Use sdk for callback verification 🤦

build.gradle.kts

@@ -37,6 +37,7 @@ dependencies {
     implementation(libs.spring.boot.starter.actuator)
     implementation(libs.spring.boot.starter.security)
     implementation(libs.spring.boot.starter.web)
+    implementation("org.springframework.cloud:spring-cloud-starter-kubernetes-client-config:3.1.3")
     implementation(libs.fitko.fitconnect.sdk)
 
     compileOnly(libs.lombok)

gradle/libs.versions.toml

@@ -13,6 +13,7 @@ spring-boot-starter-actuator = { module = "org.springframework.boot:spring-boot-
 spring-boot-starter-security = { module = "org.springframework.boot:spring-boot-starter-security" }
 spring-boot-starter-web = { module = "org.springframework.boot:spring-boot-starter-web" }
 spring-boot-starter-test = { module = "org.springframework.boot:spring-boot-starter-test" }
+spring-cloud-starter-kubernetes-client-config = { module = "org.springframework.cloud:spring-cloud-starter-kubernetes-client-config"}
 spring-security-test = { module = "org.springframework.security:spring-security-test" }
 fitko-fitconnect-sdk = "dev.fitko.fitconnect.sdk:client:2.3.0"
 

src/main/java/de/bund/digitalservice/a2j/config/SecurityConfig.java

@@ -1,7 +1,6 @@
 package de.bund.digitalservice.a2j.config;
 
-import de.bund.digitalservice.a2j.service.receiver.verification.CallbackVerificationFilter;
-import de.bund.digitalservice.a2j.service.receiver.verification.CallbackVerificationService;
+import de.bund.digitalservice.a2j.service.receiver.CallbackVerificationFilter;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -13,10 +12,11 @@
 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {
-  private final CallbackVerificationService callbackVerificationService;
 
-  public SecurityConfig(CallbackVerificationService callbackVerificationService) {
-    this.callbackVerificationService = callbackVerificationService;
+  private final CallbackVerificationFilter callbackVerificationFilter;
+
+  public SecurityConfig(CallbackVerificationFilter callbackVerificationFilter) {
+    this.callbackVerificationFilter = callbackVerificationFilter;
   }
 
   @Bean
@@ -36,9 +36,7 @@ public SecurityFilterChain springSecurityWebFilterChain(HttpSecurity http) throw
                     .permitAll()
                     .anyRequest()
                     .denyAll())
-        .addFilterAfter(
-            new CallbackVerificationFilter(callbackVerificationService),
-            BasicAuthenticationFilter.class)
+        .addFilterAfter(callbackVerificationFilter, BasicAuthenticationFilter.class)
         .build();
   }
 

src/main/java/de/bund/digitalservice/a2j/service/receiver/CallbackVerificationFilter.java

@@ -0,0 +1,50 @@
+package de.bund.digitalservice.a2j.service.receiver;
+
+import dev.fitko.fitconnect.client.SenderClient;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import org.jetbrains.annotations.NotNull;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+@Component
+public class CallbackVerificationFilter extends OncePerRequestFilter {
+  private final SenderClient senderClient;
+  private final String callbackSecret;
+
+  public CallbackVerificationFilter(
+      SenderClient senderClient, @Value("${callbackSecret}") String callbackSecret) {
+    this.senderClient = senderClient;
+    this.callbackSecret = callbackSecret;
+  }
+
+  @Override
+  protected boolean shouldNotFilter(HttpServletRequest request) {
+    return !request.getServletPath().startsWith("/callbacks/fit-connect");
+  }
+
+  @Override
+  protected void doFilterInternal(
+      HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain chain)
+      throws ServletException, IOException {
+
+    if (!senderClient
+        .validateCallback(
+            request.getHeader("callback-athentication"),
+            Long.parseLong(request.getHeader("callback-timestamp")),
+            request.getReader().lines().reduce("", String::concat),
+            callbackSecret)
+        .isValid()) {
+
+      System.out.println("Received fit-connect callback, returned 401");
+      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+      return;
+    }
+
+    chain.doFilter(request, response);
+  }
+}

src/main/resources/application-local.yaml

@@ -0,0 +1,8 @@
+submission:
+  destination: d0fe1fad-d6f1-4c67-b4e7-9d0ca6663bf3
+  serviceType:
+    urn: urn:de:fim:leika:leistung:99400048079000
+    name: Simple Dummy Service
+  jsonUri: https://schema.fitko.de/fim/s17000717_1.0.schema.json
+
+callbackSecret: s3cr3t

src/main/resources/application.yaml

@@ -1,9 +1,10 @@
-submission:
-  destination: d0fe1fad-d6f1-4c67-b4e7-9d0ca6663bf3
-  serviceType:
-    urn: urn:de:fim:leika:leistung:99400048079000
-    name: Simple Dummy Service
-  jsonUri: https://schema.fitko.de/fim/s17000717_1.0.schema.json
+spring:
+  cloud:
+    kubernetes:
+      secrets:
+        enabled: true
+        fail-fast: true
+        paths: /etc/secrets
 
 management:
   endpoint: