Support Paseto tokens

gradle/libs.versions.toml

@@ -1,6 +1,9 @@
 [versions]
 managed-nimbus-jose-jwt = "10.9"
 managed-jjwt = "0.13.0"
+managed-jpaseto = "0.7.0"
+managed-bcprov-jdk18on = "1.84"
+managed-jackson-bom = "2.18.6"
 micronaut = "5.0.0"
 micronaut-platform = "5.0.0-RC1"
 awaitility = "4.3.0"
@@ -41,6 +44,13 @@ micronaut-validation = { module = "io.micronaut.validation:micronaut-validation-
 micronaut-data = { module = "io.micronaut.data:micronaut-data-bom", version.ref = "micronaut-data" }
 micronaut-sql = { module = "io.micronaut.sql:micronaut-sql-bom", version.ref = "micronaut-sql" }
 
+managed-jpaseto-api = { module = "dev.paseto:jpaseto-api", version.ref = "managed-jpaseto" }
+managed-jpaseto-bouncy-castle = { module = "dev.paseto:jpaseto-bouncy-castle", version.ref = "managed-jpaseto" }
+managed-jpaseto-impl = { module = "dev.paseto:jpaseto-impl", version.ref = "managed-jpaseto" }
+managed-jpaseto-jackson = { module = "dev.paseto:jpaseto-jackson", version.ref = "managed-jpaseto" }
+managed-bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "managed-bcprov-jdk18on" }
+managed-jackson-bom = { module = "com.fasterxml.jackson:jackson-bom", version.ref = "managed-jackson-bom" }
+
 managed-nimbus-jose-jwt = { module = "com.nimbusds:nimbus-jose-jwt", version.ref = "managed-nimbus-jose-jwt" }
 managed-jjwt-api = { module = "io.jsonwebtoken:jjwt-api", version.ref = "managed-jjwt" }
 managed-jjwt-impl = { module = "io.jsonwebtoken:jjwt-impl", version.ref = "managed-jjwt" }
@@ -65,4 +75,3 @@ testcontainers-mysql = { module = "org.testcontainers:testcontainers-mysql" }
 testcontainers = { module = "org.testcontainers:testcontainers" }
 awaitility = { module = 'org.awaitility:awaitility', version.ref = 'awaitility' }
 graalvm-native-buildtools = { module = "org.graalvm.buildtools.native:org.graalvm.buildtools.native.gradle.plugin", version.ref = "graalvm-native-buildtools" }
-

security-paseto/build.gradle.kts

@@ -0,0 +1,31 @@
+plugins {
+    id("io.micronaut.build.internal.security-module")
+}
+dependencies {
+    api(mn.micronaut.http)
+    api(mn.micronaut.http.server)
+    api(projects.micronautSecurity)
+    api(libs.managed.jpaseto.api)
+    implementation(platform(libs.managed.jackson.bom))
+    implementation(libs.managed.bcprov.jdk18on)
+    implementation(libs.managed.jpaseto.bouncy.castle) {
+        exclude(group = "org.bouncycastle", module = "bcprov-jdk15on")
+    }
+    implementation(libs.managed.jpaseto.impl)
+    implementation(libs.managed.jpaseto.jackson)
+    implementation(mnReactor.micronaut.reactor)
+    testAnnotationProcessor(projects.micronautSecurityProcessor)
+    testCompileOnly(projects.micronautSecurityProcessor)
+    testImplementation(mn.micronaut.http.client)
+    testAnnotationProcessor(mn.micronaut.inject.java)
+    testImplementation(mnSerde.micronaut.serde.jackson)
+    testImplementation(mn.micronaut.http.server.netty)
+    testImplementation(projects.testSuiteUtils)
+    testImplementation(projects.testSuiteUtilsSecurity)
+}
+
+micronautBuild {
+    binaryCompatibility {
+        enabledAfter("5.0.1")
+    }
+}

security-paseto/src/main/java/io/micronaut/security/token/paseto/config/LocalGeneratorConfigurationProperties.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2017-2021 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.token.paseto.config;
+
+import dev.paseto.jpaseto.Version;
+import io.micronaut.context.annotation.ConfigurationProperties;
+import io.micronaut.context.annotation.Requires;
+import io.micronaut.core.annotation.NonNull;
+import jakarta.inject.Named;
+
+import javax.crypto.SecretKey;
+import jakarta.validation.constraints.NotNull;
+
+/**
+ * @author Sergio del Amo
+ * @since 3.1.0
+ */
+@Requires(property = PasetoConfigurationProperties.PREFIX + ".local-generator.base64-shared-secret")
+@ConfigurationProperties(PasetoConfigurationProperties.PREFIX + ".local-generator")
+@Named("local-generator")
+public class LocalGeneratorConfigurationProperties implements VersionedSharedSecretConfiguration {
+
+    public static final Version DEFAULT_VERSION = Version.V1;
+
+    @NotNull
+    @NonNull
+    private Version version = DEFAULT_VERSION;
+
+    @NonNull
+    @NotNull
+    private SecretKey base64SharedSecret;
+
+    @Override
+    @NonNull
+    public Version getVersion() {
+        return version;
+    }
+
+    /**
+     * Paseto version. Defaults to v1.
+     * @param version Paseto version
+     */
+    public void setVersion(@NonNull Version version) {
+        this.version = version;
+    }
+
+    @Override
+    @NonNull
+    public SecretKey getSharedSecret() {
+        return base64SharedSecret;
+    }
+
+    /**
+     * shared secret used for Paseto token base64 encoded.
+     * @param base64SharedSecret shared secret used for Paseto token base64 encoded.
+     */
+    public void setBase64SharedSecret(@NonNull SecretKey base64SharedSecret) {
+        this.base64SharedSecret = base64SharedSecret;
+    }
+}

security-paseto/src/main/java/io/micronaut/security/token/paseto/config/LocalValidators.java

