diff --git a/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/helper/TokenValidationHelper.java b/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/helper/TokenValidationHelper.java index b3a56eba064..49cf16533ac 100644 --- a/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/helper/TokenValidationHelper.java +++ b/authentication/authentication-common/src/main/java/io/mosip/authentication/common/service/helper/TokenValidationHelper.java @@ -1,26 +1,17 @@ package io.mosip.authentication.common.service.helper; import java.time.LocalDateTime; -import java.util.Collection; -import java.util.List; import java.util.Optional; -import java.util.Set; -import java.util.stream.Collectors; import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Value; +import org.springframework.stereotype.Component; import io.mosip.authentication.common.service.entity.KycTokenData; -import io.mosip.authentication.common.service.entity.OIDCClientData; import io.mosip.authentication.common.service.repository.KycTokenDataRepository; -import io.mosip.authentication.common.service.repository.OIDCClientDataRepository; -import io.mosip.authentication.common.service.util.EnvUtil; -import io.mosip.authentication.common.service.util.IdaRequestResponsConsumerUtil; import io.mosip.authentication.core.constant.IdAuthCommonConstants; import io.mosip.authentication.core.constant.IdAuthenticationErrorConstants; import io.mosip.authentication.core.constant.KycTokenStatusType; import io.mosip.authentication.core.exception.IdAuthenticationBusinessException; -import io.mosip.authentication.core.indauth.dto.BaseRequestDTO; import io.mosip.authentication.core.logger.IdaLogger; import io.mosip.authentication.core.spi.indauth.service.KycService; import io.mosip.kernel.core.logger.spi.Logger; @@ -31,15 +22,12 @@ * @author Mahammed Taheer */ +@Component public class TokenValidationHelper { /** The mosip logger. */ private static Logger mosipLogger = IdaLogger.getLogger(TokenValidationHelper.class); - @Value("${ida.idp.consented.individual_id.attribute.name:individual_id}") - private String consentedIndividualIdAttributeName; - - /** The Kyc Service */ @Autowired private KycService kycService; @@ -47,13 +35,6 @@ public class TokenValidationHelper { @Autowired private KycTokenDataRepository kycTokenDataRepo; - @Autowired - private IdInfoHelper idInfoHelper; - - @Autowired - private OIDCClientDataRepository oidcClientDataRepo; - - public KycTokenData findAndValidateIssuedToken(String tokenData, String oidcClientId, String reqTransactionId, String idvidHash) throws IdAuthenticationBusinessException { @@ -131,49 +112,4 @@ private void validateToken(KycTokenData kycTokenData, String oidcClientId, Strin IdAuthenticationErrorConstants.KYC_TOKEN_EXPIRED.getErrorMessage()); } } - - public void mapConsentedAttributesToIdSchemaAttributes(List consentAttributes, Set filterAttributes, - List policyAllowedKycAttribs) throws IdAuthenticationBusinessException { - - if(consentAttributes != null && !consentAttributes.isEmpty()) { - for (String attrib : consentAttributes) { - Collection idSchemaAttribute = idInfoHelper.getIdentityAttributesForIdName(attrib); - filterAttributes.addAll(idSchemaAttribute); - } - // removing individual id from consent if the claim is not allowed in policy. - if (!policyAllowedKycAttribs.contains(consentedIndividualIdAttributeName)) { - consentAttributes.remove(consentedIndividualIdAttributeName); - } - } - } - - public Set filterByPolicyAllowedAttributes(Set filterAttributes, List policyAllowedKycAttribs) { - return policyAllowedKycAttribs.stream() - .filter(attribute -> filterAttributes.contains(attribute)) - .collect(Collectors.toSet()); - } - - public String getKycExchangeResponseTime(BaseRequestDTO authRequestDTO) { - String dateTimePattern = EnvUtil.getDateTimePattern(); - return IdaRequestResponsConsumerUtil.getResponseTime(authRequestDTO.getRequestTime(), dateTimePattern); - } - - public List filterAllowedUserClaims(String oidcClientId, List consentAttributes) { - mosipLogger.info(IdAuthCommonConstants.IDA, this.getClass().getSimpleName(), "filterAllowedUserClaims", - "Checking for OIDC client allowed userclaims"); - Optional oidcClientData = oidcClientDataRepo.findByClientId(oidcClientId); - - List oidcClientAllowedUserClaims = List.of(oidcClientData.get().getUserClaims()) - .stream() - .map(String::toLowerCase) - .collect(Collectors.toList()); - if (consentAttributes.isEmpty()) { - return oidcClientAllowedUserClaims; - } - - return consentAttributes.stream() - .filter(claim -> oidcClientAllowedUserClaims.contains(claim.toLowerCase())) - .collect(Collectors.toList()); - - } } diff --git a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/KycFacadeImpl.java b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/KycFacadeImpl.java index 7e3582f9732..a181c6a7cd9 100644 --- a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/KycFacadeImpl.java +++ b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/KycFacadeImpl.java @@ -3,6 +3,7 @@ */ package io.mosip.authentication.service.kyc.facade; +import java.time.LocalDateTime; import java.util.AbstractMap.SimpleEntry; import java.util.Collection; import java.util.HashSet; @@ -26,11 +27,13 @@ import io.mosip.authentication.common.service.builder.AuthTransactionBuilder; import io.mosip.authentication.common.service.entity.AutnTxn; import io.mosip.authentication.common.service.entity.KycTokenData; +import io.mosip.authentication.common.service.entity.OIDCClientData; import io.mosip.authentication.common.service.helper.AuditHelper; import io.mosip.authentication.common.service.helper.TokenValidationHelper; import io.mosip.authentication.common.service.integration.TokenIdManager; import io.mosip.authentication.common.service.repository.IdaUinHashSaltRepo; import io.mosip.authentication.common.service.repository.KycTokenDataRepository; +import io.mosip.authentication.common.service.repository.OIDCClientDataRepository; import io.mosip.authentication.common.service.transaction.manager.IdAuthSecurityManager; import io.mosip.authentication.common.service.util.EnvUtil; import io.mosip.authentication.common.service.util.IdaRequestResponsConsumerUtil; @@ -70,6 +73,7 @@ import io.mosip.authentication.core.spi.indauth.match.IdInfoFetcher; import io.mosip.authentication.core.spi.indauth.service.KycService; import io.mosip.authentication.core.spi.partner.service.PartnerService; +import io.mosip.authentication.service.kyc.util.ExchangeDataAttributesUtil; import io.mosip.kernel.core.logger.spi.Logger; import reactor.util.function.Tuple3; @@ -133,6 +137,9 @@ public class KycFacadeImpl implements KycFacade { @Autowired private TokenValidationHelper tokenValidationHelper; + @Autowired + private ExchangeDataAttributesUtil exchangeDataAttributesUtil; + /* * (non-Javadoc) * @@ -399,15 +406,15 @@ public KycExchangeResponseDTO processKycExchange(KycExchangeRequestDTO kycExchan } List consentAttributes = kycExchangeRequestDTO.getConsentObtained(); - List allowedConsentAttributes = tokenValidationHelper.filterAllowedUserClaims(oidcClientId, consentAttributes); + List allowedConsentAttributes = exchangeDataAttributesUtil.filterAllowedUserClaims(oidcClientId, consentAttributes); PolicyDTO policyDto = policyDtoOpt.get(); List policyAllowedKycAttribs = Optional.ofNullable(policyDto.getAllowedKycAttributes()).stream() .flatMap(Collection::stream).map(KYCAttributes::getAttributeName).collect(Collectors.toList()); Set filterAttributes = new HashSet<>(); - tokenValidationHelper.mapConsentedAttributesToIdSchemaAttributes(allowedConsentAttributes, filterAttributes, policyAllowedKycAttribs); - Set policyAllowedAttributes = tokenValidationHelper.filterByPolicyAllowedAttributes(filterAttributes, policyAllowedKycAttribs); + exchangeDataAttributesUtil.mapConsentedAttributesToIdSchemaAttributes(allowedConsentAttributes, filterAttributes, policyAllowedKycAttribs); + Set policyAllowedAttributes = exchangeDataAttributesUtil.filterByPolicyAllowedAttributes(filterAttributes, policyAllowedKycAttribs); boolean isBioRequired = false; if (filterAttributes.contains(CbeffDocType.FACE.getType().value().toLowerCase()) || @@ -438,7 +445,7 @@ public KycExchangeResponseDTO processKycExchange(KycExchangeRequestDTO kycExchan kycExchangeResponseDTO.setId(kycExchangeRequestDTO.getId()); kycExchangeResponseDTO.setTransactionID(kycExchangeRequestDTO.getTransactionID()); kycExchangeResponseDTO.setVersion(kycExchangeRequestDTO.getVersion()); - kycExchangeResponseDTO.setResponseTime(tokenValidationHelper.getKycExchangeResponseTime(kycExchangeRequestDTO)); + kycExchangeResponseDTO.setResponseTime(exchangeDataAttributesUtil.getKycExchangeResponseTime(kycExchangeRequestDTO)); EncryptedKycRespDTO