feat: P4ADEV-791-P4PA-AUTH-API-censimento-client-id

openapi/p4pa-auth.openapi.yaml

@@ -26,7 +26,8 @@ paths:
           required: true
           schema:
             enum: [
-              "urn:ietf:params:oauth:grant-type:token-exchange"
+              "urn:ietf:params:oauth:grant-type:token-exchange",
+              "client_credentials"
             ]
             type: string
         - name: subject_token
@@ -154,6 +155,66 @@ paths:
           description: Invalid request
         '401':
           description: Invalid client_id
+  /auth/clients/{organizationIpaCode}:
+    get:
+      tags:
+        - authz
+      operationId: getClients
+      parameters:
+        - name: organizationIpaCode
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ClientDTO'
+        '400':
+          description: Invalid request
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+        '412':
+          description: ToS acceptance missing
+        '429':
+          description: Too Many Requests
+    post:
+      tags:
+        - authz
+      operationId: registerClient
+      parameters:
+        - name: organizationIpaCode
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateClientRequest'
+        required: true
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: array
+                $ref: '#/components/schemas/ClientDTO'
+        '400':
+          description: Invalid request
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+        '429':
+          description: Too Many Requests
   /am/users:
     post:
       tags:
@@ -351,6 +412,25 @@ components:
           default: Bearer
         expires_in:
           type: integer
+    ClientDTO:
+      type: object
+      required:
+        - client_id
+        - client_Secret
+      properties:
+        client_id:
+          type: string
+        organizationIpaCode:
+          type: string
+        client_secret:
+          type: string
+    CreateClientRequest:
+      type: object
+      required:
+        - clientId
+      properties:
+        clientId:
+          type: string
     UserDTO:
       type: object
       required:

src/main/java/it/gov/pagopa/payhub/auth/controller/AuthzControllerImpl.java

@@ -4,10 +4,7 @@
 import it.gov.pagopa.payhub.auth.service.AuthzService;
 import it.gov.pagopa.payhub.auth.utils.SecurityUtils;
 import it.gov.pagopa.payhub.controller.generated.AuthzApi;
-import it.gov.pagopa.payhub.model.generated.CreateOperatorRequest;
-import it.gov.pagopa.payhub.model.generated.OperatorDTO;
-import it.gov.pagopa.payhub.model.generated.OperatorsPage;
-import it.gov.pagopa.payhub.model.generated.UserDTO;
+import it.gov.pagopa.payhub.model.generated.*;
 import it.gov.pagopa.payhub.model.generated.UserInfo;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.data.domain.Page;
@@ -99,4 +96,15 @@ public ResponseEntity<UserDTO> createUser(UserDTO user) {
         }
         return ResponseEntity.ok(authzService.createUser(user));
     }
+
+    @Override
+    public ResponseEntity<ClientDTO> registerClient(String organizationIpaCode, CreateClientRequest createClientRequest) {
+        if(organizationAccessMode){
+            return new ResponseEntity<>(HttpStatus.NOT_IMPLEMENTED);
+        }
+        if(!SecurityUtils.hasAdminRole()){
+            throw new UserUnauthorizedException("User not allowed to create client");
+        }
+        return ResponseEntity.ok(authzService.registerClient(organizationIpaCode, createClientRequest));
+    }
 }

src/main/java/it/gov/pagopa/payhub/auth/model/Client.java

@@ -0,0 +1,23 @@
+package it.gov.pagopa.payhub.auth.model;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import lombok.experimental.FieldNameConstants;
+import org.springframework.data.annotation.Id;
+import org.springframework.data.mongodb.core.mapping.Document;
+
+@Data
+@Document("clients")
+@NoArgsConstructor
+@AllArgsConstructor
+@Builder
+@FieldNameConstants
+public class Client {
+
+	@Id
+	private String clientId;
+	private String organizationIpaCode;
+	private String clientSecret;
+}

src/main/java/it/gov/pagopa/payhub/auth/repository/ClientRepository.java

@@ -0,0 +1,8 @@
+package it.gov.pagopa.payhub.auth.repository;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+import org.springframework.data.mongodb.repository.MongoRepository;
+
+public interface ClientRepository extends ClientRepositoryExt, MongoRepository<Client, String> {
+
+}

src/main/java/it/gov/pagopa/payhub/auth/repository/ClientRepositoryExt.java

@@ -0,0 +1,8 @@
+package it.gov.pagopa.payhub.auth.repository;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+
+public interface ClientRepositoryExt {
+
+	Client registerClient(String clientId, String organizationIpaCode, String clientSecret);
+}

