remove generic soft-delete implementation from all tables

Author: ashutoshgngwr

src/integrationTest/java/com/trynoice/api/identity/AccountControllerTest.java

@@ -2,6 +2,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.trynoice.api.identity.entities.AuthUser;
+import com.trynoice.api.identity.entities.RefreshToken;
 import com.trynoice.api.identity.exceptions.SignInTokenDispatchException;
 import com.trynoice.api.identity.payload.AuthCredentialsResponse;
 import com.trynoice.api.identity.payload.SignInParams;
@@ -40,7 +41,6 @@
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.params.provider.Arguments.arguments;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
@@ -357,7 +357,7 @@ void deleteAccount() throws Exception {
             .andExpect(status().is(HttpStatus.NO_CONTENT.value()));
 
         // validate that all existing refresh tokens have been revoked.
-        assertTrue(refreshTokens.stream().noneMatch(t -> t.getDeletedAt() != null));
+        refreshTokens.forEach(t -> assertNull(entityManager.find(RefreshToken.class, t.getId())));
 
         // perform the request again to ensure access token no longer works
         mockMvc.perform(

src/integrationTest/java/com/trynoice/api/platform/BasicEntityRepositoryTest.java

@@ -66,11 +66,13 @@ public static Subscription buildSubscription(
 
     @NonNull
     static Customer buildCustomer(@NonNull EntityManager entityManager, @NonNull AuthUser user) {
-        val customer = Customer.builder()
-            .userId(user.getId())
-            .stripeId(UUID.randomUUID().toString())
-            .build();
+        val customer = Optional.ofNullable(entityManager.find(Customer.class, user.getId()))
+            .orElse(
+                Customer.builder()
+                    .userId(user.getId())
+                    .build());
 
+        customer.setStripeId(UUID.randomUUID().toString());
         return entityManager.merge(customer);
     }
 

src/integrationTest/java/com/trynoice/api/platform/TestConfig.java

@@ -92,20 +92,18 @@ public static String createSignedRefreshJwt(
 
         val jwtSigningAlgorithm = Algorithm.HMAC256(hmacSecret);
         if (type != JwtType.REUSED) {
-            return refreshToken.getJwt(jwtSigningAlgorithm);
+            return refreshToken.toSignedJwt(jwtSigningAlgorithm);
         }
 
         // create a separate entity that is not attached to the entity manager.
-        val usedRefreshToken = RefreshToken.builder()
+        return RefreshToken.builder()
+            .id(refreshToken.getId())
+            .createdAt(refreshToken.getCreatedAt())
             .owner(owner)
             .expiresAt(refreshToken.getExpiresAt())
             .ordinal(refreshToken.getOrdinal() + 1)
-            .build();
-
-        usedRefreshToken.setId(refreshToken.getId());
-        usedRefreshToken.setCreatedAt(refreshToken.getCreatedAt());
-
-        return usedRefreshToken.getJwt(jwtSigningAlgorithm);
+            .build()
+            .toSignedJwt(jwtSigningAlgorithm);
     }
 
     /**

src/integrationTest/java/com/trynoice/api/platform/TestEntity.java

@@ -144,7 +144,7 @@ private String createSignInToken(@NonNull AuthUser authUser) throws TooManySignI
                     .owner(authUser)
                     .expiresAt(OffsetDateTime.now().plus(authConfig.getSignInTokenExpiry()))
                     .build())
-            .getJwt(jwtAlgorithm);
+            .toSignedJwt(jwtAlgorithm);
     }
 
     /**
@@ -158,7 +158,8 @@ private String createSignInToken(@NonNull AuthUser authUser) throws TooManySignI
     @Transactional(rollbackFor = Throwable.class)
     public void signOut(@NonNull String refreshJwt, @NonNull String accessJwt) throws RefreshTokenVerificationException {
         val refreshToken = verifyRefreshJWT(refreshJwt);
-        refreshTokenRepository.delete(refreshToken);
+        refreshToken.setExpiresAt(OffsetDateTime.now());
+        refreshTokenRepository.save(refreshToken);
         revokedAccessJwtCache.put(accessJwt, Boolean.TRUE);
     }
 
@@ -175,29 +176,29 @@ public void signOut(@NonNull String refreshJwt, @NonNull String accessJwt) throw
     @Transactional(rollbackFor = Throwable.class, noRollbackFor = RefreshTokenVerificationException.class)
     public AuthCredentialsResponse issueAuthCredentials(@NonNull String refreshToken, String userAgent) throws RefreshTokenVerificationException {
         var token = verifyRefreshJWT(refreshToken);
+        val owner = token.getOwner();
+        owner.updateLastActiveTimestamp(); // update last active timestamp for the user and save.
 
         // ordinal 0 implies that this refresh token is being used to sign in, so persist userAgent
         // and reset sign-in attempts.
         if (Long.valueOf(0).equals(token.getOrdinal())) {
             token.setUserAgent(requireNonNullElse(userAgent, ""));
-            token.getOwner().resetSignInAttemptData();
+            owner.resetSignInAttemptData();
         }
 
-        // saving AuthUser entity implicitly updates last active timestamp, so always perform the
-        // save step regardless of the token ordinal value.
-        authUserRepository.save(token.getOwner());
+        authUserRepository.save(owner);
         token.setExpiresAt(OffsetDateTime.now().plus(authConfig.getRefreshTokenExpiry()));
         token.incrementOrdinal();
         token = refreshTokenRepository.save(token);
 
         val accessTokenExpiry = OffsetDateTime.now().plus(authConfig.getAccessTokenExpiry());
         val signedAccessToken = JWT.create()
-            .withSubject("" + token.getOwner().getId())
+            .withSubject("" + owner.getId())
             .withExpiresAt(Date.from(accessTokenExpiry.toInstant()))
             .sign(jwtAlgorithm);
 
         return AuthCredentialsResponse.builder()
-            .refreshToken(token.getJwt(jwtAlgorithm))
+            .refreshToken(token.toSignedJwt(jwtAlgorithm))
             .accessToken(signedAccessToken)
             .build();
     }
@@ -216,10 +217,17 @@ private RefreshToken verifyRefreshJWT(@NonNull String jwt) throws RefreshTokenVe
         val token = refreshTokenRepository.findById(jwtId)
             .orElseThrow(() -> new RefreshTokenVerificationException("refresh token doesn't exist in database"));
 
+        // an edge case could be that we revoked the token in the database, but the client didn't
+        // receive the updated JWT. Currently, it happens when the token ordinals don't match.
+        if (token.getExpiresAt().isBefore(OffsetDateTime.now())) {
+            throw new RefreshTokenVerificationException("refresh token has expired");
+        }
+
         // if token ordinal is different, it implies that an old refresh token is being re-used.
         // delete token on re-use to effectively sign out both the legitimate user and the attacker.
         if (token.getOrdinal() != jwtOrdinal) {
-            refreshTokenRepository.delete(token);
+            token.setExpiresAt(OffsetDateTime.now());
+            refreshTokenRepository.save(token);
             throw new RefreshTokenVerificationException("refresh token ordinal mismatch");
         }