encryptedKycRespDTO = new EncryptedKycRespDTO(); encryptedKycRespDTO.setEncryptedKyc(respJson); @@ -455,7 +462,6 @@ public KycExchangeResponseDTO processKycExchange(KycExchangeRequestDTO kycExchan } } - // Need to move below duplicate code to common to be used by OTPService and KycExchange. private void saveToTxnTable(KycExchangeRequestDTO kycExchangeRequestDTO, boolean isInternal, boolean status, String partnerId, String token, KycExchangeResponseDTO kycExchangeResponseDTO, ObjectWithMetadata requestWithMetadata) diff --git a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/VciFacadeImpl.java b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/VciFacadeImpl.java index 19b7b49ef92..86d104ca8d0 100644 --- a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/VciFacadeImpl.java +++ b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/facade/VciFacadeImpl.java @@ -1,6 +1,3 @@ -/** - * - */ package io.mosip.authentication.service.kyc.facade; import java.util.ArrayList; @@ -52,6 +49,7 @@ import io.mosip.authentication.core.spi.indauth.match.IdInfoFetcher; import io.mosip.authentication.core.spi.partner.service.PartnerService; import io.mosip.authentication.service.kyc.impl.VciServiceImpl; +import io.mosip.authentication.service.kyc.util.ExchangeDataAttributesUtil; import io.mosip.kernel.core.logger.spi.Logger; /** @@ -104,6 +102,9 @@ public class VciFacadeImpl implements VciFacade { @Autowired private KycTokenDataRepository kycTokenDataRepo; + @Autowired + private ExchangeDataAttributesUtil exchangeDataAttributesUtil; + @Override public VciExchangeResponseDTO processVciExchange(VciExchangeRequestDTO vciExchangeRequestDTO, String partnerId, String oidcClientId, Map metadata, ObjectWithMetadata requestWithMetadata) throws IdAuthenticationBusinessException { @@ -133,15 +134,15 @@ public VciExchangeResponseDTO processVciExchange(VciExchangeRequestDTO vciExchan // Will implement later the consent claims based on credential definition input List consentAttributes = Collections.emptyList(); - List allowedConsentAttributes = tokenValidationHelper.filterAllowedUserClaims(oidcClientId, consentAttributes); + List allowedConsentAttributes = exchangeDataAttributesUtil.filterAllowedUserClaims(oidcClientId, consentAttributes); PolicyDTO policyDto = policyDtoOpt.get(); List policyAllowedKycAttribs = Optional.ofNullable(policyDto.getAllowedKycAttributes()).stream() .flatMap(Collection::stream).map(KYCAttributes::getAttributeName).collect(Collectors.toList()); Set filterAttributes = new HashSet<>(); - tokenValidationHelper.mapConsentedAttributesToIdSchemaAttributes(allowedConsentAttributes, filterAttributes, policyAllowedKycAttribs); - Set policyAllowedAttributes = tokenValidationHelper.filterByPolicyAllowedAttributes(filterAttributes, policyAllowedKycAttribs); + exchangeDataAttributesUtil.mapConsentedAttributesToIdSchemaAttributes(allowedConsentAttributes, filterAttributes, policyAllowedKycAttribs); + Set policyAllowedAttributes = exchangeDataAttributesUtil.filterByPolicyAllowedAttributes(filterAttributes, policyAllowedKycAttribs); boolean isBioRequired = false; if (filterAttributes.contains(CbeffDocType.FACE.getType().value().toLowerCase()) || @@ -178,7 +179,7 @@ public VciExchangeResponseDTO processVciExchange(VciExchangeRequestDTO vciExchan vciExchangeResponseDTO.setId(vciExchangeRequestDTO.getId()); vciExchangeResponseDTO.setTransactionID(vciExchangeRequestDTO.getTransactionID()); vciExchangeResponseDTO.setVersion(vciExchangeRequestDTO.getVersion()); - vciExchangeResponseDTO.setResponseTime(tokenValidationHelper.getKycExchangeResponseTime(vciExchangeRequestDTO)); + vciExchangeResponseDTO.setResponseTime(exchangeDataAttributesUtil.getKycExchangeResponseTime(vciExchangeRequestDTO)); vciExchangeResponseDTO.setResponse(vcResponseDTO); saveToTxnTable(vciExchangeRequestDTO, false, true, partnerId, token, vciExchangeResponseDTO, requestWithMetadata); auditHelper.audit(AuditModules.VCI_EXCHANGE, AuditEvents.VCI_EXCHANGE_REQUEST_RESPONSE, diff --git a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/KycServiceImpl.java b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/KycServiceImpl.java index d456c2b2221..a2bf7d0196f 100644 --- a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/KycServiceImpl.java +++ b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/KycServiceImpl.java @@ -4,6 +4,7 @@ import java.nio.ByteBuffer; import java.time.LocalDateTime; import java.time.temporal.ChronoUnit; +import java.time.temporal.ValueRange; import java.util.AbstractMap.SimpleEntry; import java.util.ArrayList; import java.util.HashMap; @@ -441,9 +442,11 @@ public boolean isKycTokenExpire(LocalDateTime tokenIssuedDateTime, String kycTok LocalDateTime currentTime = LocalDateTime.now(); long diffSeconds = ChronoUnit.SECONDS.between(tokenIssuedDateTime, currentTime); + long adjustmentSeconds = EnvUtil.getKycTokenExpireTimeAdjustmentSeconds(); + ValueRange valueRange = ValueRange.of(0, adjustmentSeconds); - if (tokenIssuedDateTime != null && adjustmentSeconds < diffSeconds) { + if (tokenIssuedDateTime != null && !valueRange.isValidIntValue(diffSeconds)) { return true; } return false; diff --git a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/VciServiceImpl.java b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/VciServiceImpl.java index 91ed5a865cb..2d1418f2141 100644 --- a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/VciServiceImpl.java +++ b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/impl/VciServiceImpl.java @@ -399,15 +399,21 @@ private Map getCredSubjectMap(String credSubjectId, Map 0)) + credSubjectMap.put(idSchemaAttribute, value); + } else { Map valueMap = new HashMap<>(); String lang = identityInfo.getLanguage(); if (locales.contains(lang)) { - valueMap.put(IdAuthCommonConstants.LANGUAGE_STRING, lang); - valueMap.put(IdAuthCommonConstants.VALUE_STRING, identityInfo.getValue()); - credSubjectMap.put(idSchemaAttribute, valueMap); + String value = identityInfo.getValue(); + if (Objects.nonNull(value) && (value.trim().length() > 0)) { + valueMap.put(IdAuthCommonConstants.LANGUAGE_STRING, lang); + valueMap.put(IdAuthCommonConstants.VALUE_STRING, value); + credSubjectMap.put(idSchemaAttribute, valueMap); + } } } continue; @@ -417,12 +423,16 @@ private Map getCredSubjectMap(String credSubjectId, Map valueMap = new HashMap<>(); String lang = identityInfo.getLanguage(); if (locales.contains(lang)) { - valueMap.put(IdAuthCommonConstants.LANGUAGE_STRING, identityInfo.getLanguage()); - valueMap.put(IdAuthCommonConstants.VALUE_STRING, identityInfo.getValue()); - valueList.add(valueMap); + String value = identityInfo.getValue(); + if (Objects.nonNull(value) && (value.trim().length() > 0)) { + valueMap.put(IdAuthCommonConstants.LANGUAGE_STRING, identityInfo.getLanguage()); + valueMap.put(IdAuthCommonConstants.VALUE_STRING, identityInfo.getValue()); + valueList.add(valueMap); + } } } - credSubjectMap.put(idSchemaAttribute, valueList); + if (valueList.size() > 0) + credSubjectMap.put(idSchemaAttribute, valueList); } } return credSubjectMap; diff --git a/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/util/ExchangeDataAttributesUtil.java b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/util/ExchangeDataAttributesUtil.java new file mode 100644 index 00000000000..0497cbc9ca5 --- /dev/null +++ b/authentication/authentication-service/src/main/java/io/mosip/authentication/service/kyc/util/ExchangeDataAttributesUtil.java @@ -0,0 +1,90 @@ +package io.mosip.authentication.service.kyc.util; + +import java.util.Collection; +import java.util.List; +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.stereotype.Component; + +import io.mosip.authentication.common.service.entity.OIDCClientData; +import io.mosip.authentication.common.service.helper.IdInfoHelper; +import io.mosip.authentication.common.service.repository.OIDCClientDataRepository; +import io.mosip.authentication.common.service.util.EnvUtil; +import io.mosip.authentication.common.service.util.IdaRequestResponsConsumerUtil; +import io.mosip.authentication.core.constant.IdAuthCommonConstants; +import io.mosip.authentication.core.exception.IdAuthenticationBusinessException; +import io.mosip.authentication.core.indauth.dto.BaseRequestDTO; +import io.mosip.authentication.core.logger.IdaLogger; +import io.mosip.kernel.core.logger.spi.Logger; + +/** + * Utility class to filter the consented attribute and policy allowed attributes. + * + * @author Mahammed Taheer + */ + +@Component +public class ExchangeDataAttributesUtil { + + /** The mosip logger. */ + private static Logger mosipLogger = IdaLogger.getLogger(ExchangeDataAttributesUtil.class); + + @Value("${ida.idp.consented.individual_id.attribute.name:individual_id}") + private String consentedIndividualIdAttributeName; + + @Autowired + private IdInfoHelper idInfoHelper; + + @Autowired + private OIDCClientDataRepository oidcClientDataRepo; + + public void mapConsentedAttributesToIdSchemaAttributes(List consentAttributes, Set filterAttributes, + List policyAllowedKycAttribs) throws IdAuthenticationBusinessException { + + if(consentAttributes != null && !consentAttributes.isEmpty()) { + for (String attrib : consentAttributes) { + Collection idSchemaAttribute = idInfoHelper.getIdentityAttributesForIdName(attrib); + filterAttributes.addAll(idSchemaAttribute); + } + // removing individual id from consent if the claim is not allowed in policy. + if (!policyAllowedKycAttribs.contains(consentedIndividualIdAttributeName)) { + consentAttributes.remove(consentedIndividualIdAttributeName); + } + } + } + + public Set filterByPolicyAllowedAttributes(Set filterAttributes, List policyAllowedKycAttribs) { + return policyAllowedKycAttribs.stream() + .filter(attribute -> filterAttributes.contains(attribute)) + .collect(Collectors.toSet()); + } + + public String getKycExchangeResponseTime(BaseRequestDTO authRequestDTO) { + String dateTimePattern = EnvUtil.getDateTimePattern(); + return IdaRequestResponsConsumerUtil.getResponseTime(authRequestDTO.getRequestTime(), dateTimePattern); + } + + public List filterAllowedUserClaims(String oidcClientId, List consentAttributes) { + mosipLogger.info(IdAuthCommonConstants.IDA, this.getClass().getSimpleName(), "filterAllowedUserClaims", + "Checking for OIDC client allowed userclaims"); + Optional oidcClientData = oidcClientDataRepo.findByClientId(oidcClientId); + + List oidcClientAllowedUserClaims = List.of(oidcClientData.get().getUserClaims()) + .stream() + .map(String::toLowerCase) + .collect(Collectors.toList()); + if (consentAttributes.isEmpty()) { + return oidcClientAllowedUserClaims; + } + + return consentAttributes.stream() + .filter(claim -> oidcClientAllowedUserClaims.contains(claim.toLowerCase())) + .collect(Collectors.toList()); + + } + +} diff --git a/authentication/esignet-integration-impl/src/main/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImpl.java b/authentication/esignet-integration-impl/src/main/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImpl.java index b8fbe203d2e..5883893a871 100644 --- a/authentication/esignet-integration-impl/src/main/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImpl.java +++ b/authentication/esignet-integration-impl/src/main/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImpl.java @@ -4,6 +4,7 @@ import java.time.LocalDateTime; import java.time.ZoneOffset; import java.util.*; +import java.util.stream.Collectors; import javax.crypto.Cipher; @@ -111,8 +112,7 @@ public VCResult getVerifiableCredentialWithLinkedDataProof(VCReque idaVciExchangeRequest.setIndividualId(individualId); idaVciExchangeRequest.setCredSubjectId(holderId); idaVciExchangeRequest.setVcFormat(vcRequestDto.getFormat()); - idaVciExchangeRequest.setLocales(transaction.getClaimsLocales() != null ? - Arrays.asList(transaction.getClaimsLocales()) : List.of("eng")); + idaVciExchangeRequest.setLocales(convertLangCodesToISO3LanguageCodes(transaction.getClaimsLocales())); vciCred.setCredentialSubject(vcRequestDto.getCredentialSubject()); vciCred.setType(vcRequestDto.getType()); vciCred.setContext(vcRequestDto.getContext()); @@ -194,5 +194,14 @@ private String getKeyAlias(String keyAppId, String keyRefId) throws Exception { private byte[] b64Decode(String value) { return urlSafeDecoder.decode(value); + }; + + //Converts an array of two-letter language codes to their corresponding ISO 639-2/T language codes. + private List convertLangCodesToISO3LanguageCodes(String[] langCodes) { + if(langCodes == null || langCodes.length == 0) + return List.of("eng"); + return Arrays.stream(langCodes) + .map(langCode -> new Locale(langCode).getISO3Language()) + .collect(Collectors.toList()); } } diff --git a/authentication/esignet-integration-impl/src/test/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImplTest.java