Introduce JwtEncoder

core/src/main/java/org/springframework/security/oauth2/server/authorization/jose/DefaultKeyManager.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.server.authorization.jose;
+
+import org.springframework.util.Assert;
+
+import java.security.Key;
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * Internal implementation of {@link KeyManager} that manages a single {@link Key}.
+ *
+ * @author Anoop Garlapati
+ * @since 0.0.1
+ */
+final class DefaultKeyManager implements KeyManager {
+
+	private Key key;
+
+	DefaultKeyManager(Key key) {
+		Assert.notNull(key, "key cannot be null");
+		this.key = key;
+	}
+
+	@Override
+	public List<Key> getKeys() {
+		return Collections.singletonList(this.key);
+	}
+
+	@Override
+	public Key getActiveKey() {
+		return this.key;
+	}
+}

core/src/main/java/org/springframework/security/oauth2/server/authorization/jose/JoseHeaderNames.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.server.authorization.jose;
+
+/**
+ * The Registered Header Parameter Names defined by the JSON Web Signature (JWS) specification
+ * that may be contained in the JSON object JOSE Header.
+ *
+ * @see <a target="_blank" href="https://tools.ietf.org/html/rfc7515#section-4.1">JWS Headers</a>
+ * @see <a target="_blank" href="https://tools.ietf.org/html/rfc7797#section-3">B64 Header Parameter</a>
+ */
+public interface JoseHeaderNames {
+
+	String ALG = "alg";
+
+	String JKU = "jku";
+
+	String JWK = "jwk";
+
+	String KID = "kid";
+
+	String X5U = "x5u";
+
+	String X5C = "x5c";
+
+	String X5T = "x5t";
+
+	String X5T256 = "x5t#256";
+
+	String TYP = "typ";
+
+	String CTY = "cty";
+
+	String CRIT = "crit";
+
+	String B64 = "b64";
+}

core/src/main/java/org/springframework/security/oauth2/server/authorization/jose/JoseHeaders.java

@@ -0,0 +1,155 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.server.authorization.jose;
+
+import org.springframework.core.convert.TypeDescriptor;
+import org.springframework.security.oauth2.core.converter.ClaimConversionService;
+import org.springframework.security.oauth2.jose.jws.MacAlgorithm;
+import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
+import org.springframework.util.Assert;
+
+import java.net.URI;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Consumer;
+
+/**
+ * A representation of "headers" that may be contained
+ * in the JSON object JOSE Header of a JSON Web Signature (JWS).
+ *
+ * @author Anoop Garlapati
+ * @since 0.0.1
+ * @see <a target="_blank" href="https://tools.ietf.org/html/rfc7515#section-4">JOSE Header of JWS</a>
+ */
+public class JoseHeaders {
+
+	private final Map<String, Object> headers;
+
+	protected JoseHeaders(Map<String, Object> headers) {
+		Assert.notEmpty(headers, "headers cannot be empty");
+		this.headers = Collections.unmodifiableMap(new LinkedHashMap<>(headers));
+	}
+
+	public SignatureAlgorithm getSignatureAlgorithm() {
+		return SignatureAlgorithm.from(getHeaderAsString("alg"));
+	}
+
+	public MacAlgorithm getMacAlgorithm() {
+		return MacAlgorithm.from(getHeaderAsString("alg"));
+	}
+
+	public String getType() {
+		return getHeaderAsString("typ");
+	}
+
+	public Map<String, Object> getHeaders() {
+		return this.headers;
+	}
+
+	public String getHeaderAsString(String header) {
+		return !containsHeader(header) ? null :
+				ClaimConversionService.getSharedInstance().convert(getHeaders().get(header), String.class);
+	}
+
+	@SuppressWarnings("unchecked")
+	public List<String> getHeaderAsStringList(String header) {
+		if (!containsHeader(header)) {
+			return null;
+		}
+		final TypeDescriptor sourceDescriptor = TypeDescriptor.valueOf(Object.class);
+		final TypeDescriptor targetDescriptor = TypeDescriptor.collection(
+				List.class, TypeDescriptor.valueOf(String.class));
+		Object headerValue = getHeaders().get(header);
+		List<String> convertedValue = (List<String>) ClaimConversionService.getSharedInstance().convert(
+				headerValue, sourceDescriptor, targetDescriptor);
+		if (convertedValue == null) {
+			throw new IllegalArgumentException("Unable to convert header '" + header +
+					"' of type '" + headerValue.getClass() + "' to List.");
+		}
+		return convertedValue;
+	}
+
+	public URI getHeaderAsURI(String header) {
+		if (!containsHeader(header)) {
+			return null;
+		}
+		Object headerValue = getHeaders().get(header);
+		URI convertedValue = ClaimConversionService.getSharedInstance().convert(headerValue, URI.class);
+		if (convertedValue == null) {
+			throw new IllegalArgumentException("Unable to convert header '" + header +
+					"' of type '" + headerValue.getClass() + "' to URI.");
+		}
+		return convertedValue;
+	}
+
+	public Boolean getHeaderAsBoolean(String header) {
+		return !containsHeader(header) ? null :
+				ClaimConversionService.getSharedInstance().convert(getHeaders().get(header), Boolean.class);
+	}
+
+	private Boolean containsHeader(String header) {
+		Assert.notNull(header, "header cannot be null");
+		return getHeaders().containsKey(header);
+	}
+
+	public static class Builder {
+		private Map<String, Object> headers = new LinkedHashMap<>();
+
+		public Builder() {
+		}
+
+		public Builder(JoseHeaders joseHeaders) {
+			Assert.notNull(joseHeaders, "joseHeaders cannot be null");
+			this.headers = joseHeaders.headers;
+		}
+
+		public Builder header(String name, Object value) {
+			Assert.notNull(name, "name cannot be null");
+			this.headers.put(name, value);
+			return this;
+		}
+
+		public Builder headers(Consumer<Map<String, Object>> headersConsumer) {
+			Assert.notNull(headersConsumer, "headersConsumer cannot be null");
+			headersConsumer.accept(this.headers);
+			return this;
+		}
+
+		public Builder signatureAlgorithm(SignatureAlgorithm signatureAlgorithm) {
+			Assert.notNull(signatureAlgorithm, "signatureAlgorithm cannot be null");
+			this.header("alg", signatureAlgorithm.getName());
+			return this;
+		}
+
+		public Builder macAlgorithm(MacAlgorithm macAlgorithm) {
+			Assert.notNull(macAlgorithm, "macAlgorithm cannot be null");
+			this.header("alg", macAlgorithm.getName());
+			return this;
+		}
+
+		public Builder type(String type) {
+			Assert.notNull(type, "type cannot be null");
+			this.header("typ", type);
+			return this;
+		}
+
+		public JoseHeaders build() {
+			return new JoseHeaders(this.headers);
+		}
+	}
+}

