Support access tokens in headers (Fix #65) (#70)

src/main/java/io/kamax/mxisd/controller/DefaultExceptionHandler.java

@@ -84,8 +84,8 @@ public class DefaultExceptionHandler {
         return handleGeneric(request, response, e);
     }
 
-    @ExceptionHandler(MatrixException.class)
-    public String handleGeneric(HttpServletRequest request, HttpServletResponse response, MatrixException e) {
+    @ExceptionHandler(HttpMatrixException.class)
+    public String handleGeneric(HttpServletRequest request, HttpServletResponse response, HttpMatrixException e) {
         response.setStatus(e.getStatus());
         return handle(request, e.getErrorCode(), e.getError());
     }

src/main/java/io/kamax/mxisd/controller/ProxyController.java

@@ -0,0 +1,54 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2018 Kamax Sarl
+ *
+ * https://www.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.controller;
+
+import io.kamax.mxisd.exception.AccessTokenNotFoundException;
+import io.kamax.mxisd.util.OptionalUtil;
+import org.thymeleaf.util.StringUtils;
+
+import javax.servlet.http.HttpServletRequest;
+import java.util.Optional;
+
+public class ProxyController {
+
+    private final static String headerName = "Authorization";
+    private final static String headerValuePrefix = "Bearer ";
+    private final static String parameterName = "access_token";
+
+    Optional<String> findAccessTokenInHeaders(HttpServletRequest request) {
+        return Optional.ofNullable(request.getHeader(headerName))
+                .filter(header -> StringUtils.startsWith(header, headerValuePrefix))
+                .map(header -> header.substring(headerValuePrefix.length()));
+    }
+
+    Optional<String> findAccessTokenInQuery(HttpServletRequest request) {
+        return Optional.ofNullable(request.getParameter(parameterName));
+    }
+
+    public Optional<String> findAccessToken(HttpServletRequest request) {
+        return OptionalUtil.findFirst(() -> findAccessTokenInHeaders(request), () -> findAccessTokenInQuery(request));
+    }
+
+    public String getAccessToken(HttpServletRequest request) {
+        return findAccessToken(request).orElseThrow(AccessTokenNotFoundException::new);
+    }
+
+}

src/main/java/io/kamax/mxisd/controller/directory/v1/UserDirectoryController.java

@@ -21,6 +21,7 @@
 package io.kamax.mxisd.controller.directory.v1;
 
 import com.google.gson.Gson;
+import io.kamax.mxisd.controller.ProxyController;
 import io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchRequest;
 import io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchResult;
 import io.kamax.mxisd.directory.DirectoryManager;
@@ -28,7 +29,10 @@ import io.kamax.mxisd.util.GsonParser;
 import io.kamax.mxisd.util.GsonUtil;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
-import org.springframework.web.bind.annotation.*;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RestController;
 
 import javax.servlet.http.HttpServletRequest;
 import java.io.IOException;
@@ -37,7 +41,7 @@ import java.net.URI;
 @RestController
 @CrossOrigin
 @RequestMapping(path = "/_matrix/client/r0/user_directory", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
-public class UserDirectoryController {
+public class UserDirectoryController extends ProxyController {
 
     private Gson gson = GsonUtil.build();
     private GsonParser parser = new GsonParser(gson);
@@ -46,7 +50,8 @@ public class UserDirectoryController {
     private DirectoryManager mgr;
 
     @RequestMapping(path = "/search", method = RequestMethod.POST)
-    public String search(HttpServletRequest request, @RequestParam("access_token") String accessToken) throws IOException {
+    public String search(HttpServletRequest request) throws IOException {
+        String accessToken = getAccessToken(request);
         UserDirectorySearchRequest searchQuery = parser.parse(request, UserDirectorySearchRequest.class);
         URI target = URI.create(request.getRequestURL().toString());
         UserDirectorySearchResult result = mgr.search(target, accessToken, searchQuery.getSearchTerm());

src/main/java/io/kamax/mxisd/controller/profile/v1/ProfileController.java

@@ -26,6 +26,7 @@ import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
 import io.kamax.matrix.MatrixID;
 import io.kamax.matrix._ThreePid;
+import io.kamax.mxisd.controller.ProxyController;
 import io.kamax.mxisd.dns.ClientDnsOverwrite;
 import io.kamax.mxisd.profile.ProfileManager;
 import io.kamax.mxisd.util.GsonUtil;
@@ -49,11 +50,12 @@ import java.io.IOException;
 import java.net.URI;
 import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
 
 @RestController
 @CrossOrigin
 @RequestMapping(path = "/_matrix/client/r0/profile", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
-public class ProfileController {
+public class ProfileController extends ProxyController {
 
     private final Logger log = LoggerFactory.getLogger(ProfileController.class);
     private final ProfileManager mgr;
@@ -82,7 +84,11 @@ public class ProfileController {
 
     @RequestMapping("/{userId:.+}")
     public String getProfile(HttpServletRequest req, HttpServletResponse res, @PathVariable String userId) {
-        try (CloseableHttpResponse hsResponse = client.execute(new HttpGet(resolveProxyUrl(req)))) {
+        Optional<String> accessTokenOpt = findAccessToken(req);
+        HttpGet reqOut = new HttpGet(resolveProxyUrl(req));
+        accessTokenOpt.ifPresent(accessToken -> reqOut.addHeader("Authorization", "Bearer " + accessToken));
+
+        try (CloseableHttpResponse hsResponse = client.execute(reqOut)) {
             res.setStatus(hsResponse.getStatusLine().getStatusCode());
             JsonElement el = parser.parse(EntityUtils.toString(hsResponse.getEntity()));
             List<_ThreePid> list = mgr.getThreepids(MatrixID.asAcceptable(userId));