refactor: 💡 Removed PerunACR and PerunDeviceACR

Removed models and repositories, removed scheduled tasks tied to these
classes. Acr is now instead stored together with the User authentication

Author: Dominik Frantisek Bucik

perun-oidc-server/src/main/java/cz/muni/ics/oidc/server/CustomClearTasks.java

@@ -4,8 +4,6 @@
 import cz.muni.ics.oauth2.model.DeviceCode;
 import cz.muni.ics.oauth2.model.OAuth2AccessTokenEntity;
 import cz.muni.ics.oauth2.model.OAuth2RefreshTokenEntity;
-import cz.muni.ics.openid.connect.models.Acr;
-import cz.muni.ics.openid.connect.models.DeviceCodeAcr;
 import java.time.Instant;
 import java.util.Date;
 import javax.persistence.EntityManager;
@@ -135,38 +133,4 @@ public int clearExpiredDeviceCodes(long timeout) {
         return count;
     }
 
-    public int clearExpiredAcrs(long timeout) {
-        manager.flush();
-        manager.clear();
-        int count = 0;
-        Query query = manager.createNamedQuery(Acr.DELETE_EXPIRED);
-        query.setParameter(Acr.PARAM_EXPIRES_AT, Instant.now().toEpochMilli());
-        if (timeout > 0) {
-            query.setHint("javax.persistence.query.timeout", timeout);
-        }
-        try {
-            count += query.executeUpdate();
-        } catch (QueryTimeoutException e) {
-            // this is OK
-        }
-        return count;
-    }
-
-    public int clearExpiredDeviceCodeAcrs(long timeout) {
-        manager.flush();
-        manager.clear();
-        int count = 0;
-        Query query = manager.createNamedQuery(DeviceCodeAcr.DELETE_EXPIRED);
-        query.setParameter(DeviceCodeAcr.PARAM_EXPIRES_AT, Instant.now().toEpochMilli());
-        if (timeout > 0) {
-            query.setHint("javax.persistence.query.timeout", timeout);
-        }
-        try {
-            count += query.executeUpdate();
-        } catch (QueryTimeoutException e) {
-            // this is OK
-        }
-        return count;
-    }
-
 }

perun-oidc-server/src/main/java/cz/muni/ics/oidc/server/CustomTaskScheduler.java

@@ -105,34 +105,4 @@ public void clearExpiredDeviceCodes() {
 		log.info("clearExpiredDeviceCodes took {}ms, deleted {} records", execution, count);
 	}
 
-	@Transactional(value = "defaultTransactionManager")
-	@Scheduled(fixedDelay = 60 * ONE_MINUTE, initialDelay = 48 * ONE_MINUTE)
-	@SchedulerLock(name = "clearExpiredAcrs", lockAtMostFor = "3590s", lockAtLeastFor = "3590s")
-	public void clearExpiredAcrs() {
-		try {
-			LockAssert.assertLocked();
-		} catch (IllegalArgumentException e) {
-			return;
-		}
-		long start = System.currentTimeMillis();
-		int count = this.customClearTasks.clearExpiredAcrs(TimeUnit.MINUTES.toMillis(15));
-		long execution = System.currentTimeMillis() - start;
-		log.info("clearExpiredAcrs took {}ms, deleted {} records", execution, count);
-	}
-
-	@Transactional(value = "defaultTransactionManager")
-	@Scheduled(fixedDelay = 60 * ONE_MINUTE, initialDelay = 48 * ONE_MINUTE)
-	@SchedulerLock(name = "clearExpiredDeviceAcrs", lockAtMostFor = "3590s", lockAtLeastFor = "3590s")
-	public void clearExpiredDeviceAcrs() {
-		try {
-			LockAssert.assertLocked();
-		} catch (IllegalArgumentException e) {
-			return;
-		}
-		long start = System.currentTimeMillis();
-		int count = this.customClearTasks.clearExpiredAcrs(TimeUnit.MINUTES.toMillis(15));
-		long execution = System.currentTimeMillis() - start;
-		log.info("clearExpiredDeviceAcrs took {}ms, deleted {} records", execution, count);
-	}
-
 }

