@Test
public void shouldAuthenticateClient() throws Exception {
    Client client = mock(Client.class);
    when(client.getClientId()).thenReturn("my-client-id");
    when(client.getClientSecret()).thenReturn("my-client-secret");

    HttpServerRequest httpServerRequest = mock(HttpServerRequest.class);
    VertxHttpHeaders vertxHttpHeaders = new VertxHttpHeaders();
    vertxHttpHeaders.add(HttpHeaders.AUTHORIZATION, "Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=");
    when(httpServerRequest.headers()).thenReturn(MultiMap.newInstance(vertxHttpHeaders));

    CountDownLatch latch = new CountDownLatch(1);
    authProvider.handle(client, httpServerRequest, clientAsyncResult -> {
        latch.countDown();
        Assert.assertNotNull(clientAsyncResult);
        Assert.assertNotNull(clientAsyncResult.result());
    });

    assertTrue(latch.await(10, TimeUnit.SECONDS));
}
 

@Test
public void shouldNotAuthenticateClient_badClientSecret() throws Exception {
    Client client = mock(Client.class);
    when(client.getClientId()).thenReturn("my-client-id");
    when(client.getClientSecret()).thenReturn("my-client-secret");

    HttpServerRequest httpServerRequest = mock(HttpServerRequest.class);
    VertxHttpHeaders vertxHttpHeaders = new VertxHttpHeaders();
    vertxHttpHeaders.add(HttpHeaders.AUTHORIZATION, "Basic bXktY2xpZW50LWlkOm15LW90aGVyLWNsaWVudC1zZWNyZXQ=");
    when(httpServerRequest.headers()).thenReturn(MultiMap.newInstance(vertxHttpHeaders));

    CountDownLatch latch = new CountDownLatch(1);
    authProvider.handle(client, httpServerRequest, userAsyncResult -> {
        latch.countDown();
        Assert.assertNotNull(userAsyncResult);
        Assert.assertTrue(userAsyncResult.failed());
        Assert.assertTrue(userAsyncResult.cause() instanceof InvalidClientException);
    });

    assertTrue(latch.await(10, TimeUnit.SECONDS));
}
 

@Override
public Map<String, Set<String>> getRequestParameters() {
	MultiMap params = serverRequest.params();

	Map<String, Set<String>> map = new HashMap<>();
	for (String name : params.names()) {
		HashSet<String> set = new HashSet<>(params.getAll(name));
		map.put(name, set);
	}
	return map;
}
 

@Override
public Single<Boolean> isValid(String token) {

    if (!this.isEnabled()) {
        logger.debug("ReCaptchaService is disabled");
        return Single.just(true);
    }

    logger.debug("ReCaptchaService is enabled");

    if (token == null || "".equals(token.trim())) {
        logger.debug("Recaptcha token is empty");
        return Single.just(false);
    }

    return client.post(URI.create(serviceUrl).toString())
            .rxSendForm(MultiMap.caseInsensitiveMultiMap().set("secret", secretKey).set("response", token))
            .map(buffer -> {
                Map res = objectMapper.readValue(buffer.bodyAsString(), Map.class);

                Boolean success = (Boolean) res.getOrDefault("success", false);
                Double score = (Double) res.getOrDefault("score", 0.0d);

                logger.debug("ReCaptchaService success: {} score: {}", success, score);

                // Result should be successful and score above 0.5.
                return (success && score >= minScore);
            })
            .onErrorResumeNext(throwable -> {
                logger.error("An error occurred when trying to validate ReCaptcha token.", throwable);
                return Single.just(false);
            });
}
 

