Split classic and hydra jwtAccessTokenConverters so they can each have their own scope attribute

Author: Sheikah45

src/main/java/com/faforever/api/config/security/oauth2/OAuthJwtConfig.java

@@ -3,6 +3,7 @@
 import com.faforever.api.config.FafApiProperties;
 import com.faforever.api.security.FafMultiTokenStore;
 import com.faforever.api.security.FafUserAuthenticationConverter;
+import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Primary;
@@ -33,11 +34,16 @@ public DefaultTokenServices tokenServices(TokenStore tokenStore) {
   }
 
   @Bean
-  public TokenStore tokenStore(FafApiProperties properties, JwtAccessTokenConverter jwtAccessTokenConverter) {
-    return new FafMultiTokenStore(properties, jwtAccessTokenConverter);
+  public TokenStore tokenStore(FafApiProperties properties,
+                               @Qualifier("classicAccessTokenConverter")
+                               JwtAccessTokenConverter jwtAccessTokenConverter,
+                               @Qualifier("hydraAccessTokenConverter")
+                               JwtAccessTokenConverter hydraAccessTokenConverter) {
+    return new FafMultiTokenStore(properties, jwtAccessTokenConverter, hydraAccessTokenConverter);
   }
 
-  @Bean
+  @Bean(name = "classicAccessTokenConverter")
+  @Primary
   protected JwtAccessTokenConverter jwtAccessTokenConverter() throws IOException {
     String secretKey = Files.readString(fafApiProperties.getJwt().getSecretKeyPath());
     String publicKey = Files.readString(fafApiProperties.getJwt().getPublicKeyPath());
@@ -48,4 +54,17 @@ protected JwtAccessTokenConverter jwtAccessTokenConverter() throws IOException {
     ((DefaultAccessTokenConverter) jwtAccessTokenConverter.getAccessTokenConverter()).setUserTokenConverter(new FafUserAuthenticationConverter());
     return jwtAccessTokenConverter;
   }
+
+  @Bean(name = "hydraAccessTokenConverter")
+  protected JwtAccessTokenConverter hydraAccessTokenConverter() throws IOException {
+    String secretKey = Files.readString(fafApiProperties.getJwt().getSecretKeyPath());
+    String publicKey = Files.readString(fafApiProperties.getJwt().getPublicKeyPath());
+
+    JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
+    jwtAccessTokenConverter.setSigningKey(secretKey);
+    jwtAccessTokenConverter.setVerifierKey(publicKey);
+    ((DefaultAccessTokenConverter) jwtAccessTokenConverter.getAccessTokenConverter()).setUserTokenConverter(new FafUserAuthenticationConverter());
+    ((DefaultAccessTokenConverter) jwtAccessTokenConverter.getAccessTokenConverter()).setScopeAttribute("scp");
+    return jwtAccessTokenConverter;
+  }
 }

src/main/java/com/faforever/api/security/FafMultiTokenStore.java

@@ -1,6 +1,7 @@
 package com.faforever.api.security;
 
 import com.faforever.api.config.FafApiProperties;
+import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.security.jwt.Jwt;
 import org.springframework.security.jwt.JwtHelper;
 import org.springframework.security.oauth2.common.OAuth2AccessToken;
@@ -35,11 +36,15 @@ public class FafMultiTokenStore implements TokenStore {
 
   private final FafApiProperties fafApiProperties;
 
-  public FafMultiTokenStore(FafApiProperties fafApiProperties, JwtAccessTokenConverter jwtAccessTokenConverter) {
+  public FafMultiTokenStore(FafApiProperties fafApiProperties,
+                            @Qualifier("classicAccessTokenConverter")
+                            JwtAccessTokenConverter jwtAccessTokenConverter,
+                            @Qualifier("hydraAccessTokenConverter")
+                            JwtAccessTokenConverter hydraAccessTokenConverter) {
     this.fafApiProperties = fafApiProperties;
 
     classicTokenStore = new JwtTokenStore(jwtAccessTokenConverter);
-    hydraTokenStore = new JwkTokenStore(fafApiProperties.getJwt().getFafHydraJwksUrl(), jwtAccessTokenConverter);
+    hydraTokenStore = new JwkTokenStore(fafApiProperties.getJwt().getFafHydraJwksUrl(), hydraAccessTokenConverter);
   }
 
   @Override

src/main/resources/config/application-dev.yml

@@ -2,8 +2,8 @@ faf-api:
   jwt:
     secretKeyPath: ${JWT_PRIVATE_KEY_PATH:test-pki-private.key}
     publicKeyPath: ${JWT_PUBLIC_KEY_PATH:test-pki-public.key}
-    fafHydraJwksUrl: ${JWT_FAF_HYDRA_JWKS_URL:https://hydra.test.faforever.com/.well-known/jwks.json}
-    fafHydraIssuer: ${JWT_FAF_HYDRA_ISSUER:https://hydra.test.faforever.com/}
+    fafHydraJwksUrl: ${JWT_FAF_HYDRA_JWKS_URL:http://localhost:4444/.well-known/jwks.json}
+    fafHydraIssuer: ${JWT_FAF_HYDRA_ISSUER:http://localhost:4444/}
   map:
     target-directory: ${MAP_UPLOAD_PATH:build/cache/map/maps}
     directory-preview-path-small: ${MAP_PREVIEW_PATH_SMALL:build/cache/map_previews/small}
@@ -46,7 +46,7 @@ faf-api:
   password-reset:
     password-reset-url-format: ${PASSWORD_RESET_URL_FORMAT:http://localhost:8020/account/password/confirmReset?username=%s&token=%s}
     subject: ${PASSWORD_RESET_EMAIL_SUBJECT:FAF password reset}
-    html-format: ${PASSWORD_RESET_EMAIL_BODY:Registration email body}
+    html-format: ${PASSWORD_RESET_EMAIL_BODY:Reset email body for user {0} with reset link {1}}
   steam:
     realm: ${STEAM_REALM:http://localhost}
     api-key: ${STEAM_API_KEY:banana}