u may want to reset to prev commit

Back-End/pom.xml

@@ -27,6 +27,34 @@
     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-websocket</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.webjars</groupId>
+            <artifactId>webjars-locator-core</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.webjars</groupId>
+            <artifactId>sockjs-client</artifactId>
+            <version>1.0.2</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.webjars</groupId>
+            <artifactId>stomp-websocket</artifactId>
+            <version>2.3.3</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.json</groupId>
+            <artifactId>json</artifactId>
+            <version>20180130</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
         </dependency>
         <dependency>
@@ -48,6 +76,36 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <version>1.18.0</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+            <version>2.0.3.RELEASE</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+            <version>5.0.6.RELEASE</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-jwt</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt</artifactId>
+            <version>0.9.1</version>
+        </dependency>
     </dependencies>
 
     <build>

Back-End/src/main/java/com/zipline/back/BackEndZipLineYellowApplication.java

@@ -2,10 +2,18 @@ package com.zipline.back;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 
 @SpringBootApplication
 public class BackEndZipLineYellowApplication {
+    @Bean
+    public BCryptPasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
     public static void main(String[] args) {
         SpringApplication.run(BackEndZipLineYellowApplication.class, args);
     }
+
 }

Back-End/src/main/java/com/zipline/back/config/JWTAuthenticationFilter.java

@@ -0,0 +1,64 @@
+package com.zipline.back.config;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.zipline.back.model.User;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.Servlet;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Date;
+
+import static com.zipline.back.config.SecurityConstants.*;
+
+public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
+    private AuthenticationManager authenticationManager;
+
+    public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
+        this.authenticationManager = authenticationManager;
+        setUsernameParameter("githubId");
+        setPasswordParameter("password");
+    }
+
+    @Override
+    public Authentication attemptAuthentication(HttpServletRequest req,
+                                                HttpServletResponse res) throws AuthenticationException {
+        try {
+            User credentials = new ObjectMapper().readValue(req.getInputStream(), User.class);
+
+            return authenticationManager
+                    .authenticate(
+                            new UsernamePasswordAuthenticationToken(
+                                    credentials.getGithubId(),
+                                    credentials.getPassword(),
+                                    new ArrayList<>())
+                    );
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Override
+    protected void successfulAuthentication(HttpServletRequest req,
+                                            HttpServletResponse res,
+                                            FilterChain chain,
+                                            Authentication auth) throws IOException, ServletException {
+        User user = (User) auth.getPrincipal();
+        String token = Jwts.builder()
+                .setSubject(user.getGithubId())
+                .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME))
+                .signWith(SignatureAlgorithm.ES512, SECRET.getBytes())
+                .compact();
+        res.addHeader(HEADER_STRING, TOKEN_PREFIX + token);
+    }
+}

Back-End/src/main/java/com/zipline/back/config/JWTAuthorizationFilter.java

@@ -0,0 +1,58 @@
+package com.zipline.back.config;
+
+import io.jsonwebtoken.Jwts;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.ArrayList;
+
+import static com.zipline.back.config.SecurityConstants.HEADER_STRING;
+import static com.zipline.back.config.SecurityConstants.SECRET;
+import static com.zipline.back.config.SecurityConstants.TOKEN_PREFIX;
+
+public class JWTAuthorizationFilter extends BasicAuthenticationFilter {
+    public JWTAuthorizationFilter(AuthenticationManager authManager) {
+        super(authManager);
+    }
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest req,
+                                    HttpServletResponse res,
+                                    FilterChain chain) throws IOException, ServletException {
+        String header = req.getHeader(HEADER_STRING);
+
+        if (header == null || !header.startsWith(TOKEN_PREFIX)) {
+            chain.doFilter(req, res);
+            return;
+        }
+
+        UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
+
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+        chain.doFilter(req, res);
+    }
+
+    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest req) {
+        String token = req.getHeader(HEADER_STRING);
+        if (token != null) {
+            String user = Jwts.parser()
+                    .setSigningKey(SECRET.getBytes())
+                    .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
+                    .getBody()
+                    .getSubject();
+
+            if (user != null) {
+                return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());
+            }
+            return null;
+        }
+        return null;
+    }
+}

Back-End/src/main/java/com/zipline/back/config/SecurityConstants.java

@@ -0,0 +1,16 @@
+package com.zipline.back.config;
+
+import com.zipline.back.model.User;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+
+import java.security.PrivateKey;
+import java.util.Date;
+
+public class SecurityConstants {
+    public static final String SECRET = "Secret";
+    public static final long EXPIRATION_TIME = 5*60*100;
+    public static final String TOKEN_PREFIX = "Bearer ";
+    public static final String HEADER_STRING = "Authorization";
+    public static final String SIGN_UP_URL = "/register";
+}