core/src/main/java/org/springframework/security/oauth2/server/authorization/jose/JwtClaimsSet.java

@@ -0,0 +1,75 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.server.authorization.jose;
+
+import org.springframework.security.oauth2.jwt.JwtClaimAccessor;
+import org.springframework.util.Assert;
+
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.function.Consumer;
+
+/**
+ * A representation of "claims" that may be contained
+ * in the JSON object JWT Claims Set of a JSON Web Token (JWT).
+ *
+ * @author Anoop Garlapati
+ * @since 0.0.1
+ * @see <a target="_blank" href="https://tools.ietf.org/html/rfc7519#section-4">JWT Claims</a>
+ */
+public class JwtClaimsSet implements JwtClaimAccessor {
+
+	private final Map<String, Object> claims;
+
+	protected JwtClaimsSet(Map<String, Object> claims) {
+		Assert.notEmpty(claims, "claims cannot be null");
+		this.claims = Collections.unmodifiableMap(new LinkedHashMap<>(claims));
+	}
+
+	@Override
+	public Map<String, Object> getClaims() {
+		return this.claims;
+	}
+
+	public static class Builder {
+		private Map<String, Object> claims = new LinkedHashMap<>();
+
+		public Builder() {
+		}
+
+		public Builder(JwtClaimsSet jwtClaimsSet) {
+			Assert.notNull(jwtClaimsSet, "jwtClaimsSet cannot be null");
+			this.claims = jwtClaimsSet.claims;
+		}
+
+		public Builder claim(String name, Object value) {
+			Assert.notNull(name, "name cannot be null");
+			this.claims.put(name, value);
+			return this;
+		}
+
+		public Builder claims(Consumer<Map<String, Object>> claimsConsumer) {
+			Assert.notNull(claimsConsumer, "claimsConsumer cannot be null");
+			claimsConsumer.accept(this.claims);
+			return this;
+		}
+
+		public JwtClaimsSet build() {
+			return new JwtClaimsSet(this.claims);
+		}
+	}
+}

core/src/main/java/org/springframework/security/oauth2/server/authorization/jose/JwtEncoder.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.server.authorization.jose;
+
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtException;
+
+/**
+ * Implementations of this interface are responsible for "encoding"
+ * a JSON Web Token (JWT) from it's unsecured representation {@link UnsecuredJwt}
+ * to secured representation {@link Jwt}.
+ *
+ * @author Anoop Garlapati
+ * @since 0.0.1
+ * @see <a target="_blank" href="https://tools.ietf.org/html/rfc7519">JSON Web Token (JWT)</a>
+ */
+@FunctionalInterface
+public interface JwtEncoder {
+
+	/**
+	 * Encodes the JWT from its unsecured format {@link UnsecuredJwt} and returns a {@link Jwt}.
+	 *
+	 * @param unsecuredJwt the unsecured JWT representation
+	 * @return a {@link Jwt}
+	 * @throws JwtException if an exception occurs while attempting to encode the JWT
+	 */
+	Jwt encode(UnsecuredJwt unsecuredJwt) throws JwtException;
+}