@Override
public void handle(RoutingContext context) {
    HttpServerRequest req = context.request();
    if (req.method() != HttpMethod.POST) {
        context.fail(405); // Must be a POST
    } else {
        if (!req.isExpectMultipart()) {
            throw new IllegalStateException("Form body not parsed - do you forget to include a BodyHandler?");
        }
        // check required parameters
        MultiMap params = req.formAttributes();
        Optional<String> missingParameter = requiredParams.stream().filter(param -> {
            String paramValue = params.get(param);
            if (paramValue == null) {
                logger.warn("No {} provided in form - did you forget to include a BodyHandler?", param);
                return true;
            }
            return false;
        }).findFirst();

        if (missingParameter.isPresent()) {
            redirectToPage(context, Collections.singletonMap(ERROR_PARAM, "missing_required_parameters"));
        } else {
            context.next();
        }
    }

}
 

private void saveEnrollment(RoutingContext routingContext) {
    MultiMap params = routingContext.request().formAttributes();
    final Boolean acceptEnrollment = Boolean.valueOf(params.get("user_mfa_enrollment"));
    final String factorId = params.get("factorId");
    final String sharedSecret = params.get("sharedSecret");
    if (factorId == null) {
        logger.warn("No factor id in form - did you forget to include factor id value ?");
        routingContext.fail(400);
        return;
    }
    if (sharedSecret == null) {
        logger.warn("No shared secret in form - did you forget to include shared secret value ?");
        routingContext.fail(400);
        return;
    }
    // manage enrolled factors
    // if user has skipped the enrollment process, continue
    final String returnURL = routingContext.session().get(FormLoginHandler.DEFAULT_RETURN_URL_PARAM);
    if (!acceptEnrollment) {
        routingContext.session().put(MFA_SKIPPED_KEY, true);
        doRedirect(routingContext.response(), returnURL);
        return;
    }
    // save enrolled factor for the current user and continue
    EnrolledFactor enrolledFactor = new EnrolledFactor();
    enrolledFactor.setFactorId(factorId);
    enrolledFactor.setSecurity(new EnrolledFactorSecurity(FactorSecurityType.SHARED_SECRET, sharedSecret));
    enrolledFactor.setCreatedAt(new Date());
    enrolledFactor.setUpdatedAt(enrolledFactor.getCreatedAt());
    routingContext.session().put(ENROLLED_FACTOR_KEY, enrolledFactor);
    doRedirect(routingContext.response(), returnURL);
}
 

private User convert(MultiMap params) {
    User user = new User();
    user.setUsername(params.get("username"));
    user.setFirstName(params.get("firstName"));
    user.setLastName(params.get("lastName"));
    user.setEmail(params.get("email"));
    user.setPassword(params.get("password"));
    user.setClient(params.get("client_id"));

    return user;


}
 

private void parseRequestParameters(RoutingContext context) {
    // invalid_request if the request is missing a required parameter, includes an
    // invalid parameter value, includes a parameter more than once, or is otherwise malformed.
    MultiMap requestParameters = context.request().params();
    Set<String> requestParametersNames = requestParameters.names();
    requestParametersNames.forEach(requestParameterName -> {
        List<String> requestParameterValue = requestParameters.getAll(requestParameterName);
        if (requestParameterValue.size() > 1) {
            throw new InvalidRequestException("Parameter [" + requestParameterName + "] is included more than once");
        }
    });
}
 

private void parseRequestParameters(RoutingContext context) {
    // invalid_request if the request is missing a required parameter, includes an
    // invalid parameter value, includes a parameter more than once, or is otherwise malformed.
    MultiMap requestParameters = context.request().params();
    Set<String> requestParametersNames = requestParameters.names();
    requestParametersNames.forEach(requestParameterName -> {
        List<String> requestParameterValue = requestParameters.getAll(requestParameterName);
        if (requestParameterValue.size() > 1) {
            throw new InvalidRequestException("Parameter [" + requestParameterName + "] is included more than once");
        }
    });
}
 

@Test
public void shouldCreateRequest_additionalParameters() {
    List<Map.Entry<String, String>> entries = new ArrayList<>();
    entries.add(new Parameter<>(Parameters.CLIENT_ID, "client-id"));
    entries.add(new Parameter<>(Parameters.SCOPE, "scope"));
    entries.add(new Parameter<>(Parameters.GRANT_TYPE, "grant_type"));
    entries.add(new Parameter<>("custom", "additional-parameter"));

    io.vertx.core.MultiMap multiMap = mock(io.vertx.core.MultiMap.class);
    when(multiMap.entries()).thenReturn(entries);

