AccessBoundaryUtils { public static AccessToken addAccessBoundary(AccessToken accessToken, String target) { if (target == null || target.isEmpty()) { return accessToken; } JsonArray permissionsJSON = new JsonArray(); List<String> permissions = AppSettings.getInstance().getStringList(AppSettings.ACCESS_TOKEN_BOUNDARY_PERMISSIONS); for (String permission: permissions) { permissionsJSON.add(permission); } Gson gson = new Gson(); JsonObject accessBoundaryRule = new JsonObject(); accessBoundaryRule.addProperty("availableResource", target); accessBoundaryRule.add("availablePermissions", permissionsJSON); JsonArray accessBoundaryRules = new JsonArray(); accessBoundaryRules.add(accessBoundaryRule); JsonObject accessBoundary = new JsonObject(); accessBoundary.add("accessBoundaryRules", accessBoundaryRules); String encodedAccessBoundary; try { encodedAccessBoundary = URLEncoder.encode(gson.toJson(accessBoundary), StandardCharsets.UTF_8.toString()); } catch (UnsupportedEncodingException e) { throw new RuntimeException(e); } CloseableHttpClient httpClient = HttpClients.createDefault(); HttpPost httpPost = new HttpPost("https: httpPost.setHeader("Content-type", "application/json"); Map<String, String> requestBody = new HashMap<>(); requestBody.put("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange"); requestBody.put("subject_token_type", "urn:ietf:params:oauth:token-type:access_token"); requestBody.put("requested_token_type", "urn:ietf:params:oauth:token-type:access_token"); requestBody.put("subject_token", accessToken.getValue()); requestBody.put("access_boundary", encodedAccessBoundary); try { httpPost.setEntity(new StringEntity(gson.toJson(requestBody))); } catch (UnsupportedEncodingException e) { throw new RuntimeException(e); } BoundedAccessTokenResponse accessTokenResponse; try { CloseableHttpResponse response = httpClient.execute(httpPost); if (response.getStatusLine().getStatusCode() != 200) { throw Status.PERMISSION_DENIED.asRuntimeException(); } accessTokenResponse = gson.fromJson(EntityUtils.toString(response.getEntity()), BoundedAccessTokenResponse.class); httpClient.close(); } catch (IOException e) { throw new RuntimeException(e); } return new AccessToken(accessTokenResponse.access_token, accessTokenResponse.expires_in); }  static AccessToken addAccessBoundary(AccessToken accessToken, String target);  }
@Test public void testTargetNull() throws IOException { GoogleCredentials credentials = CloudStorageUtils.getCloudStorageCredentials(); com.google.auth.oauth2.AccessToken rawAccessToken = credentials.refreshAccessToken(); AccessToken accessToken = new AccessToken(rawAccessToken.getTokenValue(), rawAccessToken.getExpirationTime().getTime()); AccessToken boundedToken = AccessBoundaryUtils.addAccessBoundary(accessToken, null); assertEquals(boundedToken.getValue(), rawAccessToken.getTokenValue()); assertEquals(boundedToken.getExpiresAt(), rawAccessToken.getExpirationTime().getTime()); }
@Test public void testTargetEmptyString() throws IOException { GoogleCredentials credentials = CloudStorageUtils.getCloudStorageCredentials(); com.google.auth.oauth2.AccessToken rawAccessToken = credentials.refreshAccessToken(); AccessToken accessToken = new AccessToken(rawAccessToken.getTokenValue(), rawAccessToken.getExpirationTime().getTime()); AccessToken boundedToken = AccessBoundaryUtils.addAccessBoundary(accessToken, ""); assertEquals(boundedToken.getValue(), rawAccessToken.getTokenValue()); assertEquals(boundedToken.getExpiresAt(), rawAccessToken.getExpirationTime().getTime()); }
@Test public void testBoundary() throws IOException { GoogleCredentials credentials = CloudStorageUtils.getCloudStorageCredentials(); com.google.auth.oauth2.AccessToken rawAccessToken = credentials.refreshAccessToken(); AccessToken accessToken = new AccessToken(rawAccessToken.getTokenValue(), rawAccessToken.getExpirationTime().getTime()); AccessToken boundedToken = AccessBoundaryUtils.addAccessBoundary(accessToken, MOCK_BUCKET); assertNotEquals(boundedToken.getValue(), rawAccessToken.getTokenValue()); assertNotEquals(boundedToken.getExpiresAt(), rawAccessToken.getExpirationTime().getTime()); }