b/authentication/esignet-integration-impl/src/test/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImplTest.java new file mode 100644 index 00000000000..b37730feed7 --- /dev/null +++ b/authentication/esignet-integration-impl/src/test/java/io/mosip/authentication/esignet/integration/service/IdaVCIssuancePluginImplTest.java @@ -0,0 +1,281 @@ +package io.mosip.authentication.esignet.integration.service; + +import com.fasterxml.jackson.databind.ObjectMapper; +import foundation.identity.jsonld.JsonLDObject; +import io.mosip.authentication.esignet.integration.dto.IdaResponseWrapper; +import io.mosip.authentication.esignet.integration.dto.IdaVcExchangeRequest; +import io.mosip.authentication.esignet.integration.dto.IdaVcExchangeResponse; +import io.mosip.authentication.esignet.integration.helper.VCITransactionHelper; +import io.mosip.esignet.api.dto.VCRequestDto; +import io.mosip.esignet.api.dto.VCResult; +import io.mosip.esignet.core.constants.ErrorConstants; +import io.mosip.esignet.core.dto.OIDCTransaction; +import io.mosip.esignet.core.exception.EsignetException; +import io.mosip.esignet.core.util.IdentityProviderUtil; +import io.mosip.kernel.core.keymanager.spi.KeyStore; +import io.mosip.kernel.keymanagerservice.entity.KeyAlias; +import io.mosip.kernel.keymanagerservice.helper.KeymanagerDBHelper; +import org.junit.Assert; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.InjectMocks; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.junit.MockitoJUnitRunner; +import org.springframework.core.ParameterizedTypeReference; +import org.springframework.http.RequestEntity; +import org.springframework.http.ResponseEntity; +import org.springframework.test.util.ReflectionTestUtils; +import org.springframework.web.client.RestTemplate; + +import javax.crypto.Cipher; +import javax.crypto.KeyGenerator; +import javax.crypto.SecretKey; +import java.nio.charset.StandardCharsets; +import java.security.Key; +import java.time.LocalDateTime; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import static io.mosip.kernel.keymanagerservice.constant.KeymanagerConstant.CURRENTKEYALIAS; + +@RunWith(MockitoJUnitRunner.class) +public class IdaVCIssuancePluginImplTest { + + @Mock + VCITransactionHelper vciTransactionHelper; + + @Mock + ObjectMapper objectMapper; + + @Mock + RestTemplate restTemplate; + + @Mock + HelperService helperService; + + @Mock + KeymanagerDBHelper keymanagerDBHelper; + + @Mock + KeyStore keyStore; + + @InjectMocks + IdaVCIssuancePluginImpl idaVCIssuancePlugin=new IdaVCIssuancePluginImpl(); + + @Test + public void getVerifiableCredentialWithLinkedDataProof_withValidDetails_thenPass() throws Exception { + + ReflectionTestUtils.setField(idaVCIssuancePlugin,"vciExchangeUrl","http://example.com"); + + VCRequestDto vcRequestDto = new VCRequestDto(); + vcRequestDto.setFormat("ldp_vc"); + vcRequestDto.setContext(Arrays.asList("context1","context2")); + vcRequestDto.setType(Arrays.asList("VerifiableCredential")); + vcRequestDto.setCredentialSubject(Map.of("subject1","subject1","subject2","subject2")); + + OIDCTransaction oidcTransaction = new OIDCTransaction(); + oidcTransaction.setIndividualId("individualId"); + oidcTransaction.setKycToken("kycToken"); + oidcTransaction.setAuthTransactionId("authTransactionId"); + oidcTransaction.setRelyingPartyId("relyingPartyId"); + oidcTransaction.setClaimsLocales(new String[]{"eng"}); + + IdaResponseWrapper> mockResponseWrapper = new IdaResponseWrapper<>(); + IdaVcExchangeResponse mockResponse = new IdaVcExchangeResponse<>(); + JsonLDObject jsonLDObject = new JsonLDObject(); + jsonLDObject.setJsonObjectKeyValue("key", "value"); + mockResponse.setVerifiableCredentials(jsonLDObject); + mockResponseWrapper.setResponse(mockResponse); + mockResponseWrapper.setId("id"); + mockResponseWrapper.setVersion("version"); + mockResponseWrapper.setTransactionID("transactionID"); + + ResponseEntity>> mockResponseEntity = ResponseEntity.ok(mockResponseWrapper); + ParameterizedTypeReference>> responseType = + new ParameterizedTypeReference>>() { + }; + + Mockito.when(vciTransactionHelper.getOAuthTransaction(Mockito.any())).thenReturn(oidcTransaction); + Mockito.when(objectMapper.writeValueAsString(Mockito.any(IdaVcExchangeRequest.class))).thenReturn("jsonString"); + Mockito.when(restTemplate.exchange( + Mockito.any(RequestEntity.class), + Mockito.eq(responseType) + )).thenReturn(mockResponseEntity); + + VCResult result=idaVCIssuancePlugin.getVerifiableCredentialWithLinkedDataProof(vcRequestDto,"holderId",Map.of("accessTokenHash","ACCESS_TOKEN_HASH","client_id","CLIENT_ID")); + Assert.assertNotNull(result.getCredential()); + Assert.assertEquals(jsonLDObject,result.getCredential()); + Assert.assertEquals(result.getFormat(),"ldp_vc"); + } + + @Test + public void getVerifiableCredentialWithLinkedDataProof_withValidDetailsAndStoreIndividualId_thenPass() throws Exception { + + ReflectionTestUtils.setField(idaVCIssuancePlugin,"vciExchangeUrl","http://example.com"); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"storeIndividualId",true); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"secureIndividualId",true); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"aesECBTransformation","AES/ECB/PKCS5Padding"); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"cacheSecretKeyRefId","cacheSecretKeyRefId"); + + VCRequestDto vcRequestDto = new VCRequestDto(); + vcRequestDto.setFormat("ldp_vc"); + vcRequestDto.setContext(Arrays.asList("context1","context2")); + vcRequestDto.setType(Arrays.asList("VerifiableCredential")); + vcRequestDto.setCredentialSubject(Map.of("subject1","subject1","subject2","subject2")); + + KeyGenerator generator = KeyGenerator.getInstance("AES"); + generator.init(256); + SecretKey key = generator.generateKey(); + String individualId = encryptIndividualId("individual-id",key); + + OIDCTransaction oidcTransaction = new OIDCTransaction(); + oidcTransaction.setIndividualId(individualId); + oidcTransaction.setKycToken("kycToken"); + oidcTransaction.setAuthTransactionId("authTransactionId"); + oidcTransaction.setRelyingPartyId("relyingPartyId"); + + Map> keyaliasesMap = new HashMap<>(); + KeyAlias keyAlias = new KeyAlias(); + keyAlias.setAlias("test"); + keyaliasesMap.put(CURRENTKEYALIAS, Arrays.asList(keyAlias)); + Mockito.when(keymanagerDBHelper.getKeyAliases(Mockito.anyString(), Mockito.anyString(), Mockito.any(LocalDateTime.class))).thenReturn(keyaliasesMap); + Mockito.when(keyStore.getSymmetricKey(Mockito.anyString())).thenReturn(key, key); + + IdaResponseWrapper> mockResponseWrapper = new IdaResponseWrapper<>(); + IdaVcExchangeResponse mockResponse = new IdaVcExchangeResponse<>(); + JsonLDObject jsonLDObject = new JsonLDObject(); + jsonLDObject.setJsonObjectKeyValue("key", "value"); + mockResponse.setVerifiableCredentials(jsonLDObject); + mockResponseWrapper.setResponse(mockResponse); + mockResponseWrapper.setId("id"); + mockResponseWrapper.setVersion("version"); + mockResponseWrapper.setTransactionID("transactionID"); + + ResponseEntity>> mockResponseEntity = ResponseEntity.ok(mockResponseWrapper); + ParameterizedTypeReference>> responseType = + new ParameterizedTypeReference>>() { + }; + + Mockito.when(vciTransactionHelper.getOAuthTransaction(Mockito.any())).thenReturn(oidcTransaction); + Mockito.when(objectMapper.writeValueAsString(Mockito.any())).thenReturn("jsonString"); + Mockito.when(restTemplate.exchange( + Mockito.any(RequestEntity.class), + Mockito.eq(responseType) + )).thenReturn(mockResponseEntity); + + VCResult result=idaVCIssuancePlugin.getVerifiableCredentialWithLinkedDataProof(vcRequestDto,"holderId",Map.of("accessTokenHash","ACCESS_TOKEN_HASH","client_id","CLIENT_ID")); + Assert.assertNotNull(result.getCredential()); + Assert.assertEquals(jsonLDObject,result.getCredential()); + Assert.assertEquals(result.getFormat(),"ldp_vc"); + Mockito.verify(keymanagerDBHelper).getKeyAliases(Mockito.anyString(), Mockito.anyString(), Mockito.any(LocalDateTime.class)); + } + + @Test + public void getVerifiableCredentialWithLinkedDataProof_withInValidIndividualId_thenFail() throws Exception { + + ReflectionTestUtils.setField(idaVCIssuancePlugin,"vciExchangeUrl","http://example.com"); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"storeIndividualId",true); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"secureIndividualId",true); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"aesECBTransformation","AES/ECB/PKCS5Padding"); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"cacheSecretKeyRefId","cacheSecretKeyRefId"); + + VCRequestDto vcRequestDto = new VCRequestDto(); + vcRequestDto.setFormat("ld_vc"); + vcRequestDto.setContext(Arrays.asList("context1","context2")); + vcRequestDto.setType(Arrays.asList("VerifiableCredential")); + vcRequestDto.setCredentialSubject(Map.of("subject1","subject1","subject2","subject2")); + + OIDCTransaction oidcTransaction = new OIDCTransaction(); + oidcTransaction.setIndividualId("individualId"); + oidcTransaction.setKycToken("kycToken"); + oidcTransaction.setAuthTransactionId("authTransactionId"); + oidcTransaction.setRelyingPartyId("relyingPartyId"); + + Mockito.when(vciTransactionHelper.getOAuthTransaction(Mockito.any())).thenReturn(oidcTransaction); + try{ + VCResult result= idaVCIssuancePlugin.getVerifiableCredentialWithLinkedDataProof(vcRequestDto,"holderId",Map.of("accessTokenHash","ACCESS_TOKEN_HASH","client_id","CLIENT_ID")); + Assert.fail(); + }catch (Exception e) + { + Assert.assertEquals("vci_exchange_failed",e.getMessage()); + } + } + + @Test + public void getVerifiableCredentialWithLinkedDataProof_withInVlidResponse_thenFail() throws Exception { + + ReflectionTestUtils.setField(idaVCIssuancePlugin,"vciExchangeUrl","http://example.com"); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"storeIndividualId",true); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"secureIndividualId",true); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"aesECBTransformation","AES/ECB/PKCS5Padding"); + ReflectionTestUtils.setField(idaVCIssuancePlugin,"cacheSecretKeyRefId","cacheSecretKeyRefId"); + + VCRequestDto vcRequestDto = new VCRequestDto(); + vcRequestDto.setFormat("ldp_vc"); + vcRequestDto.setContext(Arrays.asList("context1","context2")); + vcRequestDto.setType(Arrays.asList("VerifiableCredential")); + vcRequestDto.setCredentialSubject(Map.of("subject1","subject1","subject2","subject2")); + + KeyGenerator generator = KeyGenerator.getInstance("AES"); + generator.init(256); + SecretKey key = generator.generateKey(); + String individualId = encryptIndividualId("individual-id",key); + + OIDCTransaction oidcTransaction = new OIDCTransaction(); + oidcTransaction.setIndividualId(individualId); + oidcTransaction.setKycToken("kycToken"); + oidcTransaction.setAuthTransactionId("authTransactionId"); + oidcTransaction.setRelyingPartyId("relyingPartyId"); + + Map> keyaliasesMap = new HashMap<>(); + KeyAlias keyAlias = new KeyAlias(); + keyAlias.setAlias("test"); + keyaliasesMap.put(CURRENTKEYALIAS, Arrays.asList(keyAlias)); + Mockito.when(vciTransactionHelper.getOAuthTransaction(Mockito.any())).thenReturn(oidcTransaction); + Mockito.when(objectMapper.writeValueAsString(Mockito.any())).thenReturn("jsonString"); + Mockito.when(keymanagerDBHelper.getKeyAliases(Mockito.anyString(), Mockito.anyString(), Mockito.any(LocalDateTime.class))).thenReturn(keyaliasesMap); + Mockito.when(keyStore.getSymmetricKey(Mockito.anyString())).thenReturn(key, key); + + IdaResponseWrapper> mockResponseWrapper = new IdaResponseWrapper<>(); + IdaVcExchangeResponse mockResponse = new IdaVcExchangeResponse<>(); + JsonLDObject jsonLDObject = new JsonLDObject(); + jsonLDObject.setJsonObjectKeyValue("key", "value"); + mockResponse.setVerifiableCredentials(jsonLDObject); + mockResponseWrapper.setResponse(null); + mockResponseWrapper.setId("id"); + mockResponseWrapper.setVersion("version"); + mockResponseWrapper.setTransactionID("transactionID"); + + ResponseEntity>> mockResponseEntity = ResponseEntity.ok(mockResponseWrapper); + ParameterizedTypeReference>> responseType = + new ParameterizedTypeReference>>() { + }; + Mockito.when(restTemplate.exchange( + Mockito.any(RequestEntity.class), + Mockito.eq(responseType) + )).thenReturn(mockResponseEntity); + + try{ + VCResult result= idaVCIssuancePlugin.getVerifiableCredentialWithLinkedDataProof(vcRequestDto,"holderId",Map.of("accessTokenHash","ACCESS_TOKEN_HASH","client_id","CLIENT_ID")); + Assert.fail(); + }catch (Exception e) + { + Assert.assertEquals("vci_exchange_failed",e.getMessage()); + } + } + + private String encryptIndividualId(String individualId, Key key) { + try { + Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); + byte[] secretDataBytes = individualId.getBytes(StandardCharsets.UTF_8); + cipher.init(Cipher.ENCRYPT_MODE,key); + return IdentityProviderUtil.b64Encode(cipher.doFinal(secretDataBytes, 0, secretDataBytes.length)); + } catch(Exception e) { + throw new EsignetException(ErrorConstants.AES_CIPHER_FAILED); + } + } + +}