BSR

Author: oharsta

oidc/src/main/java/oidc/endpoints/UserInfoEndpoint.java

@@ -25,7 +25,11 @@
 
 import java.io.IOException;
 import java.time.Clock;
-import java.util.*;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.TreeMap;
 
 @RestController
 public class UserInfoEndpoint {
@@ -43,64 +47,62 @@ public UserInfoEndpoint(AccessTokenRepository accessTokenRepository, TokenGenera
     @GetMapping("oidc/userinfo")
     public ResponseEntity<Map<String, Object>> getUserInfo(HttpServletRequest request)
         throws IOException, java.text.ParseException {
-        try {
-            return userInfo(request);
-        } catch (com.nimbusds.oauth2.sdk.ParseException e) {
-            return handleMissingToken(e, request);
-        }
+        return userInfo(request);
     }
 
     @PostMapping(value = {"oidc/userinfo"}, consumes = {MediaType.APPLICATION_FORM_URLENCODED_VALUE})
     public ResponseEntity<Map<String, Object>> postUserInfo(HttpServletRequest request)
         throws IOException, java.text.ParseException {
-        try {
-            return userInfo(request);
-        } catch (com.nimbusds.oauth2.sdk.ParseException e) {
-            return handleMissingToken(e, request);
-        }
+        return userInfo(request);
     }
 
     private ResponseEntity<Map<String, Object>> handleMissingToken(com.nimbusds.oauth2.sdk.ParseException e, HttpServletRequest request) {
         LOG.warn(String.format("UserInfo request failed: %s | Path: %s | IP: %s",
             e.getMessage(), request.getRequestURI(), request.getRemoteAddr()));
 
-        Map<String, Object> body = new HashMap<>();
-        body.put("error", "invalid_request");
-        body.put("error_description", e.getMessage());
+        Map<String, Object> body = Map.of(
+            "error", "invalid_request",
+            "error_description", e.getMessage()
+        );
 
         return ResponseEntity
             .status(HttpStatus.UNAUTHORIZED)
             .header("WWW-Authenticate", "Bearer error=\"invalid_request\", error_description=\"Missing access token\"")
             .body(body);
     }
 
-    private ResponseEntity<Map<String, Object>> userInfo(HttpServletRequest request) throws ParseException, IOException, java.text.ParseException {
+    private ResponseEntity<Map<String, Object>> userInfo(HttpServletRequest request) throws IOException, java.text.ParseException {
         HTTPRequest httpRequest = JakartaServletUtils.createHTTPRequest(request);
         if (request.getMethod().equalsIgnoreCase("GET")) {
             //Otherwise the query parameters are not read by the nimbus parser
             httpRequest.setEntityContentType(null);
         }
-        UserInfoRequest userInfoRequest = UserInfoRequest.parse(httpRequest);
+        UserInfoRequest userInfoRequest;
+        try {
+            userInfoRequest = UserInfoRequest.parse(httpRequest);
+        } catch (ParseException e) {
+            return handleMissingToken(e, request);
+        }
 
         String accessTokenValue = userInfoRequest.getAccessToken().getValue();
 
         MDCContext.mdcContext("action", "Userinfo", "accessTokenValue", accessTokenValue);
         Optional<SignedJWT> optionalSignedJWT;
-        try  {
+        try {
             optionalSignedJWT = tokenGenerator.parseAndValidateSignedJWT(accessTokenValue);
         } catch (IllegalArgumentException e) {
             //Thrown when the signing key has been deleted, which only happens when all access_tokens with that key are gone
             return errorResponse("Access Token not found");
         }
 
-        if (!optionalSignedJWT.isPresent()) {
+        if (optionalSignedJWT.isEmpty()) {
             return errorResponse("Access Token not found");
         }
         SignedJWT signedJWT = optionalSignedJWT.get();
         String jwtId = signedJWT.getJWTClaimsSet().getJWTID();
         Optional<AccessToken> optionalAccessToken = accessTokenRepository.findByJwtId(jwtId);
 
-        if (!optionalAccessToken.isPresent()) {
+        if (optionalAccessToken.isEmpty()) {
             return errorResponse("Access Token not found");
         }
         AccessToken accessToken = optionalAccessToken.get();
@@ -122,7 +124,7 @@ private ResponseEntity<Map<String, Object>> userInfo(HttpServletRequest request)
         attributes.put("authenticating_authority", user.getAuthenticatingAuthority());
         attributes.put("updated_at", user.getUpdatedAt());
         attributes.put("sub", user.getSub());
-        return ResponseEntity.ok(new TreeMap(attributes));
+        return ResponseEntity.ok(new TreeMap<>(attributes));
     }
 
     private ResponseEntity<Map<String, Object>> errorResponse(String errorDescription) {

oidc/src/test/java/oidc/endpoints/UserInfoEndpointTest.java

@@ -4,6 +4,7 @@
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.core.read.ListAppender;
 import com.nimbusds.oauth2.sdk.GrantType;
+import io.restassured.common.mapper.TypeRef;
 import io.restassured.response.Response;
 import io.restassured.specification.RequestSpecification;
 import oidc.AbstractIntegrationTest;
@@ -13,6 +14,7 @@
 import org.springframework.http.HttpStatus;
 
 import java.io.IOException;
+import java.lang.reflect.Type;
 import java.text.ParseException;
 import java.util.Map;
 
@@ -33,6 +35,17 @@ public void postUserInfo() throws IOException {
         userInfo("POST");
     }
 
+    @Test
+    public void getUserInfoParseException() {
+        Map<String, Object> response = given()
+            .when()
+            .header("Content-type", "application/x-www-form-urlencoded")
+            .get("oidc/userinfo")
+                .as(new TypeRef<>() {
+                });
+        assertEquals("Missing access token", response.get("error_description"));
+    }
+
     @Test
     public void signingKeyNotFound() throws IOException {
         String accessToken = getAccessToken();