Add Reactive One-Time Token Login support

Closes gh-15699

core/src/main/java/org/springframework/security/authentication/ott/reactive/InMemoryReactiveOneTimeTokenService.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.authentication.ott.reactive;
+
+import java.time.Clock;
+
+import reactor.core.publisher.Mono;
+
+import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
+import org.springframework.security.authentication.ott.InMemoryOneTimeTokenService;
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
+import org.springframework.util.Assert;
+
+/**
+ * Reactive adapter for {@link InMemoryOneTimeTokenService}
+ *
+ * @author Max Batischev
+ * @since 6.4
+ * @see InMemoryOneTimeTokenService
+ */
+public final class InMemoryReactiveOneTimeTokenService implements ReactiveOneTimeTokenService {
+
+	private final InMemoryOneTimeTokenService oneTimeTokenService = new InMemoryOneTimeTokenService();
+
+	@Override
+	public Mono<OneTimeToken> generate(GenerateOneTimeTokenRequest request) {
+		return Mono.just(request).map(this.oneTimeTokenService::generate);
+	}
+
+	@Override
+	public Mono<OneTimeToken> consume(OneTimeTokenAuthenticationToken authenticationToken) {
+		return Mono.just(authenticationToken).mapNotNull(this.oneTimeTokenService::consume);
+	}
+
+	/**
+	 * Sets the {@link Clock} used when generating one-time token and checking token
+	 * expiry.
+	 * @param clock the clock
+	 */
+	public void setClock(Clock clock) {
+		Assert.notNull(clock, "clock cannot be null");
+		this.oneTimeTokenService.setClock(clock);
+	}
+
+}

core/src/main/java/org/springframework/security/authentication/ott/reactive/OneTimeTokenReactiveAuthenticationManager.java

@@ -0,0 +1,71 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.authentication.ott.reactive;
+
+import java.util.function.Function;
+
+import reactor.core.publisher.Mono;
+
+import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.authentication.ott.InvalidOneTimeTokenException;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+
+/**
+ * A {@link ReactiveAuthenticationManager} for one time tokens.
+ *
+ * @author Max Batischev
+ * @since 6.4
+ */
+public final class OneTimeTokenReactiveAuthenticationManager implements ReactiveAuthenticationManager {
+
+	private final ReactiveOneTimeTokenService oneTimeTokenService;
+
+	private final ReactiveUserDetailsService userDetailsService;
+
+	public OneTimeTokenReactiveAuthenticationManager(ReactiveOneTimeTokenService oneTimeTokenService,
+			ReactiveUserDetailsService userDetailsService) {
+		Assert.notNull(oneTimeTokenService, "oneTimeTokenService cannot be null");
+		Assert.notNull(userDetailsService, "userDetailsService cannot be null");
+		this.oneTimeTokenService = oneTimeTokenService;
+		this.userDetailsService = userDetailsService;
+	}
+
+	@Override
+	public Mono<Authentication> authenticate(Authentication authentication) {
+		if (!(authentication instanceof OneTimeTokenAuthenticationToken otpAuthenticationToken)) {
+			return Mono.empty();
+		}
+		return this.oneTimeTokenService.consume(otpAuthenticationToken)
+			.switchIfEmpty(Mono.error(new InvalidOneTimeTokenException("Invalid token")))
+			.flatMap((consumed) -> this.userDetailsService.findByUsername(consumed.getUsername()))
+			.map(onSuccess(otpAuthenticationToken));
+	}
+
+	private Function<UserDetails, OneTimeTokenAuthenticationToken> onSuccess(OneTimeTokenAuthenticationToken token) {
+		return (user) -> {
+			OneTimeTokenAuthenticationToken authenticated = OneTimeTokenAuthenticationToken.authenticated(user,
+					user.getAuthorities());
+			authenticated.setDetails(token.getDetails());
+			return authenticated;
+		};
+	}
+
+}

core/src/main/java/org/springframework/security/authentication/ott/reactive/ReactiveOneTimeTokenService.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.authentication.ott.reactive;
+
+import reactor.core.publisher.Mono;
+
+import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
+
+/**
+ * Reactive interface for generating and consuming one-time tokens.
+ *
+ * @author Max Batischev
+ * @since 6.4
+ */
+public interface ReactiveOneTimeTokenService {
+
+	/**
+	 * Generates a one-time token based on the provided generate request.
+	 * @param request the generate request containing the necessary information to
+	 * generate the token
+	 * @return the generated {@link OneTimeToken}.
+	 */
+	Mono<OneTimeToken> generate(GenerateOneTimeTokenRequest request);
+
+	/**
+	 * Consumes a one-time token based on the provided authentication token.
+	 * @param authenticationToken the authentication token containing the one-time token
+	 * value to be consumed
+	 * @return the consumed {@link OneTimeToken} or empty Mono if the token is invalid
+	 */
+	Mono<OneTimeToken> consume(OneTimeTokenAuthenticationToken authenticationToken);
+
+}

core/src/test/java/org/springframework/security/authentication/ott/reactive/InMemoryReactiveOneTimeTokenServiceTests.java

