RefreshTokenGrantHandler { public TokenResponseEntity handle(final Client client, final String scope, final String state, final BigInteger refreshId) { ClientType type = client.getType(); if (!type.equals(ClientType.OwnerCredentials) && !type.equals(ClientType.AuthorizationGrant)) { throw new InvalidGrantException(); } if (refreshId == null) { throw new InvalidGrantException(); } OAuthToken refreshToken = session.get(OAuthToken.class, refreshId); if (refreshToken == null || !refreshToken.getTokenType() .equals(OAuthTokenType.Refresh)) { throw new InvalidGrantException(); } if (refreshToken.isExpired()) { throw new InvalidGrantException(); } SortedMap<String, ApplicationScope> requestedScopes = ValidationUtil.revalidateScope( scope, refreshToken.getScopes(), refreshToken.getIdentity().getUser().getRole() ); OAuthToken newAuthToken = new OAuthToken(); newAuthToken.setClient(client); newAuthToken.setTokenType(OAuthTokenType.Bearer); newAuthToken.setExpiresIn(client.getAccessTokenExpireIn()); newAuthToken.setScopes(requestedScopes); newAuthToken.setIdentity(refreshToken.getIdentity()); newAuthToken.setIssuer(refreshToken.getIssuer()); OAuthToken newRefreshToken = new OAuthToken(); newRefreshToken.setClient(client); newRefreshToken.setTokenType(OAuthTokenType.Refresh); newRefreshToken.setExpiresIn(client.getRefreshTokenExpireIn()); newRefreshToken.setScopes(requestedScopes); newRefreshToken.setIdentity(refreshToken.getIdentity()); newRefreshToken.setAuthToken(newAuthToken); newRefreshToken.setIssuer(refreshToken.getIssuer()); session.save(newAuthToken); session.save(newRefreshToken); if (refreshToken.getAuthToken() != null) { session.delete(refreshToken.getAuthToken()); } session.delete(refreshToken); return TokenResponseEntity.factory(newAuthToken, newRefreshToken, state); } @Inject  RefreshTokenGrantHandler(final Session session); TokenResponseEntity handle(final Client client,
                                      final String scope,
                                      final String state,
                                      final BigInteger refreshId);  }
@Test public void testValidAuthorizationGrant() { Client authClient = authGrantContext.getClient(); OAuthToken refreshToken = authGrantContext.getBuilder() .bearerToken("debug") .refreshToken() .build() .getToken(); TokenResponseEntity token = handler.handle(authClient, "debug", null, refreshToken.getId()); assertEquals(OAuthTokenType.Bearer, token.getTokenType()); assertEquals((long) ClientConfig.ACCESS_TOKEN_EXPIRES_DEFAULT, (long) token.getExpiresIn()); assertNotNull(token.getAccessToken()); assertNotNull(token.getRefreshToken()); assertEquals("debug", token.getScope()); OAuthToken newRefresh = getSession().get(OAuthToken.class, token.getRefreshToken()); assertEquals((long) ClientConfig.REFRESH_TOKEN_EXPIRES_DEFAULT, newRefresh.getExpiresIn().longValue()); assertEquals(OAuthTokenType.Refresh, newRefresh.getTokenType()); assertEquals(token.getAccessToken(), newRefresh.getAuthToken().getId()); assertNull(getSession().get(OAuthToken.class, refreshToken.getAuthToken().getId())); assertNull(getSession().get(OAuthToken.class, refreshToken.getId())); }
@Test public void testValidOwnerCredentials() { Client authClient = ownerCredsContext.getClient(); OAuthToken refreshToken = ownerCredsContext.getBuilder() .bearerToken("debug") .refreshToken() .build() .getToken(); TokenResponseEntity token = handler.handle(authClient, "debug", null, refreshToken.getId()); assertEquals(OAuthTokenType.Bearer, token.getTokenType()); assertEquals((long) ClientConfig.ACCESS_TOKEN_EXPIRES_DEFAULT, (long) token.getExpiresIn()); assertNotNull(token.getAccessToken()); assertNotNull(token.getRefreshToken()); assertEquals("debug", token.getScope()); OAuthToken newRefresh = getSession().get(OAuthToken.class, token.getRefreshToken()); assertEquals((long) ClientConfig.REFRESH_TOKEN_EXPIRES_DEFAULT, newRefresh.getExpiresIn().longValue()); assertEquals(OAuthTokenType.Refresh, newRefresh.getTokenType()); assertEquals(token.getAccessToken(), newRefresh.getAuthToken().getId()); assertNull(getSession().get(OAuthToken.class, refreshToken.getAuthToken().getId())); assertNull(getSession().get(OAuthToken.class, refreshToken.getId())); }