    MultiMap rxMultiMap = mock(MultiMap.class);
    when(rxMultiMap.getDelegate()).thenReturn(multiMap);

    io.vertx.core.http.HttpServerRequest httpServerRequest = mock(io.vertx.core.http.HttpServerRequest.class);
    when(httpServerRequest.method()).thenReturn(HttpMethod.POST);

    HttpServerRequest rxHttpServerRequest = mock(HttpServerRequest.class);
    when(rxHttpServerRequest.params()).thenReturn(rxMultiMap);
    when(rxHttpServerRequest.params().get(Parameters.CLIENT_ID)).thenReturn("client-id");
    when(rxHttpServerRequest.params().get(Parameters.SCOPE)).thenReturn("scope");
    when(rxHttpServerRequest.params().get(Parameters.GRANT_TYPE)).thenReturn("grant_type");
    when(rxHttpServerRequest.params().entries()).thenReturn(entries);
    when(rxHttpServerRequest.getDelegate()).thenReturn(httpServerRequest);

    TokenRequest tokenRequest = tokenRequestFactory.create(rxHttpServerRequest);

    Assert.assertNotNull(tokenRequest);
    Assert.assertEquals("client-id", tokenRequest.getClientId());
    Assert.assertTrue(tokenRequest.getAdditionalParameters().size() == 1 && tokenRequest.getAdditionalParameters().containsKey("custom"));
}
 

@Test
public void shouldCreateRequest_additionalParameters() {
    List<Map.Entry<String, String>> entries = new ArrayList<>();
    entries.add(new Parameter<>(Parameters.CLIENT_ID, "client-id"));
    entries.add(new Parameter<>(Parameters.SCOPE, "scope"));
    entries.add(new Parameter<>("custom", "additional-parameter"));

    io.vertx.core.MultiMap multiMap = mock(io.vertx.core.MultiMap.class);
    when(multiMap.entries()).thenReturn(entries);

    MultiMap rxMultiMap = mock(MultiMap.class);
    when(rxMultiMap.getDelegate()).thenReturn(multiMap);

    io.vertx.core.http.HttpServerRequest httpServerRequest = mock(io.vertx.core.http.HttpServerRequest.class);
    when(httpServerRequest.method()).thenReturn(HttpMethod.POST);

    HttpServerRequest rxHttpServerRequest = mock(HttpServerRequest.class);
    when(rxHttpServerRequest.params()).thenReturn(rxMultiMap);
    when(rxHttpServerRequest.params().get(Parameters.CLIENT_ID)).thenReturn("client-id");
    when(rxHttpServerRequest.params().get(Parameters.SCOPE)).thenReturn("scope");
    when(rxHttpServerRequest.params().entries()).thenReturn(entries);
    when(rxHttpServerRequest.getDelegate()).thenReturn(httpServerRequest);

    AuthorizationRequest authorizationRequest = authorizationRequestFactory.create(rxHttpServerRequest);

    Assert.assertNotNull(authorizationRequest);
    Assert.assertEquals("client-id", authorizationRequest.getClientId());
    Assert.assertTrue(authorizationRequest.getAdditionalParameters().size() == 1 && authorizationRequest.getAdditionalParameters().containsKey("custom"));
}
 

