Merge pull request #6 from hongwei1/develop

UK Open Banking v4.0.1 consent flow

Author: simonredfern

application properties.example

@@ -1,7 +1,8 @@
 server.port=8087
-oauth2.public_url=https://oauth2.openbankproject.com/hydra-public
+oauth2.public_url=https://oauth2.openbankproject.com/obp-oidc
 obp.base_url=https://apisandbox.openbankproject.com
 endpoint.path.prefix=${obp.base_url}/open-banking/v3.1
+endpoint.path.prefix.v401=${obp.base_url}/open-banking/v4.0.1/aisp
 
 logging.level.com.openbankproject=DEBUG
 
@@ -22,6 +23,7 @@ logo.bank.url=https://static.openbankproject.com/images/obp_logo.png
 ### insert oauth2-related keys from API consumer registration below ###
 
 oauth2.client_id=taewei3sidooshoaquaisie2ohng8seepieLahna
+oauth2.client_secret=imras3cgsjwplcjdcnmj0abkx1nxqlnbyawvwx3e
 oauth2.redirect_uri=https://hola.openbankproject.com/main.html
 oauth2.client_scope=ReadAccountsBasic,\
 ReadAccountsDetail,\
@@ -32,7 +34,3 @@ ReadTransactionsDetail,\
 ReadAccountsBerlinGroup,\
 ReadBalancesBerlinGroup,\
 ReadTransactionsBerlinGroup
-
-oauth2.jws_alg=ES256
-oauth2.jwk_private_key={"kty":"EC","d":"Aepaewaibisoo8deevae1Zaeni2ahwee6ne3Aik0ahX","use":"sig","crv":"P-256","kid":"39087g94-2b67-1ab4-124e-157ae7f2c078","x":"b9HEBe415JME8W_rPwAq1Ume_tBbohy2XSXda9Mqoe4","y":"ieSahSh2cheereeF0zix4EeB-kohx9Ieb6mah8obeid","alg":"ES256"}
-

application.properties.docker

@@ -1,8 +1,8 @@
 server.port=${SERVER_PORT}
-oauth2.provider=${OAUTH2_PROVIDER:obp-oidc}
 oauth2.public_url=${OAUTH_2_PUBLIC_URL}
 obp.base_url=${OBP_BASE_URL}
 endpoint.path.prefix=${OBP_BASE_URL}/open-banking/v3.1
+endpoint.path.prefix.v401=${OBP_BASE_URL}/open-banking/v4.0.1/aisp
 
 mtls.keyStore.path=file:///keystore/keystore.jks
 mtls.keyStore.password=${KEYSTORE_PASSWD}
@@ -21,8 +21,6 @@ oauth2.client_secret=$(OAUTH2_CLIENT_SECRET)
 oauth2.client_id=${OAUTH2_CLIENT_ID}
 oauth2.redirect_uri=${OAUTH2_REDIRECT_URI}
 oauth2.client_scope=${OAUTH2_CLIENT_SCOPE}
-#oauth2.jws_alg=${OAUTH2_JWS_ALG}
-#oauth2.jwk_private_key=${OAUTH2_JWK_PRIVATE_KEY}
 
 spring.redis.database=${SPRING_REDIS_DATABASE:}
 spring.redis.host=${SPRING_REDIS_HOST}

src/main/java/com/openbankproject/hydra/auth/HydraConfig.java

@@ -4,18 +4,15 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.client.RestTemplate;
 
 import javax.annotation.PostConstruct;
 import javax.annotation.Resource;
-import java.util.Map;
 
 @Configuration
-@ConditionalOnProperty(name = "oauth2.provider", havingValue = "obp-oidc", matchIfMissing = true)
-public class ObpOidcConfig implements OIDCProvider {
+public class ObpOidcConfig {
     Logger log = LoggerFactory.getLogger(ObpOidcConfig.class);
 
     @Value("${oauth2.public_url:http://localhost:9000/obp-oidc}/.well-known/openid-configuration")
@@ -36,22 +33,4 @@ private void initiate() {
     public WellKnown openIDConfiguration() {
         return this.openIDConfiguration;
     }
-
-    /**
-     * OBP-OIDC uses client_secret authentication, not private_key_jwt.
-     */
-    @Override
-    public boolean isPublicClient() {
-        return false;
-    }
-
-    @Override
-    public String buildClientAssertion() {
-        throw new UnsupportedOperationException("OBP-OIDC does not support private_key_jwt client assertions");
-    }
-
-    @Override
-    public String buildRequestObject(Map<String, String> queryParam) {
-        throw new UnsupportedOperationException("OBP-OIDC does not support signed request objects");
-    }
 }

src/main/java/com/openbankproject/hydra/auth/OIDCProvider.java

@@ -0,0 +1,64 @@
+package com.openbankproject.hydra.auth.controller;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.MissingServletRequestParameterException;
+import org.springframework.web.bind.UnsatisfiedServletRequestParameterException;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+
+/**
+ * Without this, a request that fails Spring's @PostMapping(params=...) matching
+ * (e.g. a consent form submitted with no permission checkbox selected) never reaches
+ * a controller method, so none of the per-endpoint try/catch blocks in IndexController
+ * run. It falls through to the default error view with a blank message instead.
+ */
+@ControllerAdvice
+public class GlobalExceptionHandler {
+    private static final Logger logger = LoggerFactory.getLogger(GlobalExceptionHandler.class);
+
+    @Value("${obp.base_url:#}")
+    private String obpBaseUrl;
+    @Value("${logo.bank.enabled:false}")
+    private String showBankLogo;
+    @Value("${logo.bank.url:#}")
+    private String bankLogoUrl;
+    @Value("${show_unhandled_errors:false}")
+    private boolean showUnhandledErrors;
+
+    @ExceptionHandler(UnsatisfiedServletRequestParameterException.class)
+    public String handleUnsatisfiedServletRequestParameter(UnsatisfiedServletRequestParameterException e, Model model) {
+        logger.warn("Form submission rejected: {}", e.getMessage());
+        addCommonAttributes(model);
+        model.addAttribute("errorMsg", "The form is missing one or more required fields (" + e.getMessage()
+                + "). If this form has permission checkboxes, make sure at least one is selected before submitting.");
+        return "error";
+    }
+
+    @ExceptionHandler(MissingServletRequestParameterException.class)
+    public String handleMissingServletRequestParameter(MissingServletRequestParameterException e, Model model) {
+        logger.warn("Form submission rejected: {}", e.getMessage());
+        addCommonAttributes(model);
+        model.addAttribute("errorMsg", "The form is missing a required field: " + e.getParameterName() + ".");
+        return "error";
+    }
+
+    // Catches anything a controller method itself doesn't try/catch (this class's other handlers
+    // above take precedence for their specific exception types). Same showUnhandledErrors
+    // convention IndexController's own per-endpoint catch-all blocks use.
+    @ExceptionHandler(Exception.class)
+    public String handleUnhandled(Exception e, Model model) {
+        logger.error("Unhandled exception reached GlobalExceptionHandler", e);
+        addCommonAttributes(model);
+        model.addAttribute("errorMsg", showUnhandledErrors ? e.toString() : "Internal Server Error");
+        return "error";
+    }
+
+    private void addCommonAttributes(Model model) {
+        model.addAttribute("obpBaseUrl", obpBaseUrl);
+        model.addAttribute("showBankLogo", showBankLogo);
+        model.addAttribute("bankLogoUrl", bankLogoUrl);
+    }
+}