aswi2022code-of-duty-gitlab/backend/src/main/java/cz/zcu/kiv/backendapi/user/UserController.java @ c7d2ced1

package cz.zcu.kiv.backendapi.user;

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.google.common.base.Strings;
import cz.zcu.kiv.backendapi.security.jwt.JwtUtils;
import cz.zcu.kiv.backendapi.exception.ApiRequestException;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.web.bind.annotation.*;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.validation.Valid;
import java.io.IOException;
import java.time.LocalDateTime;
import java.time.ZoneId;
import java.util.Date;
import java.util.List;
import java.util.stream.Collectors;

/**
 * Controller for users
 */
@RestController()
@RequiredArgsConstructor
@Slf4j
public class UserController {

    /**
     * User service
     */
    private final IUserService userService;

    /**
     * JWT utils
     */
    private final JwtUtils jwtUtils;


    /**
     * Registers new user
     *
     * @param userDto user DTO
     */
    @PostMapping("/register")
    public void registerNewUser(@RequestBody @Valid UserDto userDto) {
        userService.registerNewUser(userDto);
    }

    /**
     * Returns list of all users
     *
     * @return list of all users
     */
    @GetMapping("/users")
    public ResponseEntity<List<UserDto>> getAllUsers() {
        return new ResponseEntity<>(userService.getAllUsers(), HttpStatus.OK);
    }

    //TODO check if need, if needed probably change new dto without email, comment otherwise
    @PutMapping("/user/{username}")
    public void updateUser(@PathVariable String username, @RequestBody @Valid UserDto userDto) {
        userService.updateUser(username, userDto);
    }

    //TODO check if needed, comment otherwise
    @DeleteMapping("/user/{username}")
    public void deleteUser(@PathVariable String username) {
        userService.deleteUser(username);
    }


    /**
     * Refreshes access token if refresh token is valid
     *
     * @param request  request
     * @param response response
     * @throws IOException I/O Exception
     */
    @GetMapping("token/refresh")
    public void refreshToken(HttpServletRequest request, HttpServletResponse response) throws IOException {
        String authorizationHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
        if (Strings.isNullOrEmpty(authorizationHeader) || !authorizationHeader.startsWith(jwtUtils.getTokenPrefix())) {
            throw new ApiRequestException("Refresh token is missing", HttpStatus.FORBIDDEN);
        }
        try {
            String refresh_token = authorizationHeader.substring(jwtUtils.getTokenPrefix().length());
            Algorithm algorithm = jwtUtils.getAlgorithm(); //TODO secure
            JWTVerifier verifier = JWT.require(algorithm).build();
            DecodedJWT decodedJWT = verifier.verify(refresh_token);
            String username = decodedJWT.getSubject();
            UserEntity user = userService.getUserByName(username);
            String access_token = JWT.create()
                    .withSubject(user.getUsername())
                    .withExpiresAt(Date.from((LocalDateTime.now().plusMinutes(jwtUtils.getTokenExpirationAfterMinutes())).atZone(ZoneId.systemDefault()).toInstant()))
                    .withIssuer(request.getRequestURL().toString())
                    .withClaim(jwtUtils.getClaimAuthoritiesName(), user.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList()))
                    .sign(algorithm);
            jwtUtils.writeTokensToResponse(response, access_token, refresh_token);
        } catch (Exception e) {
            log.error("Error refreshing token in: " + e.getMessage());
            jwtUtils.writeErrorToResponse(response, e);
        }
    }
}