src/main/java/it/gov/pagopa/payhub/auth/repository/ClientRepositoryExtImpl.java

@@ -0,0 +1,28 @@
+package it.gov.pagopa.payhub.auth.repository;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+import org.springframework.data.mongodb.core.FindAndModifyOptions;
+import org.springframework.data.mongodb.core.MongoTemplate;
+import org.springframework.data.mongodb.core.query.Criteria;
+import org.springframework.data.mongodb.core.query.Query;
+import org.springframework.data.mongodb.core.query.Update;
+
+public class ClientRepositoryExtImpl implements  ClientRepositoryExt {
+	private final MongoTemplate mongoTemplate;
+
+	public ClientRepositoryExtImpl(MongoTemplate mongoTemplate) { this.mongoTemplate = mongoTemplate;	}
+
+	@Override
+	public Client registerClient(String clientId, String organizationIpaCode, String clientSecret) {
+		return mongoTemplate.findAndModify(
+			Query.query(Criteria.where(Client.Fields.clientId).is(clientId)),
+			new Update()
+				.set(Client.Fields.organizationIpaCode, organizationIpaCode)
+				.set(Client.Fields.clientSecret, clientSecret),
+			FindAndModifyOptions.options()
+				.returnNew(true)
+				.upsert(true),
+			Client.class
+		);
+	}
+}

src/main/java/it/gov/pagopa/payhub/auth/service/AuthzService.java

@@ -1,8 +1,6 @@
 package it.gov.pagopa.payhub.auth.service;
 
-import it.gov.pagopa.payhub.model.generated.CreateOperatorRequest;
-import it.gov.pagopa.payhub.model.generated.OperatorDTO;
-import it.gov.pagopa.payhub.model.generated.UserDTO;
+import it.gov.pagopa.payhub.model.generated.*;
 import it.gov.pagopa.payhub.model.generated.UserInfo;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
@@ -15,4 +13,5 @@ public interface AuthzService {
     OperatorDTO createOrganizationOperator(String organizationIpaCode, CreateOperatorRequest createOperatorRequest);
     UserDTO createUser(UserDTO user);
     UserInfo getUserInfoFromMappedExternalUserId(String mappedExternalUserId);
+    ClientDTO registerClient(String organizationIpaCode, CreateClientRequest createClientRequest);
 }

src/main/java/it/gov/pagopa/payhub/auth/service/AuthzServiceImpl.java

@@ -2,17 +2,18 @@
 
 import it.gov.pagopa.payhub.auth.exception.custom.OperatorNotFoundException;
 import it.gov.pagopa.payhub.auth.exception.custom.UserNotFoundException;
+import it.gov.pagopa.payhub.auth.model.Client;
 import it.gov.pagopa.payhub.auth.model.Operator;
 import it.gov.pagopa.payhub.auth.model.User;
 import it.gov.pagopa.payhub.auth.repository.OperatorsRepository;
 import it.gov.pagopa.payhub.auth.repository.UsersRepository;
+import it.gov.pagopa.payhub.auth.service.a2a.ClientService;
+import it.gov.pagopa.payhub.auth.service.a2a.retreive.ClientDTOMapper;
 import it.gov.pagopa.payhub.auth.service.user.UserService;
 import it.gov.pagopa.payhub.auth.service.user.retrieve.Operator2UserInfoMapper;
 import it.gov.pagopa.payhub.auth.service.user.retrieve.OperatorDTOMapper;
 import it.gov.pagopa.payhub.auth.service.user.retrieve.UserDTOMapper;
-import it.gov.pagopa.payhub.model.generated.CreateOperatorRequest;
-import it.gov.pagopa.payhub.model.generated.OperatorDTO;
-import it.gov.pagopa.payhub.model.generated.UserDTO;
+import it.gov.pagopa.payhub.model.generated.*;
 import it.gov.pagopa.payhub.model.generated.UserInfo;
 import jakarta.transaction.Transactional;
 import java.util.HashSet;
@@ -28,22 +29,26 @@
 public class AuthzServiceImpl implements AuthzService {
 
     private final UserService userService;
+    private final ClientService clientService;
     private final UsersRepository usersRepository;
     private final OperatorsRepository operatorsRepository;
     private final OperatorDTOMapper operatorDTOMapper;
     private final UserDTOMapper userDTOMapper;
     private final Operator2UserInfoMapper operator2UserInfoMapper;
+    private final ClientDTOMapper clientDTOMapper;
     private static final String MYPAYIAMISSUERS = "MYPAY";
 
-    public AuthzServiceImpl(UserService userService, UsersRepository usersRepository,
-        OperatorsRepository operatorsRepository, OperatorDTOMapper operatorDTOMapper,
-        UserDTOMapper userDTOMapper, Operator2UserInfoMapper operator2UserInfoMapper) {
+    public AuthzServiceImpl(UserService userService, ClientService clientService, UsersRepository usersRepository,
+        OperatorsRepository operatorsRepository, OperatorDTOMapper operatorDTOMapper, UserDTOMapper userDTOMapper,
+        Operator2UserInfoMapper operator2UserInfoMapper, ClientDTOMapper clientDTOMapper) {
         this.userService = userService;
+        this.clientService = clientService;
         this.usersRepository = usersRepository;
         this.operatorsRepository = operatorsRepository;
         this.operatorDTOMapper = operatorDTOMapper;
         this.userDTOMapper = userDTOMapper;
         this.operator2UserInfoMapper = operator2UserInfoMapper;
+        this.clientDTOMapper = clientDTOMapper;
     }
 
