Add SecurityUtils to extract client ID from JWT and update project creation to use authenticated client

Author: angelmp01

api-project/src/main/java/org/opendevstack/apiservice/project/controller/ProjectController.java

@@ -7,6 +7,7 @@
 import org.opendevstack.apiservice.project.facade.ProjectsFacade;
 import org.opendevstack.apiservice.project.model.CreateProjectRequest;
 import org.opendevstack.apiservice.project.model.CreateProjectResponse;
+import org.opendevstack.apiservice.project.util.SecurityUtils;
 import org.opendevstack.apiservice.project.validation.ProjectRequestValidator;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -37,15 +38,16 @@ public class ProjectController implements ProjectsApi {
     @Override
     public ResponseEntity<CreateProjectResponse> createProject(@Valid @RequestBody CreateProjectRequest createProjectRequest) {
         projectRequestValidator.validate(createProjectRequest);
-        UUID clientId = UUID.fromString("00000000-0000-0000-0000-000000000001");
+        UUID clientId = SecurityUtils.getClientId();
+
         CreateProjectResponse projectResponse = projectsFacade.createProject(createProjectRequest, clientId);
         projectResponse.setLocation(API_BASE_PATH + "/" + projectResponse.getProjectKey());
         return ResponseEntity
                 .status(HttpStatus.OK)
                 .header(HTTP_HEADER_LOCATION, API_BASE_PATH)
                 .body(projectResponse);
     }
-    
+
     @GetMapping("/{projectKey}")
     @Override
     public ResponseEntity<CreateProjectResponse> getProject(@PathVariable String projectKey) {

api-project/src/main/java/org/opendevstack/apiservice/project/util/SecurityUtils.java

@@ -0,0 +1,27 @@
+package org.opendevstack.apiservice.project.util;
+
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.server.resource.InvalidBearerTokenException;
+
+import java.util.UUID;
+
+public class SecurityUtils {
+
+    private SecurityUtils() {
+        // to avoid instantiation
+    }
+
+    public static UUID getClientId() {
+        String appId = null;
+        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
+
+        if (principal instanceof Jwt) {
+            appId = ((Jwt) principal).getClaimAsString("appid");
+        } else {
+            throw new InvalidBearerTokenException("Invalid authentication token: " + principal.getClass().getName());
+        }
+
+        return UUID.fromString(appId);
+    }
+}

api-project/src/test/java/org/opendevstack/apiservice/project/controller/ProjectControllerTest.java

@@ -11,14 +11,17 @@
 import org.opendevstack.apiservice.project.validation.ProjectRequestValidator;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
+
+import java.util.UUID;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-import java.util.UUID;
-
 class ProjectControllerTest {
 
     @Mock
@@ -34,6 +37,14 @@ class ProjectControllerTest {
     void setup() {
         mocks = MockitoAnnotations.openMocks(this);
         sut = new ProjectController(projectsFacade, projectRequestValidator);
+
+        Jwt jwtToken = Jwt.withTokenValue("dummy-token")
+                .claim("appid", UUID.randomUUID().toString())
+                .claim("sub", "test-user")
+                .header("alg", "none")
+                .build();
+        JwtAuthenticationToken authentication = new JwtAuthenticationToken(jwtToken);
+        SecurityContextHolder.getContext().setAuthentication(authentication);
     }
 
     @AfterEach