MODAT-150: Remove legacy token endpoint and all code associated with it

README.md

@@ -46,11 +46,9 @@ mod-authtoken supports a number of command line options as system properties, se
 * `cache.permissions` - Boolean controlling the permissions cache. Defaults to `true`.
 * `allow.cross.tenant.requests` - Boolean to allow (in consortia setups) or deny cross tenant requests. Defaults to `false`.
 * `token.expiration.seconds` - Override defaults for token expiration in the form of `tenantId:<tenant id>,accessToken:<seconds>,refreshToken:<seconds>;accessToken:<seconds>,refreshToken:<seconds>`. To override defaults for a specific tenant provide a triplet. To override defaults provide a pair. Separate entries in the string with a `;` character. Neither tenant entries nor a default are required. If a default or a key is not provided, a default of 10 minutes is set by the module for the access token, and a default of one week is set by the module for the refresh token. Note that the invalidate APIs invalidate refresh tokens only. An access token cannot be invalidated and remains valid until its expiration time; this is by design because the access token is stateless.
-* `legacy.token.tenants` - A comma separated list of tenant ids for which legacy (non-expiring) tokens are supported. Provide `*` to enable legacy tokens for all tenants or, do not provide the property at all. To disable legacy tokens for all tenants provide the key with an empty value. This will change to the default behavior in a future release.
 
 # Environment variables
 * `TOKEN_EXPIRATION_SECONDS` - Identical to `token.expiration.seconds` as specified above. Provided as a convenience. System property takes precedence.
-* `LEGACY_TOKEN_TENANTS` - Identical to `legacy.token.tenanats`.
 * `DB_HOST` - Postgres hostname. Defaults to `localhost`.
 * `DB_PORT` - Postgres port. Default to `5432`.
 * `DB_USERNAME` - Postgres username. Defaults to `root`.

descriptors/ModuleDescriptor-template.json

@@ -2,22 +2,6 @@
   "id": "${artifactId}-${version}",
   "name": "authtoken",
   "provides": [
-    {
-      "id": "authtoken",
-      "version": "2.1",
-      "handlers": [
-        {
-          "methods": [ "POST" ],
-          "pathPattern": "/token",
-          "permissionsRequired": [ "auth.token.post" ]
-        },
-        {
-          "methods": [ "POST" ],
-          "pathPattern": "/refreshtoken",
-          "permissionsRequired": [ "auth.refreshtoken.post" ]
-        }
-      ]
-    },
     {
       "id": "authtoken2",
       "version": "1.1",

src/main/java/org/folio/auth/authtokenmodule/apis/RouteApi.java

@@ -16,10 +16,6 @@
 import org.folio.auth.authtokenmodule.storage.RefreshTokenStore;
 import org.folio.auth.authtokenmodule.TokenCreator;
 import org.folio.auth.authtokenmodule.tokens.AccessToken;
-import org.folio.auth.authtokenmodule.tokens.DummyToken;
-import org.folio.auth.authtokenmodule.tokens.legacy.LegacyTokenTenantException;
-import org.folio.auth.authtokenmodule.tokens.legacy.LegacyTokenTenants;
-import org.folio.auth.authtokenmodule.tokens.legacy.LegacyAccessToken;
 import org.folio.auth.authtokenmodule.tokens.DummyTokenExpiring;
 import org.folio.auth.authtokenmodule.tokens.RefreshToken;
 import org.folio.auth.authtokenmodule.tokens.Token;
@@ -55,7 +51,6 @@ public class RouteApi extends Api implements RouterCreator, TenantInitHooks {
   private List<Route> routes;
   private Vertx vertx;
   private TokenExpiration tokenExpiration;
-  private LegacyTokenTenants legacyTokenTenants;
 
   /**
    * Constructs the API.
@@ -72,7 +67,6 @@ public RouteApi(Vertx vertx, TokenCreator tokenCreator, UserService userService)
     this.tokenCreator = tokenCreator;
 
     tokenExpiration = new TokenExpiration();
-    legacyTokenTenants = new LegacyTokenTenants();
     logger = LogManager.getLogger(RouteApi.class);
     int permLookupTimeout = Integer.parseInt(System.getProperty("perm.lookup.timeout", "10"));
     permissionsSource = new ModulePermissionsSource(vertx, permLookupTimeout);
@@ -88,10 +82,6 @@ public RouteApi(Vertx vertx, TokenCreator tokenCreator, UserService userService)
     // Must come after /invalidate-all because of startsWithMatching in Route.java.
     addRoute("/token/invalidate", List.of());
     addRoute("/_/tenant", List.of());
-    // The "legacy" routes.
-    addRoute("/refreshtoken", List.of("auth.refreshtoken.post"));
-    // This must be last because of the startsWith matching in Route.java.
-    addRoute("/token", List.of("auth.token.post"));
   }
 