@@ -0,0 +1,132 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.authentication.ott.reactive;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.UUID;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatNoException;
+
+/**
+ * Tests for {@link InMemoryReactiveOneTimeTokenService}
+ *
+ * @author Max Batischev
+ */
+public class InMemoryReactiveOneTimeTokenServiceTests {
+
+	private final InMemoryReactiveOneTimeTokenService oneTimeTokenService = new InMemoryReactiveOneTimeTokenService();
+
+	private static final String USERNAME = "user";
+
+	private static final String TOKEN = "token";
+
+	@Test
+	void generateThenTokenValueShouldBeValidUuidAndProvidedUsernameIsUsed() {
+		GenerateOneTimeTokenRequest request = new GenerateOneTimeTokenRequest(USERNAME);
+
+		OneTimeToken oneTimeToken = this.oneTimeTokenService.generate(request).block();
+
+		assertThatNoException().isThrownBy(() -> UUID.fromString(oneTimeToken.getTokenValue()));
+		assertThat(oneTimeToken.getUsername()).isEqualTo(USERNAME);
+	}
+
+	@Test
+	void consumeWhenTokenDoesNotExistThenNull() {
+		OneTimeTokenAuthenticationToken authenticationToken = new OneTimeTokenAuthenticationToken(TOKEN);
+
+		OneTimeToken oneTimeToken = this.oneTimeTokenService.consume(authenticationToken).block();
+
+		assertThat(oneTimeToken).isNull();
+	}
+
+	@Test
+	void consumeWhenTokenExistsThenReturnItself() {
+		GenerateOneTimeTokenRequest request = new GenerateOneTimeTokenRequest(USERNAME);
+		OneTimeToken generated = this.oneTimeTokenService.generate(request).block();
+		OneTimeTokenAuthenticationToken authenticationToken = new OneTimeTokenAuthenticationToken(
+				generated.getTokenValue());
+
+		OneTimeToken consumed = this.oneTimeTokenService.consume(authenticationToken).block();
+
+		assertThat(consumed.getTokenValue()).isEqualTo(generated.getTokenValue());
+		assertThat(consumed.getUsername()).isEqualTo(generated.getUsername());
+		assertThat(consumed.getExpiresAt()).isEqualTo(generated.getExpiresAt());
+	}
+
+	@Test
+	void consumeWhenTokenIsExpiredThenReturnNull() {
+		GenerateOneTimeTokenRequest request = new GenerateOneTimeTokenRequest(USERNAME);
+		OneTimeToken generated = this.oneTimeTokenService.generate(request).block();
+		OneTimeTokenAuthenticationToken authenticationToken = new OneTimeTokenAuthenticationToken(
+				generated.getTokenValue());
+		Clock tenMinutesFromNow = Clock.fixed(Instant.now().plus(10, ChronoUnit.MINUTES), ZoneOffset.UTC);
+		this.oneTimeTokenService.setClock(tenMinutesFromNow);
+
+		OneTimeToken consumed = this.oneTimeTokenService.consume(authenticationToken).block();
+
+		assertThat(consumed).isNull();
+	}
+
+	@Test
+	void generateWhenMoreThan100TokensThenClearExpired() {
+		// @formatter:off
+		List<OneTimeToken> toExpire = generate(50); // 50 tokens will expire in 5 minutes from now
+		Clock twoMinutesFromNow = Clock.fixed(Instant.now().plus(2, ChronoUnit.MINUTES), ZoneOffset.UTC);
+		this.oneTimeTokenService.setClock(twoMinutesFromNow);
+		List<OneTimeToken> toKeep = generate(50); // 50 tokens will expire in 7 minutes from now
+		Clock sixMinutesFromNow = Clock.fixed(Instant.now().plus(6, ChronoUnit.MINUTES), ZoneOffset.UTC);
+		this.oneTimeTokenService.setClock(sixMinutesFromNow);
+
+		assertThat(toExpire)
+				.extracting((token) -> this.oneTimeTokenService.consume(new OneTimeTokenAuthenticationToken(token.getTokenValue()))
+								.block()
+				)
+				.containsOnlyNulls();
+
+		assertThat(toKeep)
+				.extracting((token) -> this.oneTimeTokenService.consume(new OneTimeTokenAuthenticationToken(token.getTokenValue()))
+								.block()
+				)
+				.noneMatch(Objects::isNull);
+		// @formatter:on
+	}
+
+	private List<OneTimeToken> generate(int howMany) {
+		List<OneTimeToken> generated = new ArrayList<>(howMany);
+		for (int i = 0; i < howMany; i++) {
+			OneTimeToken oneTimeToken = this.oneTimeTokenService
+				.generate(new GenerateOneTimeTokenRequest("generated" + i))
+				.block();
+			generated.add(oneTimeToken);
+		}
+		return generated;
+	}
+
+}

core/src/test/java/org/springframework/security/authentication/ott/reactive/OneTimeTokenReactiveAuthenticationManagerTests.java