     @Override
@@ -101,4 +106,10 @@ public UserInfo getUserInfoFromMappedExternalUserId(String mappedExternalUserId)
         List<Operator> operators = operatorsRepository.findAllByUserId(user.getUserId());
         return operator2UserInfoMapper.apply(user, operators);
     }
+
+    @Override
+    public ClientDTO registerClient(String organizationIpaCode, CreateClientRequest createClientRequest) {
+        Client client = clientService.registerClient(createClientRequest.getClientId(), organizationIpaCode);
+        return clientDTOMapper.map(client);
+    }
 }

src/main/java/it/gov/pagopa/payhub/auth/service/a2a/ClientService.java

@@ -0,0 +1,8 @@
+package it.gov.pagopa.payhub.auth.service.a2a;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+
+public interface ClientService {
+
+	Client registerClient(String clientId, String organizationIpaCode);
+}

src/main/java/it/gov/pagopa/payhub/auth/service/a2a/ClientServiceImpl.java

@@ -0,0 +1,22 @@
+package it.gov.pagopa.payhub.auth.service.a2a;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+import it.gov.pagopa.payhub.auth.service.a2a.registration.ClientRegistrationService;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+@Service
+@Slf4j
+public class ClientServiceImpl implements ClientService {
+
+	private final ClientRegistrationService clientRegistrationService;
+
+	public ClientServiceImpl(ClientRegistrationService clientRegistrationService) {
+		this.clientRegistrationService = clientRegistrationService;
+	}
+
+	@Override
+	public Client registerClient(String clientId, String organizationIpaCode) {
+		return clientRegistrationService.registerClient(clientId, organizationIpaCode);
+	}
+}

src/main/java/it/gov/pagopa/payhub/auth/service/a2a/registration/ClientRegistrationService.java

@@ -0,0 +1,27 @@
+package it.gov.pagopa.payhub.auth.service.a2a.registration;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+import it.gov.pagopa.payhub.auth.repository.ClientRepository;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.util.UUID;
+
+@Service
+@Slf4j
+public class ClientRegistrationService {
+
+	private final ClientSecretGeneratorService clientSecretGeneratorService;
+	private final ClientRepository clientRepository;
+
+	public ClientRegistrationService(ClientSecretGeneratorService clientSecretGeneratorService, ClientRepository clientRepository) {
+		this.clientSecretGeneratorService = clientSecretGeneratorService;
+		this.clientRepository = clientRepository;
+	}
+
+	public Client registerClient(String clientId, String organizationIpaCode) {
+		String clientSecret = clientSecretGeneratorService.apply(UUID.randomUUID().toString());
+		log.info("Registering client having clientId {} and organizationIpaCode {}", clientId, organizationIpaCode);
+		return clientRepository.registerClient(clientId, organizationIpaCode, clientSecret);
+	}
+}

src/main/java/it/gov/pagopa/payhub/auth/service/a2a/registration/ClientSecretGeneratorService.java

@@ -0,0 +1,22 @@
+package it.gov.pagopa.payhub.auth.service.a2a.registration;
+
+import it.gov.pagopa.payhub.auth.service.DataCipherService;
+import org.springframework.stereotype.Service;
+
+import java.util.Base64;
+import java.util.function.Function;
+
+@Service
+public class ClientSecretGeneratorService implements Function<String, String> {
+
+	private final DataCipherService dataCipherService;
+
+	public ClientSecretGeneratorService(DataCipherService dataCipherService) {
+		this.dataCipherService = dataCipherService;
+	}
+
+	@Override
+	public String apply(String clientSecret) {
+		return Base64.getUrlEncoder().encodeToString(dataCipherService.hash(clientSecret));
+	}
+}

src/main/java/it/gov/pagopa/payhub/auth/service/a2a/retreive/ClientDTOMapper.java

@@ -0,0 +1,17 @@
+package it.gov.pagopa.payhub.auth.service.a2a.retreive;
+
+import it.gov.pagopa.payhub.auth.model.Client;
+import it.gov.pagopa.payhub.model.generated.ClientDTO;
+import org.springframework.stereotype.Service;
+
+@Service
+public class ClientDTOMapper {
+
+	public ClientDTO map(Client client) {
+		return ClientDTO.builder()
+			.clientId(client.getClientId())
+			.organizationIpaCode(client.getOrganizationIpaCode())
+			.clientSecret(client.getClientSecret())
+			.build();
+	}
+}