#5848

Committed 05 May 2025 03:41PM UTC coverage: 78.738% (-0.03%) from 78.768%

Build # #5848

Build Type

push

Committed by

Commit Message

DT-1518: Populate AuthUser with full Consent User object (#2488)

Coverage Stats

97 of 116 new or added lines in 11 files covered. (83.62%)

10091 of 12816 relevant lines covered (78.74%)

0.79 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

81.25

/src/main/java/org/broadinstitute/consent/http/authentication/AuthorizationHelper.java

package org.broadinstitute.consent.http.authentication;

import com.google.common.cache.Cache;
import com.google.inject.Inject;
import jakarta.ws.rs.NotFoundException;
import jakarta.ws.rs.WebApplicationException;
import java.util.Map;
import org.broadinstitute.consent.http.filters.ClaimsCache;
import org.broadinstitute.consent.http.models.AuthUser;
import org.broadinstitute.consent.http.models.User;
import org.broadinstitute.consent.http.models.sam.UserStatus;
import org.broadinstitute.consent.http.models.sam.UserStatusInfo;
import org.broadinstitute.consent.http.service.UserService;
import org.broadinstitute.consent.http.service.sam.SamService;
import org.broadinstitute.consent.http.util.ConsentLogger;

/**
 * Helper class for authorization and authentication. This class contains methods to build AuthUser
 * objects from request headers, retrieve user status information from Sam, and check user roles.
 */
public class AuthorizationHelper implements ConsentLogger {

  protected final ClaimsCache claimsCache;
  protected final SamService samService;
  protected final UserService userService;

  @Inject
  public AuthorizationHelper(SamService samService,
      UserService userService) {
    this.claimsCache = ClaimsCache.getInstance();
    this.samService = samService;
    this.userService = userService;
  }

  protected Cache<String, Map<String, String>> getCache() {
    return claimsCache.cache;
  }

  protected AuthUser buildAuthUserFromHeaders(Map<String, String> headers) {
    String aud = headers.get(ClaimsCache.OAUTH2_CLAIM_aud);
    String token = headers.get(ClaimsCache.OAUTH2_CLAIM_access_token);
    String email = headers.get(ClaimsCache.OAUTH2_CLAIM_email);
    String name = headers.get(ClaimsCache.OAUTH2_CLAIM_name);
    // Name is not a guaranteed header
    if (name == null || name.equals("unknown")) {
      name = email;
    }
    if (email == null) {
      logWarn(String.format(
          "Reading oauth2 claim headers: email is null, auth user is incomplete. Aud: %s Name: %s",
          aud, name));
    }
    return new AuthUser(token, email, name, aud);
  }

  /**
   * Attempt to get the registration status of the current user. If the user is not registered,
   * attempt to register them and return the registration status.
   *
   * @param authUser The AuthUser
   * @return A Sam UserStatusInfo entity
   */
  protected UserStatusInfo getUserStatusInfo(AuthUser authUser) {
    try {
      return samService.getRegistrationInfo(authUser);
    } catch (NotFoundException e) {
      try {
        // Try to post the user to Sam if they have not registered previously
        UserStatus userStatus = samService.postRegistrationInfo(authUser);
        // If we succeed, return a basic version of UserStatusInfo. Future API calls will
        // return the full UserStatusInfo object.
        return new UserStatusInfo()
            .setUserEmail(authUser.getEmail())
            .setUserSubjectId(userStatus.getUserInfo().getUserSubjectId());
      } catch (Exception ex) {
        // if post response is not successful, propagate the error to the user
        throw new WebApplicationException(ex.getMessage());
      }
    } catch (Exception e) {
      logWarn(String.format("Exception retrieving Sam user info for '%s'", authUser.getEmail()), e);
    }
    return null;
  }

  /**
   * Check if the user has a specific role. This method will check if the user is a Duos User and
   * look for all roles they may have, returning true if any of them match the requested role.
   *
   * @param authUser AuthUser
   * @param role     String role to check
   * @return True if the user has the role, false otherwise
   */
  protected boolean authorize(AuthUser authUser, String role) {
    boolean authorize = false;
    try {
      User user = userService.findUserByEmail(authUser.getEmail());
      return user.getRoles().stream().anyMatch(r -> r.getName().equalsIgnoreCase(role));
    } catch (NotFoundException e) {
      logWarn("User not found, authorization incomplete: %s".formatted(authUser.getEmail()));
    }
    return authorize;
  }