@@ -0,0 +1,136 @@
+/*
+ * Copyright 2017-2021 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.token.paseto.config;
+
+import io.micronaut.context.annotation.EachProperty;
+import io.micronaut.core.annotation.NonNull;
+import io.micronaut.core.annotation.Nullable;
+import jakarta.inject.Singleton;
+
+import javax.crypto.SecretKey;
+import jakarta.validation.constraints.NotNull;
+
+/**
+ * {@link EachProperty} implementation of {@link SharedSecretConfiguration}.
+ */
+@Singleton
+@EachProperty(PasetoConfigurationProperties.PREFIX + ".local-validators")
+public class LocalValidators implements SharedSecretConfiguration {
+
+    @NonNull
+    @NotNull
+    private SecretKey base64SharedSecret;
+
+    @Nullable
+    private String requiredAudience;
+
+    @Nullable
+    private String requiredKeyId;
+
+    @Nullable
+    private String requiredIssuer;
+
+    @Nullable
+    private String requiredSubject;
+
+    @Nullable
+    private String requiredTokenId;
+
+    @Override
+    @NonNull
+    public SecretKey getSharedSecret() {
+        return base64SharedSecret;
+    }
+
+    @Nullable
+    @Override
+    public String getRequiredAudience() {
+        return this.requiredAudience;
+    }
+
+    @Override
+    @Nullable
+    public String getRequiredKeyId() {
+        return requiredKeyId;
+    }
+
+    @Override
+    @Nullable
+    public String getRequiredIssuer() {
+        return requiredIssuer;
+    }
+
+    @Override
+    @Nullable
+    public String getRequiredSubject() {
+        return requiredSubject;
+    }
+
+    @Override
+    @Nullable
+    public String getRequiredTokenId() {
+        return requiredTokenId;
+    }
+
+    /**
+     * The required value for the required token id.
+     * @param requiredTokenId The required value for the token id
+     */
+    public void setRequiredTokenId(@Nullable String requiredTokenId) {
+        this.requiredTokenId = requiredTokenId;
+    }
+
+    /**
+     * Shared Secret.
+     * @param base64SharedSecret Shared Secret
+     */
+    public void setBase64SharedSecret(@NonNull SecretKey base64SharedSecret) {
+        this.base64SharedSecret = base64SharedSecret;
+    }
+
+    /**
+     * The required value for the audience claim.
+     * @param requiredAudience The required value for the audience claim.
+     */
+    public void setRequiredAudience(@Nullable String requiredAudience) {
+        this.requiredAudience = requiredAudience;
+    }
+
+    /**
+     * The required value for the keyId.
+     * @param requiredKeyId The required value of the keyId
+     */
+    public void setRequiredKeyId(@Nullable String requiredKeyId) {
+        this.requiredKeyId = requiredKeyId;
+    }
+
+    /**
+     * The required issuer value.
+     * @param requiredIssuer The required issuer value
+     */
+    public void setRequiredIssuer(@Nullable String requiredIssuer) {
+        this.requiredIssuer = requiredIssuer;
+    }
+
+    /**
+     * The required subject value.
+     * @param requiredSubject The required subject value
+     */
+    public void setRequiredSubject(@Nullable String requiredSubject) {
+        this.requiredSubject = requiredSubject;
+    }
+
+}

security-paseto/src/main/java/io/micronaut/security/token/paseto/config/PasetoConfiguration.java

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2017-2021 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.token.paseto.config;
+
+import io.micronaut.core.util.Toggleable;
+
+/**
+ * Represents configuration of the PASETO token.
+ *
+ * @author Utsav Varia
+ * @since 3.0
+ */
+public interface PasetoConfiguration extends Toggleable {
+
+}

security-paseto/src/main/java/io/micronaut/security/token/paseto/config/PasetoConfigurationProperties.java

@@ -0,0 +1,57 @@
+/*
+ * Copyright 2017-2021 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.token.paseto.config;
+
+import io.micronaut.context.annotation.ConfigurationProperties;
+import io.micronaut.context.annotation.Requires;
+import io.micronaut.core.util.StringUtils;
+import io.micronaut.security.token.config.TokenConfigurationProperties;
+
+/**
+ * {@link PasetoConfiguration} implementation.
+ *
+ * @author Utsav Varia
+ * @since 3.0
+ */
+@Requires(property = TokenConfigurationProperties.PREFIX + ".enabled", notEquals = StringUtils.FALSE)
+@ConfigurationProperties(PasetoConfigurationProperties.PREFIX)
+public class PasetoConfigurationProperties implements PasetoConfiguration {
+
+    public static final String PREFIX = TokenConfigurationProperties.PREFIX  + ".paseto";
+    /**
+     * The default enable value.
+     */
+    public static final boolean DEFAULT_ENABLED = true;
+
+    private boolean enabled = DEFAULT_ENABLED;
+
+    /**
+     *
+     * @return a boolean flag indicating whether PASETO beans should be enabled or not
+     */
+    @Override
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    /**
+     * Sets whether Paseto security is enabled. Default value ({@value #DEFAULT_ENABLED}).
+     * @param enabled True if it is
+     */
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+}