Subject identifier (sub) replaced email for user id (backend internal)

src/main/java/ch/sbb/pfi/netzgrafikeditor/api/common/AuthenticationService.java

@@ -20,6 +20,7 @@
 import lombok.Value;
 import lombok.val;
 
+import org.jooq.Condition;
 import org.jooq.DSLContext;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.GrantedAuthority;
@@ -32,20 +33,36 @@
 @Service
 @RequiredArgsConstructor
 public class AuthenticationService {
-    private static final String USER_ID_CLAIM = "sub";
-    private static final String EMAIL_CLAIM = "preferred_username";
+
+    // See: https://openid.net/specs/openid-connect-core-1_0.html#Claims
+    private static final String USER_ID_FROM_EMAIL_CLAIM = "email";
+    private static final String Subject_Identifier_CLAIM = "sub";
+    private static final String PREFERRED_USERNAME_CLAIM = "preferred_username";
 
     private final DSLContext context;
 
     public String getCurrentUserEmail() {
-        return this.tryGetClaim(EMAIL_CLAIM)
-                .orElseThrow(() -> new BadCredentialsException("E-Mail missing in token"));
+        return this.tryGetClaim(PREFERRED_USERNAME_CLAIM)
+                .orElseThrow(() -> new BadCredentialsException("E-Mail missing in token"))
+                .toLowerCase();
+    }
+
+    public UserId getCurrentUserIdFromEmail() {
+        val idString =
+                this.tryGetClaim(USER_ID_FROM_EMAIL_CLAIM)
+                        .orElseThrow(() -> new BadCredentialsException("User ID missing in token"))
+                        .toLowerCase();
+
+        return UserId.of(idString);
     }
 
-    public UserId getCurrentUserId() {
+    public UserId getCurrentSubjectId() {
         val idString =
-                this.tryGetClaim(USER_ID_CLAIM)
-                        .orElseThrow(() -> new BadCredentialsException("User ID missing in token"));
+                this.tryGetClaim(Subject_Identifier_CLAIM)
+                        .orElseThrow(
+                                () ->
+                                        new BadCredentialsException(
+                                                "Sub identifier missing in token"));
 
         return UserId.of(idString);
     }
@@ -66,14 +83,26 @@ private Optional<String> tryGetClaim(String claim) {
     }
 
     public AuthorizationInfo getAuthorizationInfo(ProjectId projectId) throws NotFoundException {
+        Condition whereCondition =
+                this.isAdmin()
+                        ? PROJECTS.ID.eq(projectId.getValue())
+                        : PROJECTS.ID
+                                .eq(projectId.getValue())
+                                .and(
+                                        PROJECTS_USERS
+                                                .USER_ID
+                                                .eq(this.getCurrentUserIdFromEmail().getValue())
+                                                .or(
+                                                        PROJECTS_USERS.USER_ID.eq(
+                                                                this.getCurrentSubjectId()
+                                                                        .getValue())));
         return this.context
                 .select(PROJECTS.IS_ARCHIVED, PROJECTS_USERS.IS_EDITOR)
                 .from(PROJECTS)
                 .leftJoin(PROJECTS_USERS)
-                .on(
-                        PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID),
-                        PROJECTS_USERS.USER_ID.eq(this.getCurrentUserId().getValue()))
-                .where(PROJECTS.ID.eq(projectId.getValue()))
+                .on(PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID))
+                .where(whereCondition)
+                .limit(1)
                 .fetchOptional()
                 .map(
                         record -> {
@@ -86,16 +115,28 @@ record -> {
     }
 
