Merge pull request #7 from helioauth/feature/rpid-from-application

Read relying party config from application (re-trigger)

Author: vstanchev

.gitignore

@@ -1,4 +1,5 @@
 HELP.md
+TODO.md
 target/
 !.mvn/wrapper/maven-wrapper.jar
 !**/src/main/**/target/
@@ -31,3 +32,4 @@ build/
 
 ### VS Code ###
 .vscode/
+.aider*

docs/openapi/components/schemas/AddApplicationRequest.yaml

@@ -1,6 +1,9 @@
 type: object
-description: Request to add a new client application. Contains the name of the application.
+description: Request to add a new client application
 properties:
   name:
     type: string
     description: Name of the new application.
+  relyingPartyHostname:
+    type: string
+    description: Hostname of the application, e.g. example.com

docs/openapi/components/schemas/Application.yaml

@@ -16,3 +16,6 @@ properties:
     type: string
     format: date-time
     description: Timestamp when the application was last updated.
+  relyingPartyHostname:
+    type: string
+    description: Hostname of the relying party.

docs/openapi/components/schemas/EditApplicationRequest.yaml

@@ -0,0 +1,9 @@
+type: object
+description: Represents a request to edit an application.
+properties:
+  name:
+    type: string
+    description: Name of the application.
+  relyingPartyHostname:
+    type: string
+    description: Hostname of the relying party.

docs/openapi/paths/admin_v1_apps_id.yaml

@@ -41,7 +41,7 @@ put:
     content:
       application/json:
         schema:
-          type: string
+          $ref: ../components/schemas/EditApplicationRequest.yaml
     required: true
   responses:
     '200':

src/main/java/com/helioauth/passkeys/api/auth/ApplicationApiKeyAuthenticationProvider.java

@@ -47,8 +47,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
             .orElseThrow(() -> new BadCredentialsException("Invalid api key"));
 
         PreAuthenticatedAuthenticationToken authenticatedToken = new PreAuthenticatedAuthenticationToken(
-            clientApp.getId(),
             clientApp,
+            clientApp.getApiKey(),
             List.of(new SimpleGrantedAuthority("ROLE_APPLICATION"))
         );
         authenticatedToken.setDetails(clientApp);

src/main/java/com/helioauth/passkeys/api/auth/ApplicationIdAuthenticationProvider.java

@@ -50,8 +50,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
                 .orElseThrow(() -> new BadCredentialsException("Invalid application ID"));
 
             PreAuthenticatedAuthenticationToken authenticatedToken = new PreAuthenticatedAuthenticationToken(
-                clientApp.getId(),
                 clientApp,
+                clientApp.getId(),
                 List.of(new SimpleGrantedAuthority("ROLE_FRONTEND_APPLICATION"))
             );
             authenticatedToken.setDetails(clientApp);

src/main/java/com/helioauth/passkeys/api/config/WebSecurityConfig.java

@@ -39,6 +39,7 @@
 import jakarta.servlet.http.HttpServletResponse;
 import java.util.List;
 
+
 /**
  * @author Viktor Stanchev
  */

src/main/java/com/helioauth/passkeys/api/controller/ClientApplicationController.java

@@ -20,7 +20,10 @@
 import com.helioauth.passkeys.api.generated.models.AddApplicationRequest;
 import com.helioauth.passkeys.api.generated.models.Application;
 import com.helioauth.passkeys.api.generated.models.ApplicationApiKey;
+import com.helioauth.passkeys.api.generated.models.EditApplicationRequest;
 import com.helioauth.passkeys.api.service.ClientApplicationService;
+
+import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import lombok.val;
 import org.springframework.http.ResponseEntity;
@@ -39,9 +42,9 @@
 @RequiredArgsConstructor
 public class ClientApplicationController implements ApplicationsApi {
 
-    private final ClientApplicationService clientApplicationService;
+ private final ClientApplicationService clientApplicationService;
 
-    public ResponseEntity<List<Application>> listAll() {
+ public ResponseEntity<List<Application>> listAll() {
         return ResponseEntity.ok(clientApplicationService.listAll());
     }
 
@@ -58,14 +61,14 @@ public ResponseEntity<ApplicationApiKey> getApiKey(@PathVariable UUID id) {
     }
 
     public ResponseEntity<Application> add(@RequestBody AddApplicationRequest request) {
-        Application created = clientApplicationService.add(request.getName());
+        Application created = clientApplicationService.add(request);
 
         return ResponseEntity.created(URI.create("/admin/v1/apps/" + created.getId()))
             .body(created);
     }
 
-    public ResponseEntity<Application> edit(@PathVariable UUID id, @RequestBody String name) {
-        val updated = clientApplicationService.edit(id, name);
+    public ResponseEntity<Application> edit(@PathVariable UUID id, @RequestBody @Valid EditApplicationRequest request) {
+        val updated = clientApplicationService.edit(id, request);
 
         return updated
             .map(ResponseEntity::ok)

src/main/java/com/helioauth/passkeys/api/controller/CredentialsController.java

@@ -17,6 +17,7 @@
 package com.helioauth.passkeys.api.controller;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
+import com.helioauth.passkeys.api.domain.ClientApplication;
 import com.helioauth.passkeys.api.generated.api.SignInApi;
 import com.helioauth.passkeys.api.generated.api.SignUpApi;
 import com.helioauth.passkeys.api.generated.models.SignInFinishRequest;
@@ -29,11 +30,14 @@
 import com.helioauth.passkeys.api.generated.models.SignUpStartResponse;
 import com.helioauth.passkeys.api.service.UserSignInService;
 import com.helioauth.passkeys.api.service.UserSignupService;
+import com.helioauth.passkeys.api.service.dto.UserSignupStartRequest;
 import com.helioauth.passkeys.api.service.exception.SignInFailedException;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RestController;
@@ -46,16 +50,35 @@
  */
 @Slf4j
 @RestController
-@CrossOrigin(origins = "*")
 @RequiredArgsConstructor
+@CrossOrigin(origins = "*")
 public class CredentialsController implements SignUpApi, SignInApi {
 
     private final UserSignInService userSignInService;
     private final UserSignupService userSignupService;
 
     public ResponseEntity<SignUpStartResponse> postSignupStart(@RequestBody @Valid SignUpStartRequest request) {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication == null || !(authentication.getPrincipal() instanceof ClientApplication clientApp)) {
+            log.error("Signup start request received without valid ClientApplication authentication.");
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Client application not authenticated");
+        }
+
+        String rpId = clientApp.getRelyingPartyHostname();
+        String rpName = clientApp.getRelyingPartyName();
+
+        if (rpId == null || rpId.isBlank()) {
+             log.error("Authenticated ClientApplication (ID: {}) is missing a valid relyingPartyHostname.", clientApp.getId());
+             throw new ResponseStatusException(HttpStatus.INTERNAL_SERVER_ERROR, "Client application configuration error: Missing RP hostname");
+        }
+
         return ResponseEntity.ok(
-            userSignupService.startRegistration(request.getName())
+            userSignupService.startRegistration(UserSignupStartRequest.builder()
+                .name(request.getName())
+                .rpId(rpId)
+                .rpName(rpName)
+                .build()
+            )
         );
     }
 
@@ -88,4 +111,4 @@ public ResponseEntity<SignInFinishResponse> finishSignInCredential(@RequestBody
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Sign in failed");
         }
     }
-}
+}