perun-oidc-server/src/main/java/cz/muni/ics/oidc/server/PerunAcrRepository.java

@@ -4,17 +4,14 @@
 import cz.muni.ics.oauth2.model.DeviceCode;
 import cz.muni.ics.oauth2.service.SystemScopeService;
 import cz.muni.ics.oauth2.web.DeviceEndpoint;
-import cz.muni.ics.oidc.server.PerunDeviceCodeAcrRepository;
 import cz.muni.ics.oidc.server.PerunScopeClaimTranslationService;
 import cz.muni.ics.oidc.server.configurations.PerunOidcConfig;
 import cz.muni.ics.oidc.server.filters.PerunFilterConstants;
 import cz.muni.ics.oidc.server.userInfo.PerunUserInfo;
 import cz.muni.ics.oidc.web.WebHtmlClasses;
 import cz.muni.ics.oidc.web.langs.Localization;
-import cz.muni.ics.openid.connect.models.DeviceCodeAcr;
 import cz.muni.ics.openid.connect.service.UserInfoService;
 import java.security.Principal;
-import java.time.Instant;
 import java.util.Map;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
@@ -41,7 +38,6 @@ public class ApproveDeviceController {
     public static final String DEVICE_APPROVED = "deviceApproved";
     public static final String REQUEST_USER_CODE = "requestUserCode";
     public static final String USER_CODE = "user_code";
-    public static final String DEVICE_CODE = "device_code";
     public static final String USER_OAUTH_APPROVAL = "user_oauth_approval";
     public static final String URL = "devicecode";
     public static final String VERIFICATION_URI = "verification_uri";
@@ -59,7 +55,6 @@ public class ApproveDeviceController {
     private final WebHtmlClasses htmlClasses;
     private final PerunScopeClaimTranslationService scopeClaimTranslationService;
     private final UserInfoService userInfoService;
-    private final PerunDeviceCodeAcrRepository deviceCodeAcrRepository;
 
     @Autowired
     public ApproveDeviceController(SystemScopeService scopeService,
@@ -68,8 +63,7 @@ public ApproveDeviceController(SystemScopeService scopeService,
                                    Localization localization,
                                    WebHtmlClasses htmlClasses,
                                    PerunScopeClaimTranslationService scopeClaimTranslationService,
-                                   UserInfoService userInfoService,
-                                   PerunDeviceCodeAcrRepository perunDeviceCodeAcrRepository)
+                                   UserInfoService userInfoService)
     {
         this.scopeService = scopeService;
         this.deviceEndpoint = deviceEndpoint;
@@ -78,7 +72,6 @@ public ApproveDeviceController(SystemScopeService scopeService,
         this.htmlClasses = htmlClasses;
         this.scopeClaimTranslationService = scopeClaimTranslationService;
         this.userInfoService = userInfoService;
-        this.deviceCodeAcrRepository = perunDeviceCodeAcrRepository;
     }
 
     @RequestMapping(
@@ -96,7 +89,6 @@ public String requestDeviceCodeMFA(@RequestParam(CLIENT_ID) String clientId, @Re
         Map<String, Object> response = (Map<String, Object>) model.get(ENTITY);
         response.replace(VERIFICATION_URI, response.get(VERIFICATION_URI) + "?" + ACR_VALUES + "=" + acrValues);
         response.replace(VERIFICATION_URI_COMPLETE, response.get(VERIFICATION_URI_COMPLETE) + "&" + ACR_VALUES + "=" + acrValues);
-        storeAcrBase((String) response.get(DEVICE_CODE), (String)response.get(USER_CODE));
 
         return result;
     }
@@ -145,10 +137,6 @@ public String readUserCode(@RequestParam(USER_CODE) String userCode,
     {
         String result = deviceEndpoint.readUserCode(userCode, model, session);
         if (result.equals(APPROVE_DEVICE) && !perunOidcConfig.getTheme().equalsIgnoreCase("default")) {
-            if (StringUtils.hasText(req.getParameter(ACR))) {
-                storeAcr(req.getParameter(ACR), userCode);
-            }
-
             return themedApproveDevice(model, p, req);
         } else if (result.equals(REQUEST_USER_CODE) && !perunOidcConfig.getTheme().equalsIgnoreCase("default")) {
             ControllerUtils.setPageOptions(model, req, localization, htmlClasses, perunOidcConfig);
@@ -189,14 +177,6 @@ public String approveDevice(@RequestParam(USER_CODE) String userCode,
         return result;
     }
 
-    private void storeAcr(String acrValue, String userCode) {
-        DeviceCodeAcr acr = deviceCodeAcrRepository.getByUserCode(userCode);
-        acr.setShibAuthnContextClass(acrValue);
-        long expiresAtEpoch = Instant.now().plusSeconds(600L).toEpochMilli();
-        acr.setExpiresAt(expiresAtEpoch);
-        deviceCodeAcrRepository.store(acr);
-    }
-
     private String themedApproveDevice(ModelMap model, Principal p, HttpServletRequest req) {
         model.remove("scopes");
         DeviceCode dc = (DeviceCode) model.get("dc");
@@ -210,10 +190,4 @@ private String themedApproveDevice(ModelMap model, Principal p, HttpServletReque
         return "themedApproveDevice";
     }
 
-    private void storeAcrBase(String deviceCode, String userCode) {
-        DeviceCodeAcr acrBase = new DeviceCodeAcr(deviceCode, userCode);
-        acrBase.setExpiresAt(Instant.now().plusSeconds(1800).toEpochMilli());
-        deviceCodeAcrRepository.store(acrBase);
-    }
-
 }