001/*
002 * (C) Copyright 2014 Nuxeo SA (http://nuxeo.com/) and others.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *     http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 *
016 * Contributors:
017 *     Arnaud Kervern
018 */
019package org.nuxeo.ecm.platform.oauth2.request;
020
021import static org.nuxeo.ecm.platform.oauth2.Constants.AUTHORIZATION_CODE_PARAM;
022import static org.nuxeo.ecm.platform.oauth2.Constants.CLIENT_SECRET_PARAM;
023import static org.nuxeo.ecm.platform.oauth2.Constants.CODE_VERIFIER_PARAM;
024import static org.nuxeo.ecm.platform.oauth2.Constants.GRANT_TYPE_PARAM;
025import static org.nuxeo.ecm.platform.oauth2.Constants.REFRESH_TOKEN_PARAM;
026
027import javax.servlet.http.HttpServletRequest;
028
029/**
030 * @author <a href="mailto:[email protected]">Arnaud Kervern</a>
031 * @since 5.9.2
032 */
033public class TokenRequest extends OAuth2Request {
034
035    protected static final String BASIC_AUTHENTICATION_HEADER_PREFIX = "basic ";
036
037    protected String grantType;
038
039    protected String code;
040
041    protected String clientSecret;
042
043    protected String refreshToken;
044
045    protected String codeVerifier;
046
047    public TokenRequest(HttpServletRequest request) {
048        super(request);
049        grantType = request.getParameter(GRANT_TYPE_PARAM);
050        code = request.getParameter(AUTHORIZATION_CODE_PARAM);
051        clientSecret = request.getParameter(CLIENT_SECRET_PARAM);
052        refreshToken = request.getParameter(REFRESH_TOKEN_PARAM);
053        codeVerifier = request.getParameter(CODE_VERIFIER_PARAM);
054
055        checkAuthorization(request);
056    }
057
058    protected void checkAuthorization(HttpServletRequest request) {
059        final String authorization = request.getHeader("Authorization");
060        if (authorization != null && authorization.toLowerCase().startsWith(BASIC_AUTHENTICATION_HEADER_PREFIX)) {
061            // Authorization: Basic base64credentials
062            String base64Credentials = authorization.substring(BASIC_AUTHENTICATION_HEADER_PREFIX.length()).trim();
063            byte[] decodedCredentials = java.util.Base64.getDecoder().decode(base64Credentials);
064            String credentials = new String(decodedCredentials, java.nio.charset.StandardCharsets.UTF_8);
065            // credentials = client_id:secret
066            String[] values = credentials.split(":", 2);
067            if (values.length == 2) {
068                clientId = values[0];
069                clientSecret = values[1];
070            }
071        }
072    }
073
074    public String getGrantType() {
075        return grantType;
076    }
077
078    public String getCode() {
079        return code;
080    }
081
082    public String getClientSecret() {
083        return clientSecret;
084    }
085
086    public String getRefreshToken() {
087        return refreshToken;
088    }
089
090    public String getCodeVerifier() {
091        return codeVerifier;
092    }
093}