Altitude/AltitudeWeb
5
0
Fork 0
Code Issues 12 Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: Altitude:02adbb2522c9d876f14faca920eb380916b8bb38
Branches Tags
Altitude:master
Altitude:edit-punishments
Altitude:bans
Altitude:textures
Altitude:particles
...
compare: Altitude:754479eb98760d8fc202949b36f4c0a2a23db97c
Branches Tags
Altitude:master
Altitude:edit-punishments
Altitude:bans
Altitude:textures
Altitude:particles

3 Commits
02adbb2522 ... 754479eb98

Author SHA1 Message Date
akastijn 754479eb98 Refactor: move actor and actorUuid UUID retrieval to method to thread with auth 2025-10-24 22:01:12 +02:00
akastijn 5974ec1dba Revert "Refactor getAuthenticatedUserUuid - extract getAuthentication method for improved null handling and clarity" 
This reverts commit 4b466f314e.
 2025-10-24 21:59:57 +02:00
akastijn c5ed657d3e Revert "Enhance AuthenticatedUuid to improve UUID extraction by adding support for decoding tokens from the Authorization header. Add logging, refactor for better null handling, and introduce @RequiredArgsConstructor." 
This reverts commit 02adbb2522.
 2025-10-24 21:59:57 +02:00
2 changed files with 12 additions and 75 deletions
Show Stats Expand all files Collapse all files

78
backend/src/main/java/com/alttd/altitudeweb/controllers/data_from_auth/AuthenticatedUuid.java
View File

@ -1,30 +1,20 @@
package com.alttd.altitudeweb.controllers.data_from_auth;
import com.nimbusds.jwt.JWT;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.stereotype.Service;
import org.springframework.web.context.request.RequestAttributes;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.server.ResponseStatusException;
import jakarta.servlet.http.HttpServletRequest;
import java.util.UUID;
@Slf4j
@Service
@RequiredArgsConstructor
public class AuthenticatedUuid {
private final JwtDecoder jwtDecoder;
@Value("${UNSECURED:#{false}}")
private boolean unsecured;
@ -35,68 +25,16 @@ public class AuthenticatedUuid {
* @throws ResponseStatusException with 401 status if authentication is invalid
*/
public UUID getAuthenticatedUserUuid() {
UUID uuidFromAuth = getUuidFromAuthentication();
if (uuidFromAuth != null) {
return uuidFromAuth;
}
return extractUuidFromAuthorizationHeader();
}
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
private UUID extractUuidFromAuthorizationHeader() {
log.debug("Attempting to extract UUID directly from Authorization header");
try {
RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();
if (requestAttributes == null) {
log.error("No request attributes found");
if (authentication == null || !(authentication.getPrincipal() instanceof Jwt jwt)) {
log.error("Authentication principal is null {} or not a JWT {}",
authentication == null, authentication == null ?
"null" : authentication.getPrincipal() instanceof JWT);
if (unsecured) {
return UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f");
}
throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "No request attributes found");
}
HttpServletRequest request = ((ServletRequestAttributes) requestAttributes).getRequest();
String authHeader = request.getHeader("Authorization");
if (authHeader == null || !authHeader.startsWith("Bearer ")) {
log.error("No valid Authorization header found");
if (unsecured) {
return UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f");
}
throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "No valid Authorization header");
}
String token = authHeader.substring(7);
Jwt jwt = jwtDecoder.decode(token);
String stringUuid = jwt.getSubject();
log.debug("Successfully extracted UUID {} from Authorization header", stringUuid);
return UUID.fromString(stringUuid);
} catch (Exception e) {
if (e instanceof ResponseStatusException responseStatusException) {
log.debug("Rethrowing ResponseStatusException", e);
throw responseStatusException;
}
log.error("Error extracting UUID from Authorization header", e);
if (unsecured) {
return UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f");
}
throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Failed to extract UUID from token");
}
}
private UUID getUuidFromAuthentication() {
Authentication authentication = getAuthentication();
if (authentication == null) {
log.error("Authentication is null");
return null;
}
if (!(authentication.getPrincipal() instanceof Jwt jwt)) {
log.error("Authentication principal is not a JWT {}", authentication.getPrincipal() instanceof JWT);
if (unsecured) {
return UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f");
}
return null;
throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Authentication required");
}
String stringUuid = jwt.getSubject();
@ -107,8 +45,4 @@ public class AuthenticatedUuid {
throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid UUID format");
}
}
private static Authentication getAuthentication() {
return SecurityContextHolder.getContext().getAuthentication();
}
}

9
backend/src/main/java/com/alttd/altitudeweb/controllers/history/HistoryApiController.java
View File

@ -242,6 +242,8 @@ public class HistoryApiController implements HistoryApi {
HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
CompletableFuture<PunishmentHistoryDto> result = new CompletableFuture<>();
final UUID actor = authenticatedUuid.getAuthenticatedUserUuid();
Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
try {
IdHistoryMapper idMapper = sqlSession.getMapper(IdHistoryMapper.class);
@ -253,7 +255,6 @@ public class HistoryApiController implements HistoryApi {
}
int changed = editMapper.setReason(historyTypeEnum, id, reason);
HistoryRecord after = idMapper.getRecentHistory(historyTypeEnum, id);
UUID actor = authenticatedUuid.getAuthenticatedUserUuid();
log.info("[Punishment Edit] Actor={} Type={} Id={} Reason: '{}' -> '{}' (rows={})",
actor, historyTypeEnum, id, before.getReason(), after != null ? after.getReason() : null, changed);
result.complete(after != null ? mapPunishmentHistory(after) : null);
@ -275,6 +276,8 @@ public class HistoryApiController implements HistoryApi {
HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
CompletableFuture<PunishmentHistoryDto> result = new CompletableFuture<>();
final UUID actor = authenticatedUuid.getAuthenticatedUserUuid();
Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
try {
IdHistoryMapper idMapper = sqlSession.getMapper(IdHistoryMapper.class);
@ -286,7 +289,6 @@ public class HistoryApiController implements HistoryApi {
}
int changed = editMapper.setUntil(historyTypeEnum, id, until);
HistoryRecord after = idMapper.getRecentHistory(historyTypeEnum, id);
UUID actor = authenticatedUuid.getAuthenticatedUserUuid();
log.info("[Punishment Edit] Actor={} Type={} Id={} Until: '{}' -> '{}' (rows={})",
actor, historyTypeEnum, id, before.getUntil(), after != null ? after.getUntil() : null, changed);
result.complete(after != null ? mapPunishmentHistory(after) : null);
@ -311,6 +313,8 @@ public class HistoryApiController implements HistoryApi {
HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
CompletableFuture<Boolean> result = new CompletableFuture<>();
final UUID actorUuid = authenticatedUuid.getAuthenticatedUserUuid();
Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
try {
IdHistoryMapper idMapper = sqlSession.getMapper(IdHistoryMapper.class);
@ -320,7 +324,6 @@ public class HistoryApiController implements HistoryApi {
result.complete(false);
return;
}
UUID actorUuid = authenticatedUuid.getAuthenticatedUserUuid();
String actorName = sqlSession.getMapper(RecentNamesMapper.class).getUsername(actorUuid.toString());
int changed = editMapper.remove(historyTypeEnum, id);
log.info("[Punishment Remove] Actor={} ({}) Type={} Id={} Before(active={} removedBy={} reason='{}') (rows={})",