Back-End/src/main/java/com/zipline/back/config/WebSecurity.java

@@ -0,0 +1,53 @@
+package com.zipline.back.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import static com.zipline.back.config.SecurityConstants.SIGN_UP_URL;
+
+@EnableWebSecurity
+public class WebSecurity extends WebSecurityConfigurerAdapter {
+    private UserDetailsService userDetailsService;
+    private BCryptPasswordEncoder passwordEncoder;
+
+    public WebSecurity(UserDetailsService userDetailsService,
+                       BCryptPasswordEncoder passwordEncoder) {
+        this.userDetailsService = userDetailsService;
+        this.passwordEncoder = passwordEncoder;
+    }
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.cors().and().csrf().disable().authorizeRequests()
+                .antMatchers("/**").permitAll();
+//                .antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
+//                .anyRequest().authenticated()
+//                .and()
+//                .addFilter(new JWTAuthenticationFilter(authenticationManager()))
+//                .addFilter(new JWTAuthorizationFilter(authenticationManager()))
+//                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
+    }
+
+    @Override
+    public void configure(AuthenticationManagerBuilder auth) throws Exception {
+        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
+    }
+
+    @Bean
+    CorsConfigurationSource corsConfigurationSource() {
+        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
+        return source;
+    }
+
+}

Back-End/src/main/java/com/zipline/back/config/WebSocketConfig.java

@@ -0,0 +1,23 @@
+package com.zipline.back.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.messaging.simp.config.MessageBrokerRegistry;
+import org.springframework.messaging.simp.config.StompBrokerRelayRegistration;
+import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
+import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
+import org.springframework.web.socket.config.annotation.WebSocketMessageBrokerConfigurer;
+
+@Configuration
+@EnableWebSocketMessageBroker
+public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
+    @Override
+    public void configureMessageBroker(MessageBrokerRegistry config) {
+        config.enableSimpleBroker("/socket");
+        config.setApplicationDestinationPrefixes("/app");
+    }
+
+    @Override
+    public void registerStompEndpoints(StompEndpointRegistry registry) {
+        registry.addEndpoint("/stomp");
+    }
+}

Back-End/src/main/java/com/zipline/back/controller/PostController.java

@@ -4,13 +4,19 @@ import com.zipline.back.dao.PostRepository;
 import com.zipline.back.dao.UserRepository;
 import com.zipline.back.model.Post;
 import com.zipline.back.model.User;
+import com.zipline.back.utils.JWTUtils;
+import org.json.JSONObject;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.HttpStatus;
+import org.springframework.messaging.handler.annotation.MessageMapping;
+import org.springframework.messaging.handler.annotation.SendTo;
 import org.springframework.web.bind.annotation.*;
 
 import java.time.LocalDateTime;
 
+import static com.zipline.back.config.SecurityConstants.TOKEN_PREFIX;
+
 
 @RestController
 @RequestMapping("/post")
@@ -20,16 +26,17 @@ public class PostController {
     @Autowired
     private PostRepository postRepo;
 
-    @PostMapping("{githubId}/new-post")
-    @ResponseStatus(HttpStatus.OK)
-    public Post createPost (
-            @PathVariable String githubId,
-            @RequestBody Post post
-    ) {
-        post.setUser(userRepo.findByGithubId(githubId));
+    @MessageMapping("/new-post")
+    @SendTo("/socket/posts")
+    public Post createPost(@RequestHeader(value = "Authorization") String token,
+                           @RequestBody Post post) {
+        JWTUtils jwtutils = new JWTUtils();
+
+        String githubId = jwtutils.getGithubIdFromToken(token.replace(TOKEN_PREFIX, ""));
+        User user = userRepo.findByGithubId(githubId);
+        post.setUser(user);
         post.setTimestamp(LocalDateTime.now());
         return postRepo.save(post);
-
     }
 
     @GetMapping("/{githubId}")

Back-End/src/main/java/com/zipline/back/controller/RegistrationController.java

@@ -0,0 +1,55 @@
+package com.zipline.back.controller;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.zipline.back.dao.UserRepository;
+import com.zipline.back.model.User;
+import com.zipline.back.utils.JWTUtils;
+import org.json.JSONObject;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import static com.zipline.back.config.SecurityConstants.HEADER_STRING;
+import static com.zipline.back.config.SecurityConstants.TOKEN_PREFIX;
+
+@RestController
+public class RegistrationController {
+
+    private UserRepository userRepo;
+    private BCryptPasswordEncoder passwordEncoder;
+
+
+    public RegistrationController(UserRepository userRepo,
+                                  BCryptPasswordEncoder passwordEncoder) {
+        this.userRepo = userRepo;
+        this.passwordEncoder = passwordEncoder;
+    }
+
+    /*
+        STUBBED REQUEST =>
+        {
+            githubId : string,
+            name : string,
+            password : string
+        }
+     */
+    @PostMapping("/register")
+    public ResponseEntity<Void> signup(@RequestBody User user) {
+        user.setPassword( passwordEncoder.encode(user.getPassword()));
+        userRepo.save(user);
+
+        String token = new JWTUtils().generateToken(user);
+        return ResponseEntity
+                .status(302)
+                .header(HEADER_STRING, TOKEN_PREFIX + token)
+                /*
+                .header("location", "location_example")
+                .header("X-Sample-Token", "token_example")
+                */
+                .body(null);
+    }
+
+}

