feat: Implement JWT refresh token for authorization (#2230)

Author: aggarwalpulkit596

app/src/fdroid/java/org/fossasia/openevent/general/auth/TokenAuthenticator.kt

@@ -0,0 +1,24 @@
+package org.fossasia.openevent.general.auth
+
+import okhttp3.Authenticator
+import okhttp3.Request
+import okhttp3.Response
+import okhttp3.Route
+
+class TokenAuthenticator : Authenticator {
+
+    /**
+     * Authenticator for when the authToken need to be refresh and updated
+     * everytime we get a 401 error code
+     */
+
+    override fun authenticate(route: Route?, response: Response): Request? {
+
+        val loginResponse = RefreshTokenService.api.refreshToken()
+        val newToken = "JWT ${loginResponse.refreshToken}"
+
+        return response.request.newBuilder()
+            .addHeader("Authorization", newToken)
+            .build()
+    }
+}

app/src/main/java/org/fossasia/openevent/general/auth/AuthApi.kt

@@ -19,6 +19,9 @@ interface AuthApi {
     @POST("../auth/session")
     fun login(@Body login: Login): Single<LoginResponse>
 
+    @POST("/auth/token/refresh")
+    fun refreshToken(): LoginResponse
+
     @GET("users/{id}")
     fun getProfile(@Path("id") id: Long): Single<User>
 

app/src/main/java/org/fossasia/openevent/general/auth/AuthHolder.kt

@@ -3,37 +3,62 @@ package org.fossasia.openevent.general.auth
 import org.fossasia.openevent.general.data.Preference
 import org.fossasia.openevent.general.utils.JWTUtils
 
-private const val TOKEN_KEY = "TOKEN"
+private const val ACCESS_TOKEN = "accessToken"
+private const val REFRESH_TOKEN = "refreshToken"
 
 class AuthHolder(private val preference: Preference) {
 
-    var token: String? = null
+    var accessToken: String? = null
         get() {
-            return preference.getString(TOKEN_KEY)
+            return preference.getString(ACCESS_TOKEN)
         }
         set(value) {
             if (value != null && JWTUtils.isExpired(value))
                 throw IllegalStateException("Cannot set expired token")
             field = value
-            preference.putString(TOKEN_KEY, value)
+            preference.putString(ACCESS_TOKEN, value)
         }
+    var refreshToken: String? = null
+        get() {
+            return preference.getString(REFRESH_TOKEN)
+        }
+        set(value) {
+            field = if (value != null && JWTUtils.isExpired(value)) {
+                "expired"
+            } else {
+                value
+            }
+            preference.putString(REFRESH_TOKEN, value)
+        }
+
+    fun getAccessAuthorization(): String? {
+        if (!isLoggedIn())
+            return null
+        return "JWT $accessToken"
+    }
+
+    fun getRefreshAuthorization(): String? {
+        if (!isLoggedIn())
+            return null
+        return "JWT $refreshToken"
+    }
 
     fun getAuthorization(): String? {
         if (!isLoggedIn())
             return null
-        return "JWT $token"
+        return "JWT $accessToken"
     }
 
     fun isLoggedIn(): Boolean {
-        if (token == null || JWTUtils.isExpired(token)) {
-            token = null
+        if (accessToken == null || JWTUtils.isExpired(accessToken)) {
+            accessToken = null
             return false
         }
 
         return true
     }
 
     fun getId(): Long {
-        return if (!isLoggedIn()) -1 else JWTUtils.getIdentity(token)
+        return if (!isLoggedIn()) -1 else JWTUtils.getIdentity(accessToken)
     }
 }

app/src/main/java/org/fossasia/openevent/general/auth/AuthService.kt

@@ -29,7 +29,9 @@ class AuthService(
 
         return authApi.login(Login(username, password))
                 .map {
-                    authHolder.token = it.accessToken
+                    authHolder.accessToken = it.accessToken
+                    authHolder.refreshToken = it.refreshToken
+
                     it
                 }
     }
@@ -66,7 +68,8 @@ class AuthService(
 
     fun logout(): Completable {
         return Completable.fromAction {
-            authHolder.token = null
+            authHolder.accessToken = null
+            authHolder.refreshToken = null
             userDao.deleteUser(authHolder.getId())
             orderDao.deleteAllOrders()
             attendeeDao.deleteAllAttendees()

app/src/main/java/org/fossasia/openevent/general/auth/LoginResponse.kt

@@ -4,4 +4,7 @@ import com.fasterxml.jackson.databind.PropertyNamingStrategy
 import com.fasterxml.jackson.databind.annotation.JsonNaming
 
 @JsonNaming(PropertyNamingStrategy.SnakeCaseStrategy::class)
-data class LoginResponse(val accessToken: String)
+data class LoginResponse(
+    val accessToken: String,
+    val refreshToken: String
+)

app/src/main/java/org/fossasia/openevent/general/auth/RefreshTokenService.kt

@@ -0,0 +1,14 @@
+package org.fossasia.openevent.general.auth
+
+import org.fossasia.openevent.general.BuildConfig
+import retrofit2.Retrofit
+import retrofit2.converter.gson.GsonConverterFactory
+
+object RefreshTokenService {
+
+    private val retrofit = Retrofit.Builder()
+        .addConverterFactory(GsonConverterFactory.create())
+        .baseUrl(BuildConfig.DEFAULT_BASE_URL)
+        .build()
+    val api: AuthApi = retrofit.create(AuthApi::class.java)
+}

app/src/main/java/org/fossasia/openevent/general/di/Modules.kt

@@ -71,6 +71,7 @@ import org.fossasia.openevent.general.search.location.LocationService
 import org.fossasia.openevent.general.search.type.SearchTypeViewModel
 import org.fossasia.openevent.general.search.location.LocationServiceImpl
 import org.fossasia.openevent.general.auth.SmartAuthViewModel
+import org.fossasia.openevent.general.auth.TokenAuthenticator
 import org.fossasia.openevent.general.connectivity.MutableConnectionLiveData
 import org.fossasia.openevent.general.discount.DiscountApi
 import org.fossasia.openevent.general.discount.DiscountCode
@@ -296,6 +297,7 @@ val networkModule = module {
             .readTimeout(readTimeout.toLong(), TimeUnit.SECONDS)
             .addInterceptor(HostSelectionInterceptor(get()))
             .addInterceptor(RequestAuthenticator(get()))
+            .authenticator(TokenAuthenticator())
             .addNetworkInterceptor(StethoInterceptor())
 
         if (BuildConfig.DEBUG) {