     public AuthorizationInfo getAuthorizationInfo(VariantId variantId) throws NotFoundException {
+        Condition whereCondition =
+                this.isAdmin()
+                        ? VARIANTS.ID.eq(variantId.getValue())
+                        : VARIANTS.ID
+                                .eq(variantId.getValue())
+                                .and(
+                                        PROJECTS_USERS
+                                                .USER_ID
+                                                .eq(this.getCurrentUserIdFromEmail().getValue())
+                                                .or(
+                                                        PROJECTS_USERS.USER_ID.eq(
+                                                                this.getCurrentSubjectId()
+                                                                        .getValue())));
         return this.context
                 .select(PROJECTS.IS_ARCHIVED, VARIANTS.IS_ARCHIVED, PROJECTS_USERS.IS_EDITOR)
                 .from(PROJECTS)
                 .join(VARIANTS)
                 .on(VARIANTS.PROJECT_ID.eq(PROJECTS.ID))
                 .leftJoin(PROJECTS_USERS)
-                .on(
-                        PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID),
-                        PROJECTS_USERS.USER_ID.eq(this.getCurrentUserId().getValue()))
-                .where(VARIANTS.ID.eq(variantId.getValue()))
+                .on(PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID))
+                .where(whereCondition)
+                .limit(1)
                 .fetchOptional()
                 .map(
                         record -> {
@@ -112,6 +153,19 @@ record -> {
     }
 
     public AuthorizationInfo getAuthorizationInfo(VersionId versionId) throws NotFoundException {
+        Condition whereCondition =
+                this.isAdmin()
+                        ? VERSIONS.ID.eq(versionId.getValue())
+                        : VERSIONS.ID
+                                .eq(versionId.getValue())
+                                .and(
+                                        PROJECTS_USERS
+                                                .USER_ID
+                                                .eq(this.getCurrentUserIdFromEmail().getValue())
+                                                .or(
+                                                        PROJECTS_USERS.USER_ID.eq(
+                                                                this.getCurrentSubjectId()
+                                                                        .getValue())));
         return this.context
                 .select(PROJECTS.IS_ARCHIVED, VARIANTS.IS_ARCHIVED, PROJECTS_USERS.IS_EDITOR)
                 .from(PROJECTS)
@@ -120,10 +174,9 @@ public AuthorizationInfo getAuthorizationInfo(VersionId versionId) throws NotFou
                 .join(VERSIONS)
                 .on(VERSIONS.VARIANT_ID.eq(VARIANTS.ID))
                 .leftJoin(PROJECTS_USERS)
-                .on(
-                        PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID),
-                        PROJECTS_USERS.USER_ID.eq(this.getCurrentUserId().getValue()))
-                .where(VERSIONS.ID.eq(versionId.getValue()))
+                .on(PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID))
+                .where(whereCondition)
+                .limit(1)
                 .fetchOptional()
                 .map(
                         record -> {

src/main/java/ch/sbb/pfi/netzgrafikeditor/api/project/ProjectController.java

@@ -26,6 +26,7 @@
 import org.springframework.web.servlet.support.ServletUriComponentsBuilder;
 
 import java.util.Collection;
+import java.util.ListIterator;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
@@ -35,11 +36,15 @@
 public class ProjectController {
     private final ProjectService projectService;
 
-    private static Pattern USER_ID_PATTERN = Pattern.compile("^(u|ue|e)\\d+$");
+    // email adress validator: regex to match emails using the expression
+    protected static Pattern USER_ID_AS_EMAIL_PATTERN =
+            Pattern.compile(
+                    "^([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)|(u|ue|e)\\d+$");
 
     @PostMapping("/v1/projects")
     public ResponseEntity<Long> createProject(@RequestBody ProjectCreateUpdateDto projectDto)
             throws ValidationErrorException {
+        this.convertAllUsersToLowerCase(projectDto);
         this.assertValidUserIds(projectDto);
 
         val id = this.projectService.create(projectDto);
@@ -76,6 +81,7 @@ public ResponseEntity<Void> deleteProject(@PathVariable ProjectId projectId)
     public ResponseEntity<Void> updateProject(
             @PathVariable ProjectId id, @Valid @RequestBody ProjectCreateUpdateDto projectDto)
             throws NotFoundException, ValidationErrorException, ForbiddenOperationException {
+        this.convertAllUsersToLowerCase(projectDto);
         this.assertValidUserIds(projectDto);
         this.projectService.update(id, projectDto);
         return ResponseEntity.noContent().build();
@@ -87,10 +93,21 @@ private void assertValidUserIds(ProjectCreateUpdateDto projectDto)
         this.assertValidUserIds(projectDto.getWriteUsers());
     }
 