Back-End/src/main/java/com/zipline/back/model/Post.java

@@ -1,6 +1,7 @@
 package com.zipline.back.model;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
+import lombok.Getter;
 import org.hibernate.annotations.OnDelete;
 import org.hibernate.annotations.OnDeleteAction;
 

Back-End/src/main/java/com/zipline/back/model/User.java

@@ -12,6 +12,7 @@ public class User {
 
     private String githubId;
     private String name;
+    private String password;
     private ArrayList<String> friends;
 
     public User(String githubId, String name) {
@@ -38,6 +39,14 @@ public class User {
         this.githubId = githubId;
     }
 
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
     public String getName() {
         return name;
     }

Back-End/src/main/java/com/zipline/back/service/UserDetailsServiceImpl.java

@@ -0,0 +1,31 @@
+package com.zipline.back.service;
+
+import com.zipline.back.dao.UserRepository;
+import org.springframework.context.annotation.Primary;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+
+import static java.util.Collections.emptyList;
+
+@Service
+@Primary
+public class UserDetailsServiceImpl implements UserDetailsService {
+    private UserRepository userRepository;
+
+    public UserDetailsServiceImpl(UserRepository userRepository) {
+        this.userRepository = userRepository;
+    }
+
+    // username -> githubId
+    @Override
+    public UserDetails loadUserByUsername(String username) {
+        com.zipline.back.model.User user = userRepository.findByGithubId(username);
+        if (user == null) {
+            throw new UsernameNotFoundException(username);
+        }
+        return new User(user.getGithubId(), user.getName(), emptyList());
+    }
+}

Back-End/src/main/java/com/zipline/back/utils/JWTUtils.java

@@ -0,0 +1,27 @@
+package com.zipline.back.utils;
+
+import com.zipline.back.model.User;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+
+import java.util.Date;
+
+import static com.zipline.back.config.SecurityConstants.*;
+
+public class JWTUtils {
+    public String generateToken(User user) {
+        return Jwts.builder()
+                .setSubject(user.getGithubId())
+                .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME))
+                .signWith(SignatureAlgorithm.HS512, SECRET.getBytes())
+                .compact();
+    }
+
+    public String getGithubIdFromToken(String token) {
+        return Jwts.parser()
+                .setSigningKey(SECRET.getBytes())
+                .parseClaimsJws(token)
+                .getBody()
+                .getSubject();
+    }
+}

Back-End/src/test/java/com/zipline/back/controller/UserControllerTest.java

@@ -0,0 +1,69 @@
+package com.zipline.back.controller;
+
+import org.junit.Test;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RestTemplate;
+
+import static org.junit.Assert.*;
+
+public class UserControllerTest {
+    @Test
+    public void signup_A_User() {
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        String json = "{\"githubId\": \"testGithubIda\", \"name\": \"testName\", \"password\": \"testPassword\"}";
+        HttpEntity<String> entity = new HttpEntity<>(json, headers);
+        RestTemplate rt = new RestTemplate();
+        ResponseEntity<String> resp = rt.postForEntity("http://localhost:8080/register", entity, String.class);
+        System.out.println(resp.getHeaders().get("Authorization").get(0));
+    }
+
+    @Test
+        public void login_A_User() {
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        String json = "{\"githubId\": \"testGithubIda\", \"password\": \"$2a$10$n8h8GehQ461NgGQP8DrS.OAM6d7I1hSmmRw8wMonRNYhX2biWlYNC\"}";
+        HttpEntity<String> entity = new HttpEntity<>(json, headers);
+        RestTemplate rt = new RestTemplate();
+        ResponseEntity<String> resp = rt.postForEntity("http://localhost:8080/login", entity, String.class);
+        System.out.println(resp);
+    }
+
+    @Test
+    public void create_A_User() {
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        String json = "{\"githubId\": \"testGithubId\", \"name\": \"testName\"}";
+        HttpEntity<String> entity = new HttpEntity<>(json, headers);
+        RestTemplate rt = new RestTemplate();
+        ResponseEntity<String> resp = rt.postForEntity("http://localhost:8080/user/new-user", entity, String.class);
+        System.out.println(resp);
+    }
+
+    @Test
+    public void create_A_Post() {
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        headers.set("Authorization", getToken_FromSigningUp());
+        String json = "{\"body\": \"testPostBody\"}";
+        HttpEntity<String> entity = new HttpEntity<>(json, headers);
+        RestTemplate rt = new RestTemplate();
+        ResponseEntity<String> resp = rt.postForEntity("http://localhost:8080/post/new-post", entity, String.class);
+        System.out.println(resp);
+    }
+
+    private String getToken_FromSigningUp() {
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        String json = "{\"githubId\": \"testGithubId\", \"name\": \"testName\", \"password\": \"testPassword\"}";
+        HttpEntity<String> entity = new HttpEntity<>(json, headers);
+        RestTemplate rt = new RestTemplate();
+        ResponseEntity<String> resp = rt.postForEntity("http://localhost:8080/register", entity, String.class);
+        return resp.getHeaders().get("Authorization").get(0);
+    }
+}