@@ -0,0 +1,141 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.authentication.ott.reactive;
+
+import java.time.Instant;
+import java.util.Collection;
+
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentMatchers;
+import reactor.core.publisher.Mono;
+
+import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.authentication.ott.DefaultOneTimeToken;
+import org.springframework.security.authentication.ott.InvalidOneTimeTokenException;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.CollectionUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
+
+/**
+ * Tests for {@link OneTimeTokenReactiveAuthenticationManager}
+ *
+ * @author Max Batischev
+ */
+public class OneTimeTokenReactiveAuthenticationManagerTests {
+
+	private ReactiveAuthenticationManager authenticationManager;
+
+	private static final String USERNAME = "user";
+
+	private static final String PASSWORD = "password";
+
+	private static final String TOKEN = "token";
+
+	@Test
+	public void constructorWhenOneTimeTokenServiceNullThenIllegalArgumentException() {
+		ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
+		// @formatter:off
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> new OneTimeTokenReactiveAuthenticationManager(null, userDetailsService));
+		// @formatter:on
+	}
+
+	@Test
+	public void constructorWhenUserDetailsServiceNullThenIllegalArgumentException() {
+		ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
+		// @formatter:off
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService, null));
+		// @formatter:on
+	}
+
+	@Test
+	void authenticateWhenOneTimeTokenAuthenticationTokenIsPresentThenSuccess() {
+		ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
+		given(oneTimeTokenService.consume(ArgumentMatchers.any(OneTimeTokenAuthenticationToken.class)))
+			.willReturn(Mono.just(new DefaultOneTimeToken(TOKEN, USERNAME, Instant.now())));
+		ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
+		User testUser = new User(USERNAME, PASSWORD, AuthorityUtils.createAuthorityList("TEST"));
+		given(userDetailsService.findByUsername(eq(USERNAME))).willReturn(Mono.just(testUser));
+
+		this.authenticationManager = new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService,
+				userDetailsService);
+
+		Authentication auth = this.authenticationManager
+			.authenticate(OneTimeTokenAuthenticationToken.unauthenticated(TOKEN))
+			.block();
+
+		OneTimeTokenAuthenticationToken token = (OneTimeTokenAuthenticationToken) auth;
+		UserDetails user = (UserDetails) token.getPrincipal();
+		Collection<GrantedAuthority> authorities = token.getAuthorities();
+
+		assertThat(user).isNotNull();
+		assertThat(user.getUsername()).isEqualTo(USERNAME);
+		assertThat(user.getPassword()).isEqualTo(PASSWORD);
+		assertThat(token.isAuthenticated()).isTrue();
+		assertThat(CollectionUtils.isEmpty(authorities)).isFalse();
+	}
+
+	@Test
+	void authenticateWhenInvalidOneTimeTokenAuthenticationTokenIsPresentThenFail() {
+		ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
+		given(oneTimeTokenService.consume(ArgumentMatchers.any(OneTimeTokenAuthenticationToken.class)))
+			.willReturn(Mono.empty());
+		ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
+
+		this.authenticationManager = new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService,
+				userDetailsService);
+
+		// @formatter:off
+		assertThatExceptionOfType(InvalidOneTimeTokenException.class)
+				.isThrownBy(() -> this.authenticationManager.authenticate(OneTimeTokenAuthenticationToken.unauthenticated(TOKEN))
+						.block());
+		// @formatter:on
+	}
+
+	@Test
+	void authenticateWhenIncorrectTypeOfAuthenticationIsPresentThenFail() {
+		ReactiveOneTimeTokenService oneTimeTokenService = mock(ReactiveOneTimeTokenService.class);
+		given(oneTimeTokenService.consume(ArgumentMatchers.any(OneTimeTokenAuthenticationToken.class)))
+			.willReturn(Mono.empty());
+		ReactiveUserDetailsService userDetailsService = mock(ReactiveUserDetailsService.class);
+
+		this.authenticationManager = new OneTimeTokenReactiveAuthenticationManager(oneTimeTokenService,
+				userDetailsService);
+
+		// @formatter:off
+		Authentication authentication = this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(USERNAME, PASSWORD))
+				.block();
+		// @formatter:on
+
+		assertThat(authentication).isNull();
+	}
+
+}