Auth/cookies

backend/auth-service/.gitignore

@@ -39,4 +39,6 @@ bin/
 .vscode/
 
 ### Mac OS ###
-.DS_Store
+.DS_Store
+
+/src/main/resources/

backend/auth-service/build.gradle

@@ -28,7 +28,11 @@ dependencies {
 	implementation 'io.jsonwebtoken:jjwt-api:0.11.5'
 	runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.5'
 	runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.11.5'
-
+//    implementation 'org.bouncycastle:bcprov-jdk16:1.45'
+	implementation 'org.bouncycastle:bcpkix-jdk15on:1.70'
+	implementation 'org.postgresql:postgresql:42.7.3'
+	implementation 'redis.clients:jedis:5.1.0'
+	implementation 'de.mkammerer:argon2-jvm:2.11'
 }
 
 tasks.named('test') {

backend/auth-service/pom.xml

@@ -17,4 +17,5 @@
         <version>0.11.5</version>
         <scope>runtime</scope>
     </dependency>
+
 </dependencies>

backend/auth-service/src/main/java/com/city/demo/controller/AuthController.java

@@ -0,0 +1,53 @@
+package com.city.demo.controller;
+
+import com.city.demo.service.dto.RefreshRequest;
+import com.city.demo.service.impl.AuthServiceImpl;
+import com.city.demo.service.dto.LoginRequest;
+import com.city.demo.service.dto.TokenResponse;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletResponse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequestMapping("/api/auth")
+public class AuthController {
+
+    private static final Logger logger = LoggerFactory.getLogger(AuthController.class);
+
+    @Autowired
+    private AuthServiceImpl authService;
+
+    @PostMapping("/login")
+    public ResponseEntity<TokenResponse> login(@RequestBody LoginRequest request, HttpServletResponse response) {
+        logger.info("Login request: {}", request);
+
+        TokenResponse res = authService.login(request.getLogin(), request.getPassword());
+
+        Cookie cookie = new Cookie("refreshToken", res.getRefreshToken());
+        cookie.setPath("/");
+        // TODO: Change to the refresh token ttl value
+        cookie.setMaxAge(420);
+        cookie.setHttpOnly(true);
+        response.addCookie(cookie);
+
+        return ResponseEntity.ok(res);
+    }
+
+    @PostMapping("/refresh")
+    public ResponseEntity<TokenResponse> refresh(@RequestBody RefreshRequest request, HttpServletResponse response) {
+        TokenResponse res = authService.refresh(request.getRefreshToken());
+
+        Cookie cookie = new Cookie("refreshToken", res.getRefreshToken());
+        cookie.setPath("/");
+        // TODO: Change to the refresh token ttl value
+        cookie.setMaxAge(420);
+        cookie.setHttpOnly(true);
+        response.addCookie(cookie);
+
+        return ResponseEntity.ok(res);
+    }
+}

backend/auth-service/src/main/java/com/city/demo/domain/User.java

@@ -0,0 +1,47 @@
+package com.city.demo.domain;
+
+import jakarta.persistence.*;
+
+import java.util.UUID;
+
+@Entity
+@Table(name = "users")
+public class User {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.UUID)
+    private UUID id;
+
+    @Column(name = "email", unique = true, nullable = false)
+    private String email;
+
+    @Column(name = "password", nullable = false)
+    private byte[] password;
+
+    public User(){
+
+    }
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public byte[] getPassword() {
+        return password;
+    }
+
+    public void setPassword(byte[] password) {
+        this.password = password;
+    }
+
+    public void setId(UUID id) {
+        this.id = id;
+    }
+
+    public UUID getId() {
+        return id;
+    }
+}

backend/auth-service/src/main/java/com/city/demo/repository/UserRepository.java

@@ -0,0 +1,14 @@
+package com.city.demo.repository;
+
+import com.city.demo.domain.User;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import java.util.UUID;
+
+@Repository
+public interface UserRepository extends JpaRepository<User, UUID> {
+    User findByEmail(String email);
+//    User findById(UUID id);
+}
+

backend/auth-service/src/main/java/com/city/demo/security/HashPassword.java

@@ -0,0 +1,33 @@
+package com.city.demo.security;
+
+import de.mkammerer.argon2.Argon2;
+import de.mkammerer.argon2.Argon2Factory;
+
+
+public class HashPassword {
+//    public static String hashPassword(String password) {
+//        Argon2 argon2 = Argon2Factory.create(Argon2Factory.Argon2Types.ARGON2id);
+//
+//        int iterations = 3;
+//        int memory = 65536; // 64MB
+//        int parallelism = 1;
+//
+//        try {
+//            return argon2.hash(iterations, memory, parallelism, password.toCharArray());
+//        } finally {
+//            argon2.wipeArray(password.toCharArray()); // Optional
+//        }
+//    }
+
+    public static boolean verifyPassword(String hashedPassword, String password) {
+        Argon2 argon2 = Argon2Factory.create(Argon2Factory.Argon2Types.ARGON2id);
+        return argon2.verify(hashedPassword, password.toCharArray());
+    }
+
+    public static void main(String[] args) {
+        String rawPassword = "1234ddd";
+        String HashedPassword = "$argon2id$v=19$m=65536,t=3,p=1$5a8tHxwH8HmE6h3IbmNw3A$SU0R8Pnmm8u05GVrec4aTMUgNzSK5txXPJK9NumLurE";
+        boolean match = verifyPassword(HashedPassword, rawPassword);
+        System.out.println("Password match: " + match);
+    }
+}

backend/auth-service/src/main/java/com/city/demo/JwtDecoder.java → backend/auth-service/src/main/java/com/city/demo/security/JwtDecoder.java

@@ -1,8 +1,7 @@
-package com.city.demo;
+package com.city.demo.security;
 
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwts;
-import io.jsonwebtoken.security.Keys;
 
 import javax.crypto.SecretKey;
 

backend/auth-service/src/main/java/com/city/demo/security/JwtTest.java

@@ -0,0 +1,38 @@
+package com.city.demo.security;
+
+import com.city.demo.utils.PemUtils;
+import io.jsonwebtoken.Claims;
+
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.HashMap;
+import java.util.Map;
+
+public class JwtTest {
+
+    private final static String PRIVATE_KEY_PATH = "private.pem";
+    private final static String PUBLIC_KEY_PATH = "public.pem";
+
+    public static void main(String[] args) {
+        // 1. Generate a secret key
+        try {
+            RSAPublicKey publicKey = PemUtils.loadPublicKey(PUBLIC_KEY_PATH);
+            RSAPrivateKey privateKey = PemUtils.loadPrivateKey(PRIVATE_KEY_PATH);
+
+            // 2. Create an instance of JwtUtil
+            JwtUtil jwtUtil = new JwtUtil();
+
+            // 3. Generate a token
+            Map<String, String> claims = new HashMap<>();
+            claims.put("username", "testuser");
+            claims.put("role", "admin");
+            String token = jwtUtil.generateAccessToken(claims);
+            System.out.println("Generated token: " + token);
+        } catch (Exception e) {
+            System.out.println(":C");
+        }
+
+    }
+}