+    private void convertAllUsersToLowerCase(ProjectCreateUpdateDto projectDto) {
+        ListIterator<String> iteratorWriteUsers = projectDto.getWriteUsers().listIterator();
+        while (iteratorWriteUsers.hasNext()) {
+            iteratorWriteUsers.set(iteratorWriteUsers.next().toLowerCase());
+        }
+        ListIterator<String> iteratorReadUsers = projectDto.getReadUsers().listIterator();
+        while (iteratorReadUsers.hasNext()) {
+            iteratorReadUsers.set(iteratorReadUsers.next().toLowerCase());
+        }
+    }
+
     private void assertValidUserIds(Collection<String> userIds) throws ValidationErrorException {
         val invalidUserIds =
                 userIds.stream()
-                        .filter(id -> !USER_ID_PATTERN.matcher(id).matches())
+                        .filter(id -> !USER_ID_AS_EMAIL_PATTERN.matcher(id).matches())
                         .collect(Collectors.toList());
 
         if (!invalidUserIds.isEmpty()) {

src/main/java/ch/sbb/pfi/netzgrafikeditor/api/project/ProjectService.java

@@ -59,15 +59,16 @@ val record =
                         .setDescription(project.getDescription())
                         .setIsArchived(false)
                         .setCreatedAt(nowProvider.now())
-                        .setCreatedBy(this.authenticationService.getCurrentUserId().getValue());
+                        .setCreatedBy(
+                                this.authenticationService.getCurrentUserIdFromEmail().getValue());
 
         record.store();
 
         val projectId = ProjectId.of(record.getId());
 
         var writeUsersIncludingCurrentUser = new ArrayList<>(project.getWriteUsers());
         writeUsersIncludingCurrentUser.add(
-                this.authenticationService.getCurrentUserId().getValue());
+                this.authenticationService.getCurrentUserIdFromEmail().getValue());
 
         this.updateProjectUsers(projectId, writeUsersIncludingCurrentUser, project.getReadUsers());
 
@@ -184,11 +185,22 @@ public Collection<ProjectSummaryDto> getAll() {
                         : selectOne()
                                 .from(PROJECTS_USERS)
                                 .where(
-                                        PROJECTS_USERS.PROJECT_ID.eq(PROJECTS.ID),
-                                        PROJECTS_USERS.USER_ID.eq(
-                                                this.authenticationService
-                                                        .getCurrentUserId()
-                                                        .getValue()));
+                                        PROJECTS_USERS
+                                                .PROJECT_ID
+                                                .eq(PROJECTS.ID)
+                                                .and(
+                                                        PROJECTS_USERS
+                                                                .USER_ID
+                                                                .eq(
+                                                                        this.authenticationService
+                                                                                .getCurrentUserIdFromEmail()
+                                                                                .getValue())
+                                                                .or(
+                                                                        PROJECTS_USERS.USER_ID.eq(
+                                                                                this
+                                                                                        .authenticationService
+                                                                                        .getCurrentSubjectId()
+                                                                                        .getValue()))));
 
         return this.context
                 .selectFrom(PROJECTS)
@@ -227,7 +239,9 @@ public ProjectDto getById(ProjectId projectId)
 
         for (val snapshotVersion :
                 this.getLatestSnapshotVersions(
-                        projectId, authenticationService.getCurrentUserId())) {
+                        projectId,
+                        authenticationService.getCurrentUserIdFromEmail(),
+                        authenticationService.getCurrentSubjectId())) {
             variantsMap
                     .get(snapshotVersion.getVariantId())
                     .latestSnapshotVersion(Optional.of(snapshotVersion));
@@ -306,7 +320,8 @@ private List<VersionDto> getLatestReleaseVersions(ProjectId projectId) {
                 .collect(Collectors.toList());
     }
 