private void verifyCode(RoutingContext routingContext) {
    io.gravitee.am.model.User endUser = ((io.gravitee.am.gateway.handler.common.vertx.web.auth.user.User) routingContext.user().getDelegate()).getUser();
    MultiMap params = routingContext.request().formAttributes();
    final String code = params.get("code");
    final String factorId = params.get("factorId");
    if (code == null) {
        logger.warn("No code in form - did you forget to include code value ?");
        routingContext.fail(400);
        return;
    }
    if (factorId == null) {
        logger.warn("No factor id in form - did you forget to include factor id value ?");
        routingContext.fail(400);
        return;
    }
    FactorProvider factorProvider = factorManager.get(factorId);
    EnrolledFactor enrolledFactor = getEnrolledFactor(routingContext, factorId, endUser);
    final String sharedSecret = enrolledFactor.getSecurity().getValue();
    verify(factorProvider, code, sharedSecret, h -> {
        if (h.failed()) {
            handleException(routingContext);
            return;
        }
        // save enrolled factor if needed and redirect to the original url
        final String returnURL = routingContext.session().get(FormLoginHandler.DEFAULT_RETURN_URL_PARAM);
        if (routingContext.session().get(ENROLLED_FACTOR_KEY) != null) {
            saveFactor(endUser.getId(), enrolledFactor, fh -> {
                if (fh.failed()) {
                    logger.error("An error occurs while saving enrolled factor for the current user", fh.cause());
                    handleException(routingContext);
                    return;
                }
                // clean session
                routingContext.session().remove(ENROLLED_FACTOR_KEY);
                // update user strong auth status
                routingContext.session().put(STRONG_AUTH_COMPLETED, true);
                doRedirect(routingContext.request().response(), returnURL);
            });
        } else {
            // update user strong auth status
            routingContext.session().put(STRONG_AUTH_COMPLETED, true);
            doRedirect(routingContext.request().response(), returnURL);
        }
    });
}
 

@Override
public void handle(RoutingContext context) {
    // retrieve the client in context
    Client client = context.get("client");

    // create the user
    MultiMap params = context.request().formAttributes();
    User user = convert(params);

    // register the user
    register(client, user, getAuthenticatedUser(context), h -> {
        // prepare response
        Map<String, String> queryParams = new HashMap<>();
        // add client_id parameter for future use
        if (client != null) {
            queryParams.put(Parameters.CLIENT_ID, client.getClientId());
        }

        // if failure, return to the register page with an error
        if (h.failed()) {
            if (h.cause() instanceof InvalidUserException) {
                queryParams.put(WARNING_PARAM, "invalid_user_information");
            } else if (h.cause() instanceof EmailFormatInvalidException) {
                queryParams.put(WARNING_PARAM, "invalid_email");
            } else {
                LOGGER.error("An error occurs while ending user registration", h.cause());
                queryParams.put(ERROR_PARAM, "registration_failed");
            }
            redirectToPage(context, queryParams, h.cause());
            return;
        }

        // handle response
        RegistrationResponse registrationResponse = h.result();
        // if auto login option is enabled add the user to the session
        if (registrationResponse.isAutoLogin()) {
            context.setUser(io.vertx.reactivex.ext.auth.User.newInstance(new io.gravitee.am.gateway.handler.common.vertx.web.auth.user.User(registrationResponse.getUser())));
        }
        // no redirect uri has been set, redirect to the default page
        if (registrationResponse.getRedirectUri() == null || registrationResponse.getRedirectUri().isEmpty()) {
            queryParams.put(SUCCESS_PARAM, "registration_succeed");
            redirectToPage(context, queryParams);
            return;
        }
        // else, redirect to the custom redirect_uri
        context.response()
                .putHeader(HttpHeaders.LOCATION, registrationResponse.getRedirectUri())
                .setStatusCode(302)
                .end();
    });
}
 

@Override
public void handle(RoutingContext routingContext) {
    final HttpServerRequest request = routingContext.request();
    final Session session = routingContext.session();
    final Client client = routingContext.get(CLIENT_CONTEXT_KEY);
    final io.gravitee.am.model.User user = ((User) routingContext.user().getDelegate()).getUser();
    final Set<String> requestedConsent = session.get(REQUESTED_CONSENT_CONTEXT_KEY);
    final AuthorizationRequest authorizationRequest = session.get(OAuth2Constants.AUTHORIZATION_REQUEST);

