Create inital cloudflare hmac token creation implementation

Author: Sheikah45

src/inttest/java/com/faforever/api/featuredmods/FeaturedModsControllerTest.java

@@ -0,0 +1,26 @@
+package com.faforever.api.featuredmods;
+
+import com.faforever.api.AbstractIntegrationTest;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.context.jdbc.Sql;
+
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@Sql(executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD, scripts = "classpath:sql/truncateTables.sql")
+@Sql(executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD, scripts = "classpath:sql/prepDefaultData.sql")
+@Sql(executionPhase = Sql.ExecutionPhase.BEFORE_TEST_METHOD, scripts = "classpath:sql/prepFeaturedMods.sql")
+public class FeaturedModsControllerTest extends AbstractIntegrationTest {
+
+  @Test
+  public void featuredModFileUrlCorrect() throws Exception {
+    mockMvc.perform(get("/featuredMods/0/files/latest")
+        .with(getOAuthTokenWithActiveUser(NO_SCOPE, NO_AUTHORITIES)))
+      .andExpect(status().isOk())
+      .andExpect(jsonPath("$.data", hasSize(1)))
+      .andExpect(jsonPath("$.data[0].attributes.url", is("USER")));
+  }
+}

src/main/java/com/faforever/api/config/FafApiProperties.java

@@ -137,6 +137,7 @@ public static class Avatar {
   @Data
   public static class FeaturedMod {
     private String fileUrlFormat;
+    private String cloudflareHmacSecret;
   }
 
   @Data

src/main/java/com/faforever/api/featuredmods/FeaturedModFileEnricher.java

@@ -3,12 +3,24 @@
 import com.faforever.api.config.FafApiProperties;
 import org.springframework.stereotype.Component;
 
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
 import javax.inject.Inject;
 import javax.persistence.PostLoad;
+import javax.ws.rs.core.UriBuilder;
+import java.net.URI;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.time.Instant;
+import java.util.Base64;
 
 @Component
 public class FeaturedModFileEnricher {
 
+  private static final String HMAC_SHA256 = "HmacSHA256";
+
   private static FafApiProperties fafApiProperties;
 
   @Inject
@@ -17,10 +29,22 @@ public void init(FafApiProperties fafApiProperties) {
   }
 
   @PostLoad
-  public void enhance(FeaturedModFile featuredModFile) {
+  public void enhance(FeaturedModFile featuredModFile) throws NoSuchAlgorithmException, InvalidKeyException {
     String folder = featuredModFile.getFolderName();
     String urlFormat = fafApiProperties.getFeaturedMod().getFileUrlFormat();
+    String secret = fafApiProperties.getFeaturedMod().getCloudflareHmacSecret();
+    long timeStamp = Instant.now().getEpochSecond();
+    URI featuredModUri = URI.create(String.format(urlFormat, folder, featuredModFile.getOriginalFileName()));
+
+    // Builds hmac token for cloudflare firewall verification as specified at
+    // https://support.cloudflare.com/hc/en-us/articles/115001376488-Configuring-Token-Authentication
+    Mac mac = Mac.getInstance(HMAC_SHA256);
+    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), HMAC_SHA256));
+    byte[] macMessage = (featuredModUri.getPath() + timeStamp).getBytes(StandardCharsets.UTF_8);
+
+    String hmacEncoded = URLEncoder.encode(new String(Base64.getEncoder().encode(mac.doFinal(macMessage)), StandardCharsets.UTF_8), StandardCharsets.UTF_8);
+    String parameter = "%d-%s".formatted(timeStamp, hmacEncoded);
 
-    featuredModFile.setUrl(String.format(urlFormat, folder, featuredModFile.getOriginalFileName()));
+    featuredModFile.setUrl(UriBuilder.fromUri(featuredModUri).queryParam("verify", parameter).build().toString());
   }
 }

src/main/resources/config/application-local.yml

@@ -21,7 +21,8 @@ faf-api:
     target-directory: ${AVATAR_TARGET_DIRECTORY:build/cache/avatars}
     allowed-extensions: ${AVATAR_ALLOWED_FILE_EXTENSIONS:png}
   featured-mod:
-    file-url-format: ${FEATURED_MOD_URL_FORMAT:https://content.test.faforever.com/faf/updaterNew/%s/%s}
+    file-url-format: ${FEATURED_MOD_URL_FORMAT:https://localhost/legacy-featured-mod-files/%s/%s}
+    cloudflare-hmac-secret: ${CLOUDFLARE_HMAC_SECRET:banana}
   git-hub:
     deployment-environment: ${GITHUB_DEPLOYMENT_ENVIRONMENT:development}
   deployment:

src/main/resources/config/application.yml

@@ -25,6 +25,7 @@ faf-api:
     forged-alliance-develop-exe-path: ${EXE_UPLOAD_DEVELOP_PATH:/content/legacy-featured-mod-files/updates_fafdevelop_files}
   featured-mod:
     file-url-format: ${FEATURED_MOD_URL_FORMAT:https://content.${FAF_DOMAIN}/legacy-featured-mod-files/%s/%s}
+    cloudflare-hmac-secret: ${CLOUDFLARE_HMAC_SECRET}
   git-hub:
     access-token: ${GITHUB_ACCESS_TOKEN:false}
     webhook-secret: ${GITHUB_WEBHOOK_SECRET:false}