+        apiKey = issuedApiKeyService.generateRawApiKey();
+        hashedApiKey = issuedApiKeyService.hashedApiKey(apiKey);
+        } while (issuedApiKeyService.apiKeyExists(hashedApiKey));
+        issuedApiKeyService.apiKeyGenerate(request, hashedApiKey);
+
+        ResponseApiKeyOnce response = new ResponseApiKeyOnce(
+                "API-KEY", apiKey, "Please store these credentials safely");
+
+        redirectAttributes.addFlashAttribute("response", response);
+
+        return "redirect:/apikeys/result";
+
+
+    }
+
+    @GetMapping("/mykeys")
+    public String myKeys(Model model , @AuthenticationPrincipal OidcUser user) {
+        var currentUser = issuedApiKeyService.findByGoogleOidc2Id(user.getName());
+        var keys = issuedApiKeyService.allApiKeys(user.getName());
+        model.addAttribute("account", currentUser.get().getAccount());
+        model.addAttribute("keys", keys.apiKeys());
+        return "apikeys/mykeys";
+
+    }
+
+    @PostMapping("/mykeys/revoke")
+    public String revokeKey(@RequestParam String referenceId, @AuthenticationPrincipal OidcUser user) {
+        if (issuedApiKeyService.isValidUuid(UUID.fromString(referenceId), user.getName())) {
+        var update = new UpdateApiKey(UUID.fromString(referenceId),null, true, null);
+        issuedApiKeyService.updateApiKey(update);
+        }
+        return "redirect:/apikeys/mykeys";
+    }
+
+    @PostMapping("mykeys/nameupdate")
+    public String nameUpdate(@RequestParam String apiKeyName, @RequestParam String referenceId, @AuthenticationPrincipal OidcUser user) {
+        if(issuedApiKeyService.isValidUuid(UUID.fromString(referenceId), user.getName())) {
+        var update = new UpdateApiKey(UUID.fromString(referenceId), apiKeyName, false, null);
+        issuedApiKeyService.updateApiKey(update);
+        }
+        return "redirect:/apikeys/mykeys";
+    }
+
+}

src/main/java/org/storkforge/barkr/config/Config.java

@@ -3,17 +3,21 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.cache.annotation.EnableCaching;
+import org.storkforge.barkr.domain.entity.GoogleAccountApiKeyLink;
 import org.storkforge.barkr.domain.entity.Post;
 import org.springframework.boot.CommandLineRunner;
 import org.storkforge.barkr.domain.entity.Account;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Profile;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.reactive.function.client.WebClient;
+import org.storkforge.barkr.domain.roles.BarkrRole;
 import org.storkforge.barkr.infrastructure.persistence.PostRepository;
 import org.storkforge.barkr.infrastructure.persistence.AccountRepository;
 
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 @Configuration
 @Profile("!test")
@@ -31,17 +35,36 @@ CommandLineRunner accountInit(AccountRepository accountRepository, PostRepositor
         Account accountOne = new Account();
         accountOne.setUsername("Bella Pawkins");
         accountOne.setBreed("Golden Retriever");
+        accountOne.setGoogleOidc2Id("1");
         accountOne.setImage(null);
+        accountOne.setRoles(new HashSet<>(Set.of(BarkrRole.USER)));
 
         Account accountTwo = new Account();
         accountTwo.setUsername("Charlie Barkson");
         accountTwo.setBreed("Siberian Husky");
+        accountTwo.setGoogleOidc2Id("2");
         accountTwo.setImage(null);
+        accountTwo.setRoles(new HashSet<>(Set.of(BarkrRole.USER)));
 
         Account accountThree = new Account();
         accountThree.setUsername("Max Woofington");
         accountThree.setBreed("German Shepherd");
+        accountThree.setGoogleOidc2Id("3");
         accountThree.setImage(null);
+        accountThree.setRoles(new HashSet<>(Set.of(BarkrRole.USER)));
+
+        GoogleAccountApiKeyLink link1 = new GoogleAccountApiKeyLink();
+        link1.setAccount(accountOne);
+        accountOne.setGoogleAccountApiKeyLink(link1);
+
+        GoogleAccountApiKeyLink link2 = new GoogleAccountApiKeyLink();
+        link2.setAccount(accountTwo);
+        accountTwo.setGoogleAccountApiKeyLink(link2);
+
+        GoogleAccountApiKeyLink link3 = new GoogleAccountApiKeyLink();
+        link3.setAccount(accountThree);
+        accountThree.setGoogleAccountApiKeyLink(link3);
+
 