-    private List<VersionDto> getLatestSnapshotVersions(ProjectId projectId, UserId userId) {
+    private List<VersionDto> getLatestSnapshotVersions(
+            ProjectId projectId, UserId userId, UserId subId) {
         return this.context
                 .select(VERSIONS.asterisk())
                 .distinctOn(VERSIONS.VARIANT_ID)
@@ -316,7 +331,9 @@ private List<VersionDto> getLatestSnapshotVersions(ProjectId projectId, UserId u
                 .where(
                         VARIANTS.PROJECT_ID.eq(projectId.getValue()),
                         VERSIONS.SNAPSHOT_VERSION.isNotNull(),
-                        VERSIONS.CREATED_BY.eq(userId.getValue()))
+                        VERSIONS.CREATED_BY
+                                .eq(userId.getValue())
+                                .or(VERSIONS.CREATED_BY.eq(subId.getValue())))
                 .orderBy(
                         VERSIONS.VARIANT_ID,
                         VERSIONS.RELEASE_VERSION.desc(),

src/main/java/ch/sbb/pfi/netzgrafikeditor/api/variant/VariantService.java

@@ -50,7 +50,7 @@ public VariantId create(ProjectId projectId, VariantCreateDto createDto)
         this.authenticationService.getAuthorizationInfo(projectId).assertWritable();
 
         val now = this.nowProvider.now();
-        val userId = this.authenticationService.getCurrentUserId();
+        val userId = this.authenticationService.getCurrentUserIdFromEmail();
 
         val variantRecord =
                 this.context
@@ -131,7 +131,7 @@ val record =
         this.authenticationService.getAuthorizationInfo(projectId).assertWritable();
 
         val now = this.nowProvider.now();
-        val userId = this.authenticationService.getCurrentUserId();
+        val userId = this.authenticationService.getCurrentUserIdFromEmail();
 
         val variantRecord =
                 this.context
@@ -206,7 +206,7 @@ private VariantDto map(
     public void dropSnapshots(VariantId variantId) throws NotFoundException {
         assertVariantExists(variantId);
 
-        val userId = this.authenticationService.getCurrentUserId();
+        val userId = this.authenticationService.getCurrentUserIdFromEmail();
 
         if (this.hasReleases(variantId)) {
             this.deleteAllSnapshots(variantId, userId);
@@ -217,7 +217,14 @@ public void dropSnapshots(VariantId variantId) throws NotFoundException {
                     .where(
                             VERSIONS.VARIANT_ID
                                     .eq(variantId.getValue())
-                                    .and(VERSIONS.CREATED_BY.eq(userId.getValue()))
+                                    .and(
+                                            VERSIONS.CREATED_BY
+                                                    .eq(userId.getValue())
+                                                    .or(
+                                                            VERSIONS.CREATED_BY.eq(
+                                                                    this.authenticationService
+                                                                            .getCurrentSubjectId()
+                                                                            .getValue())))
                                     .and(VERSIONS.SNAPSHOT_VERSION.isNotNull())
                                     .and(VERSIONS.SNAPSHOT_VERSION.notEqual(1))
                                     .and(VERSIONS.RELEASE_VERSION.eq(1)))
@@ -236,7 +243,7 @@ public void raiseSnapshotsToNewestReleaseVersion(VariantId variantId)
         assertVariantExists(variantId);
         assertHasReleases(variantId);
 
-        val userId = this.authenticationService.getCurrentUserId();
+        val userId = this.authenticationService.getCurrentUserIdFromEmail();
 
         val highestReleasedVersion =
                 this.tryFetchHighestReleaseVersion(variantId)