   private void addRoute(String endpoint, List<String> requiredPermissions) {
@@ -103,12 +93,6 @@ public Future<Router> createRouter(Vertx vertx) {
     // Bind the openapi yaml definition with the handler methods defined here.
     return RouterBuilder.create(vertx, "openapi/token-1.0.yaml")
         .map(routerBuilder -> {
-          routerBuilder
-              .operation("token-legacy")
-              .handler(this::handleSignLegacyToken);
-          routerBuilder
-              .operation("token-sign-legacy")
-              .handler(this::handleSignRefreshTokenLegacy);
           routerBuilder
               .operation("token-refresh")
               .handler(this::handleRefresh);
@@ -312,71 +296,4 @@ private void handleTokenLogoutAll(RoutingContext ctx) {
       endText(ctx, 500, "Cannot handle token logout all: " + e.getMessage());
     }
   }
-
-  // Legacy methods. These next two methods can be removed once we stop supporting
-  // legacy tokens.
-
-  private void handleSignLegacyToken(RoutingContext ctx) {
-    try {
-      // X-Okapi-Tenant and X-Okapi-Url are already checked in FilterApi.
-      String tenant = ctx.request().headers().get(XOkapiHeaders.TENANT);
-
-      // Check for enhanced security mode being enabled for the tenant. If so return 404.
-      if (!legacyTokenTenants.isLegacyTokenTenant(tenant)) {
-        var message = "Tenant not a legacy token tenant as specified in this module's environment or system " +
-          "property. Cannot issue non-expiring legacy token.";
-       endText(ctx, 404, new LegacyTokenTenantException(message));
-       return;
-      }
-
-      JsonObject json = ctx.body().asJsonObject();
-      JsonObject payload;
-      payload = json.getJsonObject("payload");
-
-      // Both types of signing requests (dummy and access) have only this property in
-      // common.
-      String username = payload.getString("sub");
-      Token token;
-
-      // auth 2.0 did not expose the "type" property which is now used internally. But
-      // other modules like mod-login aren't aware of this type property. Because of this
-      // dummy token singing requests have a boolean which can be checked to distinguish them from
-      // regular access token signing requests.
-      if (isDummyTokenSigningRequest(payload)) {
-        logger.debug("Signing request is for a dummy token");
-
-        token = new DummyToken(tenant, payload.getJsonArray("extra_permissions"), username);
-      } else {
-        logger.debug("Signing request is for an access token");
-
-        String userId = payload.getString(USER_ID);
-        token = new LegacyAccessToken(tenant, username, userId);
-
-        // Clear the user from the permissions cache.
-        permissionsSource.clearCacheUser(userId, tenant);
-      }
-
-      logger.debug("Successfully created and signed token");
-
-      JsonObject responseObject = new JsonObject().put("token", token.encodeAsJWT(tokenCreator));
-      endJson(ctx, 201, responseObject.encode());
-    } catch (Exception e) {
-      endText(ctx, 500, e);
-    }
-  }
-
-  private void handleSignRefreshTokenLegacy(RoutingContext ctx) {
-    try {
-      String tenant = ctx.request().headers().get(XOkapiHeaders.TENANT);
-      JsonObject requestJson = ctx.body().asJsonObject();
-      String userId = requestJson.getString(USER_ID);
-      String sub = requestJson.getString("sub");
-      long expires = tokenExpiration.getRefreshTokenExpiration(tenant);
-      String refreshToken = new RefreshToken(tenant, sub, userId, expires).encodeAsJWE(tokenCreator);
-      JsonObject responseJson = new JsonObject().put(Token.REFRESH_TOKEN, refreshToken);
-      endJson(ctx, 201, responseJson.encode());
-    } catch (Exception e) {
-      endText(ctx, 500, e);
-    }
-  }
 }

src/main/java/org/folio/auth/authtokenmodule/tokens/Token.java

@@ -10,7 +10,6 @@
 import org.apache.logging.log4j.Logger;
 import org.folio.auth.authtokenmodule.BadSignatureException;
 import org.folio.auth.authtokenmodule.TokenCreator;
-import org.folio.auth.authtokenmodule.tokens.legacy.LegacyAccessToken;
 import org.folio.okapi.common.XOkapiHeaders;
 import java.text.ParseException;
 import java.time.Instant;
@@ -221,14 +220,12 @@ public static Token parse(String sourceToken, JsonObject claims) throws TokenVal
         claims.put("type", DummyToken.TYPE);
         return new DummyToken(sourceToken, claims);
       } else {
-        claims.put("type", LegacyAccessToken.TYPE);
-        return new LegacyAccessToken(sourceToken, claims);
+        claims.put("type", AccessToken.TYPE);
+        return new AccessToken(sourceToken, claims);
       }
     }
 
     switch (tokenType) {
-      case LegacyAccessToken.TYPE:
-        return new LegacyAccessToken(sourceToken, claims);
       case AccessToken.TYPE:
         return new AccessToken(sourceToken, claims);
       case RefreshToken.TYPE:

src/main/resources/openapi/token-1.0.yaml

@@ -6,58 +6,6 @@ paths:
   # NOTE This module relies on its folio-vertx-lib dependency to handle the /_/tenant
   # route. Please see its yaml specification for /_/tenant here:
   # https://dev.folio.org/reference/api/#folio-vertx-lib
-  /token:
-    parameters:
-      # folio-vertx-lib has header files but they don't make the headers required so we override
-      # that behavior here since these two headers are required.
-      - $ref: headers/okapi-tenant-required.yaml
-      - $ref: headers/okapi-url-required.yaml
-    post:
-      description: Deprecated. Will be removed in a future release. Please use /token/sign instead. Returns a signed, non-expiring legacy access token.
-      operationId: token-legacy
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/signTokenPayload"
-        required: true
-      responses:
-        "201":
-          description: Created and signed token successfully
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/tokenResponseLegacy"
-        "400":
-          $ref: "#/components/responses/trait_400"
-        "500":
-          $ref: "#/components/responses/trait_500"
-  /refreshtoken:
-    parameters:
-      - $ref: headers/okapi-tenant-required.yaml
-      - $ref: headers/okapi-url-required.yaml
-    post:
-      description: |
-        Returns a signed, expiring refresh token. This is a legacy endpoint and should not be
-        called by new code and will soon be fully depreciated.
-      operationId: token-sign-legacy
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/signRefreshToken"
-        required: true
-      responses:
-        "201":
-          description: Created and signed token successfully
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/token"
-        "400":
-          $ref: "#/components/responses/trait_400"
-        "500":
-          $ref: "#/components/responses/trait_500"
   /token/sign:
     parameters:
       # folio-vertx-lib has header files but they don't make the headers required so we override