         accountRepository.saveAll(List.of(accountOne, accountTwo, accountThree));
 

src/main/java/org/storkforge/barkr/config/SecurityConfig.java

@@ -0,0 +1,94 @@
+package org.storkforge.barkr.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.logout.LogoutFilter;
+import org.storkforge.barkr.domain.IssuedApiKeyService;
+import org.storkforge.barkr.domain.roles.BarkrRole;
+import org.storkforge.barkr.filters.ApiKeyAuthenticationFilter;
+
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+public class SecurityConfig {
+
+    @Bean
+    @Order(3)
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{
+        http
+                .oauth2Login(Customizer.withDefaults())
+                .authorizeHttpRequests(authorize -> authorize
+                                .requestMatchers("/","/login", "/error", "/css/**", "/js/**", "/images/**").permitAll()
+                                .requestMatchers("/post/load").permitAll()
+                                .requestMatchers( "/account/{id}/image").permitAll()
+                                .requestMatchers("/ai/generate").hasRole(BarkrRole.PREMIUM.name())
+                                .requestMatchers("/post/add").authenticated()
+                                .requestMatchers("/account/{id}/upload").authenticated()
+                                .requestMatchers("/{username}").authenticated()
+                                .requestMatchers("/apikeys/generate").authenticated()
+                                .requestMatchers("/apikeys/apikeyform").authenticated()
+                                .requestMatchers("/apikeys/result").authenticated()
+                                .requestMatchers("/apikeys/mykeys").authenticated()
+                                .requestMatchers("/apikeys/mykeys/revoke").authenticated()
+                                .requestMatchers("/apikeys/mykeys/nameupdate").authenticated()
+                                .requestMatchers("/unlock-easter-egg").authenticated()
+
+                                .anyRequest().denyAll()
+
+                )
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .invalidateHttpSession(true)
+                        .clearAuthentication(true)
+                        .deleteCookies("JSESSIONID")
+                        .logoutSuccessUrl("/barkr/logout")
+                        .permitAll()
+
+        ).csrf(csrf -> csrf
+                        .ignoringRequestMatchers("/logout", "/ai/generate")
+                );
+
+        return http.build();
+    }
+
+
+    @Bean
+    @Order(2)
+    public SecurityFilterChain restAPIAndGraphQLFilterChain(
+            HttpSecurity http,
+            IssuedApiKeyService issuedApiKeyService) throws Exception {
+        http.securityMatcher("/api/**", "/graphql")
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .csrf(AbstractHttpConfigurer::disable)
+                .addFilterAfter(new ApiKeyAuthenticationFilter(issuedApiKeyService), LogoutFilter.class)
+                .authorizeHttpRequests(
+                        authorize -> authorize
+                                .requestMatchers("/api/accounts").authenticated()
+                                .requestMatchers("/api/posts").authenticated()
+                                .requestMatchers("/api/accounts/{id}").authenticated()
+                                .requestMatchers("/api/posts/{id}").authenticated()
+                                .requestMatchers("/api/keys").authenticated()
+                                .requestMatchers(HttpMethod.POST, "/graphql").authenticated()
+                                .anyRequest().denyAll()
+
+                );
+        return http.build();
+
+    }
+
+
+
+
+
+
+
+}

src/main/java/org/storkforge/barkr/domain/AccountService.java

@@ -30,6 +30,10 @@ public AccountService(AccountRepository accountRepository) {
         this.accountRepository = accountRepository;
     }
 
+    public Optional<Account> findByGoogleOidc2Id(String googleOidc2Id) {
+        return accountRepository.findByGoogleOidc2Id(googleOidc2Id);
+    }
+
     @Cacheable("allAccounts")
     public Page<ResponseAccount> findAll(Pageable pageable) {
         log.info("Finding all accounts");
@@ -85,4 +89,10 @@ public void updateImage(Long id, byte[] image) {
 
         accountRepository.save(account);
     }
+
+
+
+
+
+
 }