Merge pull request #4 from authlete/refactor-methods

Refactored some methods.

Author: Takahiko Kawasaki

src/main/java/com/authlete/jaxrs/server/api/AuthorizationDecisionEndpoint.java

@@ -107,6 +107,7 @@ private HttpSession getSession(HttpServletRequest request)
 
  // A session does not exist. Make a response of "400 Bad Request".
  String message = "A session does not exist.";
+
  Response response = Response
  .status(Status.BAD_REQUEST)
  .entity(message)
@@ -131,21 +132,19 @@ private static User getUser(HttpSession session, MultivaluedMap<String, String>
  {
  return sessionUser;
  }
- else
+
+ // Look up an end-user who has the login credentials.
+ User loginUser = UserDao.getByCredentials(parameters.getFirst("loginId"),
+ parameters.getFirst("password"));
+
+ if (loginUser != null)
  {
- // Look up an end-user who has the login credentials.
- User loginUser = UserDao.getByCredentials(parameters.getFirst("loginId"),
- parameters.getFirst("password"));
-
- if (loginUser != null)
- {
- //System.err.println("Logged in as: " + loginUser);
- session.setAttribute("user", loginUser);
- session.setAttribute("authTime", new Date());
- }
-
- return loginUser;
+ //System.err.println("Logged in as: " + loginUser);
+ session.setAttribute("user", loginUser);
+ session.setAttribute("authTime", new Date());
  }
+
+ return loginUser;
  }
 
 

src/main/java/com/authlete/jaxrs/server/api/AuthorizationRequestHandlerSpiImpl.java

@@ -96,59 +96,11 @@ public Response generateAuthorizationPage(AuthorizationResponse info)
  session.setAttribute("claimNames", info.getClaims());
  session.setAttribute("claimLocales", info.getClaimsLocales());
 
- // Get the user from the session if they exist.
- User user = (User) session.getAttribute("user");
- Date authTime = (Date) session.getAttribute("authTime");
-
- //System.err.println("USER: " + user);
- //System.err.println("Auth Time: " + authTime);
- //System.err.println("AuthorizationResponse: " + info.summarize());
-
- if (user != null && authTime != null)
- {
- // See if the user should be prompted for login anyway.
- if (info.getPrompts() != null)
- {
- List<Prompt> prompts = Arrays.asList(info.getPrompts());
-
- //System.err.println("Prompts: " + prompts);
-
- if (prompts.contains(Prompt.LOGIN))
- {
- // Force a login by clearing out the current user.
-
- //System.err.println("XX Logged out from prompt");
-
- user = null;
- session.removeAttribute("user");
- session.removeAttribute("authTime");
- }
- }
-
- // Check the auth age to make sure this session isn't too old.
-
- // TODO: max_age == 0 effectively means "log in the user interactively
- // now" but it's used here as a flag, we should fix this to use Integer
- // instead of int probably.
- if (info.getMaxAge() > 0)
- {
- Date now = new Date();
-
- // Calculate number of seconds that have elapsed since login.
- long authAge = (now.getTime() - authTime.getTime()) / 1000;
-
- if (authAge > info.getMaxAge())
- {
- // Session age is too old, clear out the current user.
-
- //System.err.println("XX Logged out from max_auth");
+ // Clear the current user information in the session if necessary.
+ clearCurrentUserInfoInSessionIfNecessary(info, session);
 
- user = null;
- session.removeAttribute("user");
- session.removeAttribute("authTime");
- }
- }
- }
+ // Get the user from the session if they exist.
+ User user = (User) session.getAttribute("user");
 
  // Prepare a model object which contains information needed to
  // render the authorization page. Feel free to create a subclass
@@ -174,14 +126,9 @@ public boolean isUserAuthenticated()
  // Get the user from the session if they exist.
  User user = (User) session.getAttribute("user");
 
- if (user != null)
- {
- return true;
- }
- else
- {
- return false;
- }
+ // If the user information exists in the session, the user is already
+ // authenticated; Otherwise, the user is not authenticated.
+ return user != null;
  }
 
 
@@ -194,14 +141,12 @@ public long getUserAuthenticatedAt()
  // Get the user from the session if they exist.
  Date authTime = (Date) session.getAttribute("authTime");
 
- if (authTime != null)
- {
- return authTime.getTime() / 1000L;
- }
- else
+ if (authTime == null)
  {
  return 0;
  }
+
+ return authTime.getTime() / 1000L;
  }
 
 
@@ -214,13 +159,88 @@ public String getUserSubject()
  // Get the user from the session if they exist.
  User user = (User) session.getAttribute("user");
 
- if (user != null)
+ if (user == null)
  {
- return user.getSubject();
+ return null;
  }
- else
+
+ return user.getSubject();
+ }
+
+
+ private void clearCurrentUserInfoInSessionIfNecessary(AuthorizationResponse info, HttpSession session)
+ {
+ // Get the user from the session if they exist.
+ User user = (User) session.getAttribute("user");
+ Date authTime = (Date) session.getAttribute("authTime");
+
+ //System.err.println("USER: " + user);
+ //System.err.println("Auth Time: " + authTime);
+ //System.err.println("AuthorizationResponse: " + info.summarize());
+
+ if (user == null || authTime == null)
  {
- return null;
+ // The information about the user does not exist in the session.
+ return;
+ }
+
+ // Check 'prompts'.
+ checkPrompts(info, session);
+
+ // Check 'authentication age'.
+ checkAuthenticationAge(info, session, authTime);
+ }
+
+
+ private void checkPrompts(AuthorizationResponse info, HttpSession session)
+ {
+ if (info.getPrompts() == null)
+ {
+ return;
  }
+
+ List<Prompt> prompts = Arrays.asList(info.getPrompts());
+
+ //System.err.println("Prompts: " + prompts);
+
+ if (prompts.contains(Prompt.LOGIN))
+ {
+ // Force a login by clearing out the current user.
+ clearCurrentUserInfoInSession(session);
+
+ //System.err.println("XX Logged out from prompt");
+ };
+ }
+
+
+ private void checkAuthenticationAge(AuthorizationResponse info, HttpSession session, Date authTime)
+ {
+ // TODO: max_age == 0 effectively means "log in the user interactively
+ // now" but it's used here as a flag, we should fix this to use Integer
+ // instead of int probably.
+ if (info.getMaxAge() <= 0)
+ {
+ return;
+ }
+
+ Date now = new Date();
+
+ // Calculate number of seconds that have elapsed since login.
+ long authAge = (now.getTime() - authTime.getTime()) / 1000L;
+
+ if (authAge > info.getMaxAge())
+ {
+ // Session age is too old, clear out the current user.
+ clearCurrentUserInfoInSession(session);
+
+ //System.err.println("XX Logged out from max_auth");
+ };
+ }
+
+
+ private void clearCurrentUserInfoInSession(HttpSession session)
+ {
+ session.removeAttribute("user");
+ session.removeAttribute("authTime");
  }
 }