github.com/phrase/openapi@v0.0.0-20240514140800-49e8a106740e/openapi-generator/templates/java/libraries/jersey2-experimental/auth/HttpSignatureAuth.mustache

{{>licenseInfo}}
  
package {{invokerPackage}}.auth;

import {{invokerPackage}}.Pair;
import {{invokerPackage}}.ApiException;

import java.net.URI;
import java.net.URLEncoder;
import java.security.MessageDigest;
import java.security.Key;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Base64;
import java.util.Date;
import java.util.Locale;
import java.util.Map;
import java.util.List;

import org.tomitribe.auth.signatures.*;

/**
 * A Configuration object for the HTTP message signature security scheme.
 */
public class HttpSignatureAuth implements Authentication {

  private Signer signer;

  // An opaque string that the server can use to look up the component they need to validate the signature.
  private String keyId;

  // The HTTP signature algorithm.
  private Algorithm algorithm;

  // The list of HTTP headers that should be included in the HTTP signature.
  private List<String> headers;

  // The digest algorithm which is used to calculate a cryptographic digest of the HTTP request body.
  private String digestAlgorithm;

  /**
   * Construct a new HTTP signature auth configuration object.
   *
   * @param keyId An opaque string that the server can use to look up the component they need to validate the signature.
   * @param algorithm The signature algorithm.
   * @param headers The list of HTTP headers that should be included in the HTTP signature.
   */
  public HttpSignatureAuth(String keyId, Algorithm algorithm, List<String> headers) {
    this.keyId = keyId;
    this.algorithm = algorithm;
    this.headers = headers;
    this.digestAlgorithm = "SHA-256";
  }

  /**
   * Returns the opaque string that the server can use to look up the component they need to validate the signature.
   *
   * @return The keyId.
   */
  public String getKeyId() {
    return keyId;
  }

  /**
   * Set the HTTP signature key id.
   *
   * @param keyId An opaque string that the server can use to look up the component they need to validate the signature.
   */
  public void setKeyId(String keyId) {
    this.keyId = keyId;
  }

  /**
   * Returns the HTTP signature algorithm which is used to sign HTTP requests.
   */
  public Algorithm getAlgorithm() {
    return algorithm;
  }

  /**
   * Sets the HTTP signature algorithm which is used to sign HTTP requests.
   *
   * @param algorithm The HTTP signature algorithm.
   */
  public void setAlgorithm(Algorithm algorithm) {
    this.algorithm = algorithm;
  }

  /**
   * Returns the digest algorithm which is used to calculate a cryptographic digest of the HTTP request body.
   *
   * @see java.security.MessageDigest
   */
  public String getDigestAlgorithm() {
    return digestAlgorithm;
  }

  /**
   * Sets the digest algorithm which is used to calculate a cryptographic digest of the HTTP request body.
   *
   * The exact list of supported digest algorithms depends on the installed security providers.
   * Every implementation of the Java platform is required to support "MD5", "SHA-1" and "SHA-256".
   * Do not use "MD5" and "SHA-1", they are vulnerable to multiple known attacks.
   * By default, "SHA-256" is used.
   *
   * @param digestAlgorithm The digest algorithm.
   *
   * @see java.security.MessageDigest
   */
  public void setDigestAlgorithm(String digestAlgorithm) {
    this.digestAlgorithm = digestAlgorithm;
  }

  /**
   * Returns the list of HTTP headers that should be included in the HTTP signature.
   */
  public List<String> getHeaders() {
    return headers;
  }

  /**
   * Sets the list of HTTP headers that should be included in the HTTP signature.
   *
   * @param headers The HTTP headers.
   */
  public void setHeaders(List<String> headers) {
    this.headers = headers;
  }

  public Signer getSigner() {
    return signer;
  }

  public void setSigner(Signer signer) {
    this.signer = signer;
  }

  /**
   * Set the private key used to sign HTTP requests using the HTTP signature scheme.
   *
   * @param key The private key.
   */
  public void setPrivateKey(Key key) throws ApiException {
    if (key == null) {
      throw new ApiException("Private key (java.security.Key) cannot be null");
    }

    signer = new Signer(key, new Signature(keyId, algorithm, null, headers));
  }

  @Override
  public void applyToParams(List<Pair> queryParams, Map<String, String> headerParams, Map<String, String> cookieParams,
                            String payload, String method, URI uri) throws ApiException {
    try {
      if (headers.contains("host")) {
        headerParams.put("host", uri.getHost());
      }

      if (headers.contains("date")) {
        headerParams.put("date", new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US).format(new Date()));
      }

      if (headers.contains("digest")) {
        headerParams.put("digest",
          this.digestAlgorithm + "=" +
            new String(Base64.getEncoder().encode(MessageDigest.getInstance(this.digestAlgorithm).digest(payload.getBytes()))));
      }

      if (signer == null) {
        throw new ApiException("Signer cannot be null. Please call the method `setPrivateKey` to set it up correctly");
      }

      // construct the path with the URL query string
      String path = uri.getPath();

      List<String> urlQueries = new ArrayList<String>();
      for (Pair queryParam : queryParams) {
        urlQueries.add(queryParam.getName() + "=" + URLEncoder.encode(queryParam.getValue(), "utf8").replaceAll("\\+", "%20"));
      }

      if (!urlQueries.isEmpty()) {
        path = path + "?" + String.join("&", urlQueries);
      }

      headerParams.put("Authorization", signer.sign(method, path, headerParams).toString());
    } catch (Exception ex) {
      throw new ApiException("Failed to create signature in the HTTP request header: " + ex.toString());
    }
  }
}