}

1	package org.broadinstitute.consent.http.authentication;
2
3	import com.google.common.cache.Cache;
4	import com.google.inject.Inject;
5	import jakarta.ws.rs.NotFoundException;
6	import jakarta.ws.rs.WebApplicationException;
7	import java.util.Map;
8	import org.broadinstitute.consent.http.filters.ClaimsCache;
9	import org.broadinstitute.consent.http.models.AuthUser;
10	import org.broadinstitute.consent.http.models.User;
11	import org.broadinstitute.consent.http.models.sam.UserStatus;
12	import org.broadinstitute.consent.http.models.sam.UserStatusInfo;
13	import org.broadinstitute.consent.http.service.UserService;
14	import org.broadinstitute.consent.http.service.sam.SamService;
15	import org.broadinstitute.consent.http.util.ConsentLogger;
16
17	/**
18	* Helper class for authorization and authentication. This class contains methods to build AuthUser
19	* objects from request headers, retrieve user status information from Sam, and check user roles.
20	*/
21	public class AuthorizationHelper implements ConsentLogger {
22
23	protected final ClaimsCache claimsCache;
24	protected final SamService samService;
25	protected final UserService userService;
26
27	@Inject
28	public AuthorizationHelper(SamService samService,
29	UserService userService) {	1✔
30	this.claimsCache = ClaimsCache.getInstance();	1✔
31	this.samService = samService;	1✔
32	this.userService = userService;	1✔
33	}	1✔
34
35	protected Cache<String, Map<String, String>> getCache() {
36	return claimsCache.cache;	1✔
37	}
38
39	protected AuthUser buildAuthUserFromHeaders(Map<String, String> headers) {
40	String aud = headers.get(ClaimsCache.OAUTH2_CLAIM_aud);	1✔
41	String token = headers.get(ClaimsCache.OAUTH2_CLAIM_access_token);	1✔
42	String email = headers.get(ClaimsCache.OAUTH2_CLAIM_email);	1✔
43	String name = headers.get(ClaimsCache.OAUTH2_CLAIM_name);	1✔
44	// Name is not a guaranteed header
45	if (name == null \|\| name.equals("unknown")) {	1✔
46	name = email;	1✔
47	}
48	if (email == null) {	1✔
49	logWarn(String.format(	1✔
50	"Reading oauth2 claim headers: email is null, auth user is incomplete. Aud: %s Name: %s",
51	aud, name));
52	}
53	return new AuthUser(token, email, name, aud);	1✔
54	}
55
56	/**
57	* Attempt to get the registration status of the current user. If the user is not registered,
58	* attempt to register them and return the registration status.
59	*
60	* @param authUser The AuthUser
61	* @return A Sam UserStatusInfo entity
62	*/
63	protected UserStatusInfo getUserStatusInfo(AuthUser authUser) {
64	try {
65	return samService.getRegistrationInfo(authUser);	1✔
66	} catch (NotFoundException e) {	1✔
67	try {
68	// Try to post the user to Sam if they have not registered previously
69	UserStatus userStatus = samService.postRegistrationInfo(authUser);	1✔
70	// If we succeed, return a basic version of UserStatusInfo. Future API calls will
71	// return the full UserStatusInfo object.
72	return new UserStatusInfo()	1✔
73	.setUserEmail(authUser.getEmail())	1✔
74	.setUserSubjectId(userStatus.getUserInfo().getUserSubjectId());	1✔
75	} catch (Exception ex) {	1✔
76	// if post response is not successful, propagate the error to the user
77	throw new WebApplicationException(ex.getMessage());	1✔
78	}
NEW 79	} catch (Exception e) {	×
NEW 80	logWarn(String.format("Exception retrieving Sam user info for '%s'", authUser.getEmail()), e);	×
81	}
NEW 82	return null;	×
83	}
84
85	/**
86	* Check if the user has a specific role. This method will check if the user is a Duos User and
87	* look for all roles they may have, returning true if any of them match the requested role.
88	*
89	* @param authUser AuthUser
90	* @param role String role to check
91	* @return True if the user has the role, false otherwise
92	*/
93	protected boolean authorize(AuthUser authUser, String role) {
94	boolean authorize = false;	1✔
95	try {
96	User user = userService.findUserByEmail(authUser.getEmail());	1✔
97	return user.getRoles().stream().anyMatch(r -> r.getName().equalsIgnoreCase(role));	1✔
NEW 98	} catch (NotFoundException e) {	×
NEW 99	logWarn("User not found, authorization incomplete: %s".formatted(authUser.getEmail()));	×
100	}
NEW 101	return authorize;	×
102	}
103
104	}

DataBiosphere / consent / #5848

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous