Do not cache disabled tokens (#7061)

* Deactivated records should get 409 on GET requests * Do not cache the token if it id disabled, since the token does not know its disabled state * Remove unused imports
ORCID · Aug 6, 2024 · ee144da · ee144da
1 parent 168063c
commit ee144da
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 8 deletions.
diff --git a/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java b/orcid-api-common/src/main/java/org/orcid/api/common/jaxb/OrcidExceptionMapper.java
@@ -130,6 +130,8 @@ public Response toResponse(Throwable t) {
             logShortError(t, clientId);
         }  else if (t instanceof InvalidPutCodeException) {
             logShortError(t, clientId);
+        } else if (t instanceof MismatchedPutCodeException) {
+            logShortError(t, clientId);
         } else {
             LOGGER.error("An exception has occured processing request from client " + clientId, t);
         }

diff --git a/.../src/main/java/org/orcid/api/common/oauth/OrcidClientCredentialEndPointDelegatorImpl.java b/.../src/main/java/org/orcid/api/common/oauth/OrcidClientCredentialEndPointDelegatorImpl.java
@@ -162,8 +162,11 @@ public Response obtainOauth2Token(String authorization, MultivaluedMap<String, S
                 }                
             }
 
+            // Do not put the token in the cache if the token is disabled
+            if(token.getAdditionalInformation() != null && !token.getAdditionalInformation().containsKey(OrcidOauth2Constants.TOKEN_DISABLED)) {
+                setToCache(client.getName(), token);
+            }
             removeMetadataFromToken(token);
-            setToCache(client.getName(), token);
             return getResponse(token);
         } catch (InvalidGrantException e){ //this needs to be caught here so the transaction doesn't roll back
             OAuthError error = OAuthErrorUtils.getOAuthError(e);
@@ -307,6 +310,8 @@ protected void removeMetadataFromToken(OAuth2AccessToken accessToken) {
                 accessToken.getAdditionalInformation().remove(OrcidOauth2Constants.DATE_CREATED);
             if(accessToken.getAdditionalInformation().containsKey(OrcidOauth2Constants.TOKEN_ID))
                 accessToken.getAdditionalInformation().remove(OrcidOauth2Constants.TOKEN_ID);
+            if(accessToken.getAdditionalInformation().containsKey(OrcidOauth2Constants.TOKEN_DISABLED))
+                accessToken.getAdditionalInformation().remove(OrcidOauth2Constants.TOKEN_DISABLED);
         }
     }
 

diff --git a/orcid-core/src/main/java/org/orcid/core/constants/OrcidOauth2Constants.java b/orcid-core/src/main/java/org/orcid/core/constants/OrcidOauth2Constants.java
@@ -58,6 +58,7 @@ public class OrcidOauth2Constants {
     public static final String IETF_EXCHANGE_SUBJECT_TOKEN = "subject_token";
     public static final String IETF_EXCHANGE_SUBJECT_TOKEN_TYPE = "subject_token_type";
     public static final String IETF_EXCHANGE_REQUESTED_TOKEN_TYPE = "requested_token_type";
+    public static final String TOKEN_DISABLED = "token_disabled";
 
     public static final String CODE_RESPONSE_TYPE = "code";
 

diff --git a/orcid-core/src/main/java/org/orcid/core/oauth/IETFTokenExchangeResponse.java b/orcid-core/src/main/java/org/orcid/core/oauth/IETFTokenExchangeResponse.java
@@ -13,6 +13,8 @@
 
 import com.nimbusds.jwt.SignedJWT;
 
+import static org.orcid.core.constants.OrcidOauth2Constants.TOKEN_DISABLED;
+
 public class IETFTokenExchangeResponse implements OAuth2AccessToken {
 
     private Map<String, Object> additionalInformation = new HashMap<String, Object>();
@@ -47,6 +49,9 @@ public static  IETFTokenExchangeResponse accessToken(OAuth2AccessToken accessTok
         if (accessToken.getAdditionalInformation().containsKey("name")) {
             token.additionalInformation.put("name",accessToken.getAdditionalInformation().get("name"));
         }
+        if(accessToken.getAdditionalInformation().containsKey(TOKEN_DISABLED)) {
+            token.additionalInformation.put(TOKEN_DISABLED, "true");
+        }
         return token;
     }
 

diff --git a/orcid-core/src/main/java/org/orcid/core/oauth/service/OrcidRandomValueTokenServicesImpl.java b/orcid-core/src/main/java/org/orcid/core/oauth/service/OrcidRandomValueTokenServicesImpl.java
@@ -1,12 +1,6 @@
 package org.orcid.core.oauth.service;
 
-import java.util.Collection;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
+import java.util.*;
 
 import javax.annotation.Resource;
 import javax.persistence.PersistenceException;
@@ -465,6 +459,10 @@ public OAuth2AccessToken createRevokedAccessToken(OAuth2Authentication authentic
         // create the regular token
         DefaultOAuth2AccessToken accessToken = generateAccessToken(authentication);
         try {
+            if(accessToken.getAdditionalInformation() == null) {
+                accessToken.setAdditionalInformation(Collections.emptyMap());
+            }
+            accessToken.getAdditionalInformation().put(OrcidOauth2Constants.TOKEN_DISABLED, true);
             orcidTokenStore.storeRevokedAccessToken(accessToken, authentication, revokeReason);
         } catch (PersistenceException e) {
             // In the unlikely case that there is a constraint violation, lets