Add long-term token check in isAuthorized method (#210)

This commit adds a new parameter `isLongTermToken` to the `isAuthorized` method in the `AuthorizationService` class. It updates the `TokenService` and several test cases to accommodate this change, ensuring that long-term tokens bypass the session expiration check.
hms-dbmi · Sep 17, 2024 · 222a096 · 222a096
1 parent a66011a
commit 222a096
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 12 deletions.
diff --git a/...-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/TokenService.java b/...-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/TokenService.java
@@ -174,7 +174,7 @@ private TokenInspection validateToken(Map<String, Object> inputMap) throws Illeg
  // The protocol between applications and PSAMA is application will
  // attach everything that needs to be verified in request field of inputMap
  // besides token. So here we should attach everything in request.
- && authorizationService.isAuthorized(application, inputMap.get("request"), user)) {
+ && authorizationService.isAuthorized(application, inputMap.get("request"), user, isLongTermToken)) {
  isAuthorizationPassed = true;
  } else {
  // if isLongTermTokenCompromised flag is true,

diff --git a/...a/edu/harvard/hms/dbmi/avillach/auth/service/impl/authorization/AuthorizationService.java b/...a/edu/harvard/hms/dbmi/avillach/auth/service/impl/authorization/AuthorizationService.java
@@ -84,11 +84,12 @@ public AuthorizationService(AccessRuleService accessRuleService,
  *
  * @param application
  * @param requestBody
+ * @param isLongTermToken
  * @return
  * @see Privilege
  * @see AccessRule
  */
- public boolean isAuthorized(Application application, Object requestBody, User user) {
+ public boolean isAuthorized(Application application, Object requestBody, User user, boolean isLongTermToken) {
  String applicationName = application.getName();
  String resourceId = "null";
  String targetService = "null";
@@ -103,7 +104,7 @@ public boolean isAuthorized(Application application, Object requestBody, User us
  return false;
  }
 
- if (sessionService.isSessionExpired(user.getSubject())) {
+ if (!isLongTermToken && sessionService.isSessionExpired(user.getSubject())) {
  logger.error("isAuthorized() Session expired {}", user.getSubject());
  return false;
  }

diff --git a/...c/test/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/AuthorizationServiceTest.java b/...c/test/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/AuthorizationServiceTest.java
@@ -63,7 +63,7 @@ public void testIsAuthorized_AccessRulePassed() {
  Map<String, Object> requestBody = new HashMap<>();
  requestBody.put("test", "value");
 
- boolean result = authorizationService.isAuthorized(application, requestBody, user);
+ boolean result = authorizationService.isAuthorized(application, requestBody, user, false);
 
  assertTrue(result);
  }
@@ -77,7 +77,7 @@ public void testIsAuthorized_AccessRuleFailed() {
  Map<String, Object> requestBody = new HashMap<>();
  requestBody.put("test", "differentValue");
 
- boolean result = authorizationService.isAuthorized(application, requestBody, user);
+ boolean result = authorizationService.isAuthorized(application, requestBody, user, false);
 
  assertFalse(result);
  }
@@ -171,7 +171,7 @@ public void testIsAuthorized_NoRequestBody() {
  configureUserSecurityContext(user);
  application.setPrivileges(user.getPrivilegesByApplication(application));
 
- boolean result = authorizationService.isAuthorized(application, null, user);
+ boolean result = authorizationService.isAuthorized(application, null, user, false);
 
  assertTrue(result);
  }
@@ -182,7 +182,7 @@ public void testIsAuthorized_NoPrivileges() {
  User user = createTestUser();
 
  user.getRoles().iterator().next().setPrivileges(Collections.emptySet());
- boolean result = authorizationService.isAuthorized(application, new HashMap<>(), user);
+ boolean result = authorizationService.isAuthorized(application, new HashMap<>(), user, false);
 
  assertFalse(result);
  }

diff --git a/...u/harvard/hms/dbmi/avillach/auth/service/impl/authorization/AuthorizationServiceTest.java b/...u/harvard/hms/dbmi/avillach/auth/service/impl/authorization/AuthorizationServiceTest.java
@@ -344,7 +344,7 @@ public void testIsAuthorized_AccessRulePassed() {
  Map<String, Object> requestBody = new HashMap<>();
  requestBody.put("test", "value");
 
- boolean result = authorizationService.isAuthorized(application, requestBody, user);
+ boolean result = authorizationService.isAuthorized(application, requestBody, user, false);
 
  assertTrue(result);
  }
@@ -359,7 +359,7 @@ public void testIsAuthorized_AccessRuleFailed() {
  Map<String, Object> requestBody = new HashMap<>();
  requestBody.put("test", "differentValue");
 
- boolean result = authorizationService.isAuthorized(application, requestBody, user);
+ boolean result = authorizationService.isAuthorized(application, requestBody, user, false);
 
  assertFalse(result);
  }
@@ -374,7 +374,7 @@ public void testIsAuthorized_AccessRuleFailed_strict() {
  Map<String, Object> requestBody = new HashMap<>();
  requestBody.put("test", "differentValue");
 
- boolean result = authorizationService.isAuthorized(application, requestBody, user);
+ boolean result = authorizationService.isAuthorized(application, requestBody, user, false);
 
  assertFalse(result);
  }
@@ -476,7 +476,7 @@ public void testIsAuthorized_NoRequestBody() {
  configureUserSecurityContext(user);
  application.setPrivileges(user.getPrivilegesByApplication(application));
 
- boolean result = authorizationService.isAuthorized(application, null, user);
+ boolean result = authorizationService.isAuthorized(application, null, user, false);
 
  assertTrue(result);
  }
@@ -488,7 +488,7 @@ public void testIsAuthorized_NoPrivileges() {
  user.setConnection(createFenceTestConnection());
 
  user.getRoles().iterator().next().setPrivileges(Collections.emptySet());
- boolean result = authorizationService.isAuthorized(application, new HashMap<>(), user);
+ boolean result = authorizationService.isAuthorized(application, new HashMap<>(), user, false);
 
  assertFalse(result);
  }