@Test(expected = InvalidGrantException.class) public void testInvalidClientType() { Client authClient = implicitContext.getClient(); OAuthToken refreshToken = implicitContext.getBuilder() .bearerToken("debug") .refreshToken() .build() .getToken(); handler.handle(authClient, "debug", null, refreshToken.getId()); }
@Test(expected = InvalidGrantException.class) public void testInvalidRefreshToken() { Client authClient = authGrantContext.getClient(); handler.handle(authClient, "debug", null, IdUtil.next()); }
@Test(expected = InvalidGrantException.class) public void testNullRefreshToken() { Client authClient = authGrantContext.getClient(); handler.handle(authClient, "debug", null, null); }
@Test(expected = InvalidGrantException.class) public void testNotARefreshToken() { Client authClient = authGrantContext.getClient(); OAuthToken authToken = authGrantContext.getBuilder() .bearerToken() .build() .getToken(); handler.handle(authClient, "debug", null, authToken.getId()); }
@Test(expected = InvalidGrantException.class) public void testExpiredToken() { Client authClient = ownerCredsContext.getClient(); OAuthToken refreshToken = ownerCredsContext.getBuilder() .bearerToken() .token(OAuthTokenType.Refresh, true, "debug", null, null) .build() .getToken(); handler.handle(authClient, "debug", null, refreshToken.getId()); }
@Test(expected = InvalidScopeException.class) public void testInvalidScope() { Client authClient = authGrantContext.getClient(); OAuthToken refreshToken = authGrantContext.getBuilder() .bearerToken() .refreshToken() .build() .getToken(); handler.handle(authClient, "debug invalid", null, refreshToken.getId()); }
@Test(expected = InvalidScopeException.class) public void testEscalateScope() { Client authClient = authGrantContext.getClient(); OAuthToken refreshToken = authGrantContext.getBuilder() .bearerToken("debug") .refreshToken() .build() .getToken(); handler.handle(authClient, "debug debug1", null, refreshToken.getId()); }
@Test public void testDeescalateScope() { Client authClient = authGrantContext.getClient(); OAuthToken refreshToken = authGrantContext.getBuilder() .bearerToken("debug") .refreshToken() .build() .getToken(); TokenResponseEntity token = handler.handle(authClient, "", null, refreshToken.getId()); assertEquals(OAuthTokenType.Bearer, token.getTokenType()); assertEquals((long) ClientConfig.ACCESS_TOKEN_EXPIRES_DEFAULT, (long) token.getExpiresIn()); assertNotNull(token.getAccessToken()); assertNotNull(token.getRefreshToken()); assertNull(token.getScope()); OAuthToken newRefresh = getSession().get(OAuthToken.class, token.getRefreshToken()); assertEquals((long) ClientConfig.REFRESH_TOKEN_EXPIRES_DEFAULT, newRefresh.getExpiresIn().longValue()); assertEquals(OAuthTokenType.Refresh, newRefresh.getTokenType()); assertEquals(token.getAccessToken(), newRefresh.getAuthToken().getId()); assertNull(getSession().get(OAuthToken.class, refreshToken.getAuthToken().getId())); assertNull(getSession().get(OAuthToken.class, refreshToken.getId())); }
@Test public void testZombieRefresh() { Client authClient = authGrantContext.getClient(); OAuthToken refreshToken = authGrantContext.getBuilder() .token(OAuthTokenType.Refresh, false, "debug", null, null) .build() .getToken(); TokenResponseEntity token = handler.handle(authClient, "", null, refreshToken.getId()); assertEquals(OAuthTokenType.Bearer, token.getTokenType()); assertEquals((long) ClientConfig.ACCESS_TOKEN_EXPIRES_DEFAULT, (long) token.getExpiresIn()); assertNotNull(token.getAccessToken()); assertNotNull(token.getRefreshToken()); assertNull(token.getScope()); OAuthToken newRefresh = getSession().get(OAuthToken.class, token.getRefreshToken()); assertEquals((long) ClientConfig.REFRESH_TOKEN_EXPIRES_DEFAULT, newRefresh.getExpiresIn().longValue()); assertEquals(OAuthTokenType.Refresh, newRefresh.getTokenType()); assertEquals(token.getAccessToken(), newRefresh.getAuthToken().getId()); assertNull(getSession().get(OAuthToken.class, refreshToken.getId())); }