    // get user consent
    MultiMap params = routingContext.request().formAttributes();
    Map<String, String> userConsent = params.entries().stream()
            .filter(entry -> entry.getKey().startsWith(SCOPE_PREFIX))
            .collect(Collectors.toMap(scopeEntry -> scopeEntry.getKey(), scopeEntry -> params.get(USER_OAUTH_APPROVAL)));

    // compute user consent that have been approved / denied
    Set<String> approvedConsent = new HashSet<>();
    List<ScopeApproval> approvals = new ArrayList<>();
    for (String requestedScope : requestedConsent) {
        String approvalParameter = requestedScope;
        String value = userConsent.get(SCOPE_PREFIX + approvalParameter);
        value = value == null ? "" : value.toLowerCase();
        if ("true".equals(value) || value.startsWith("approve")) {
            approvedConsent.add(requestedScope);
            approvals.add(new ScopeApproval(authorizationRequest.transactionId(), user.getId(), client.getClientId(), domain.getId(),
                    requestedScope, ScopeApproval.ApprovalStatus.APPROVED));
        }
        else {
            approvals.add(new ScopeApproval(authorizationRequest.transactionId(), user.getId(), client.getClientId(), domain.getId(),
                    requestedScope, ScopeApproval.ApprovalStatus.DENIED));
        }
    }

    // save consent
    saveConsent(request, user, client, approvals, h -> {
        if (h.failed()) {
            routingContext.fail(h.cause());
            return;
        }

        boolean approved = (approvedConsent.isEmpty() && !requestedConsent.isEmpty()) ? false : true;
        authorizationRequest.setApproved(approved);
        authorizationRequest.setScopes(approvedConsent);
        authorizationRequest.setConsents(h.result());
        session.put(USER_CONSENT_COMPLETED_CONTEXT_KEY, true);
        routingContext.next();
    });
}
 

private Single<HttpResponse<Buffer>> processRequest(TemplateEngine templateEngine,
                                                    String httpURI,
                                                    HttpMethod httpMethod,
                                                    List<HttpHeader> httpHeaders,
                                                    String httpBody) {
    // prepare request
    final String evaluatedHttpURI = templateEngine.getValue(httpURI, String.class);
    final HttpRequest<Buffer> httpRequest = client.requestAbs(httpMethod, evaluatedHttpURI);

    // set headers
    if (httpHeaders != null) {
        httpHeaders.forEach(header -> {
            String extValue = templateEngine.getValue(header.getValue(), String.class);
            httpRequest.putHeader(header.getName(), extValue);
        });
    }

    // set body
    Single<HttpResponse<Buffer>> responseHandler;
    if (httpBody != null && !httpBody.isEmpty()) {
        String bodyRequest = templateEngine.getValue(httpBody, String.class);
        if (!httpRequest.headers().contains(HttpHeaders.CONTENT_TYPE)) {
            httpRequest.putHeader(HttpHeaders.CONTENT_LENGTH, String.valueOf(bodyRequest.length()));
            responseHandler = httpRequest.rxSendBuffer(Buffer.buffer(bodyRequest));
        } else {
            String contentTypeHeader = httpRequest.headers().get(HttpHeaders.CONTENT_TYPE);
            switch (contentTypeHeader) {
                case(MediaType.APPLICATION_JSON):
                    responseHandler = httpRequest.rxSendJsonObject(new JsonObject(bodyRequest));
                    break;
                case(MediaType.APPLICATION_FORM_URLENCODED):
                    Map<String, String> queryParameters = format(bodyRequest);
                    MultiMap multiMap = MultiMap.caseInsensitiveMultiMap();
                    multiMap.setAll(queryParameters);
                    responseHandler = httpRequest.rxSendForm(multiMap);
                    break;
                default:
                    httpRequest.putHeader(HttpHeaders.CONTENT_LENGTH, String.valueOf(bodyRequest.length()));
                    responseHandler = httpRequest.rxSendBuffer(Buffer.buffer(bodyRequest));
            }
        }
    } else {
        responseHandler = httpRequest.rxSend();
    }
    return responseHandler;
}