Feature/security keycloak solution

backend/src/main/docker/Dockerfile.jvm

@@ -1,80 +1,20 @@
 ####
 # This Dockerfile is used in order to build a container that runs the Quarkus application in JVM mode
 #
-# Before building the container image run:
-#
-# ./mvnw package
+# Before building the docker image run:
+# mvn package
 #
 # Then, build the image with:
-#
-# docker build -f src/main/docker/Dockerfile.jvm -t quarkus/code-with-quarkus-jvm .
+# docker build -f src/main/docker/Dockerfile.jvm -t quarkus/backend .
 #
 # Then run the container using:
-#
-# docker run -i --rm -p 8080:8080 quarkus/code-with-quarkus-jvm
+# docker run -i --rm -p 8080:8080 quarkus/backend
 #
 # If you want to include the debug port into your docker image
-# you will have to expose the debug port (default 5005 being the default) like this :  EXPOSE 8080 5005.
-# Additionally you will have to set -e JAVA_DEBUG=true and -e JAVA_DEBUG_PORT=*:5005
-# when running the container
+# you will have to expose the debug port (default 5005) like this :  EXPOSE 8080 5005
 #
 # Then run the container using :
-#
-# docker run -i --rm -p 8080:8080 quarkus/code-with-quarkus-jvm
-#
-# This image uses the `run-java.sh` script to run the application.
-# This scripts computes the command line to execute your Java application, and
-# includes memory/GC tuning.
-# You can configure the behavior using the following environment properties:
-# - JAVA_OPTS: JVM options passed to the `java` command (example: "-verbose:class")
-# - JAVA_OPTS_APPEND: User specified Java options to be appended to generated options
-#   in JAVA_OPTS (example: "-Dsome.property=foo")
-# - JAVA_MAX_MEM_RATIO: Is used when no `-Xmx` option is given in JAVA_OPTS. This is
-#   used to calculate a default maximal heap memory based on a containers restriction.
-#   If used in a container without any memory constraints for the container then this
-#   option has no effect. If there is a memory constraint then `-Xmx` is set to a ratio
-#   of the container available memory as set here. The default is `50` which means 50%
-#   of the available memory is used as an upper boundary. You can skip this mechanism by
-#   setting this value to `0` in which case no `-Xmx` option is added.
-# - JAVA_INITIAL_MEM_RATIO: Is used when no `-Xms` option is given in JAVA_OPTS. This
-#   is used to calculate a default initial heap memory based on the maximum heap memory.
-#   If used in a container without any memory constraints for the container then this
-#   option has no effect. If there is a memory constraint then `-Xms` is set to a ratio
-#   of the `-Xmx` memory as set here. The default is `25` which means 25% of the `-Xmx`
-#   is used as the initial heap size. You can skip this mechanism by setting this value
-#   to `0` in which case no `-Xms` option is added (example: "25")
-# - JAVA_MAX_INITIAL_MEM: Is used when no `-Xms` option is given in JAVA_OPTS.
-#   This is used to calculate the maximum value of the initial heap memory. If used in
-#   a container without any memory constraints for the container then this option has
-#   no effect. If there is a memory constraint then `-Xms` is limited to the value set
-#   here. The default is 4096MB which means the calculated value of `-Xms` never will
-#   be greater than 4096MB. The value of this variable is expressed in MB (example: "4096")
-# - JAVA_DIAGNOSTICS: Set this to get some diagnostics information to standard output
-#   when things are happening. This option, if set to true, will set
-#  `-XX:+UnlockDiagnosticVMOptions`. Disabled by default (example: "true").
-# - JAVA_DEBUG: If set remote debugging will be switched on. Disabled by default (example:
-#    true").
-# - JAVA_DEBUG_PORT: Port used for remote debugging. Defaults to 5005 (example: "8787").
-# - CONTAINER_CORE_LIMIT: A calculated core limit as described in
-#   https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt. (example: "2")
-# - CONTAINER_MAX_MEMORY: Memory limit given to the container (example: "1024").
-# - GC_MIN_HEAP_FREE_RATIO: Minimum percentage of heap free after GC to avoid expansion.
-#   (example: "20")
-# - GC_MAX_HEAP_FREE_RATIO: Maximum percentage of heap free after GC to avoid shrinking.
-#   (example: "40")
-# - GC_TIME_RATIO: Specifies the ratio of the time spent outside the garbage collection.
-#   (example: "4")
-# - GC_ADAPTIVE_SIZE_POLICY_WEIGHT: The weighting given to the current GC time versus
-#   previous GC times. (example: "90")
-# - GC_METASPACE_SIZE: The initial metaspace size. (example: "20")
-# - GC_MAX_METASPACE_SIZE: The maximum metaspace size. (example: "100")
-# - GC_CONTAINER_OPTIONS: Specify Java GC to use. The value of this variable should
-#   contain the necessary JRE command-line options to specify the required GC, which
-#   will override the default of `-XX:+UseParallelGC` (example: -XX:+UseG1GC).
-# - HTTPS_PROXY: The location of the https proxy. (example: "myuser@127.0.0.1:8080")
-# - HTTP_PROXY: The location of the http proxy. (example: "myuser@127.0.0.1:8080")
-# - NO_PROXY: A comma separated lists of hosts, IP addresses or domains that can be
-#   accessed directly. (example: "foo.example.com,bar.example.com")
+# docker run -i --rm -p 8080:8080 -p 5005:5005 -e JAVA_ENABLE_DEBUG="true" quarkus/mvp-quarkus-jvm
 #
 ###
 FROM registry.access.redhat.com/ubi8/openjdk-21:1.18
@@ -93,5 +33,4 @@ USER 185
 ENV JAVA_OPTS_APPEND="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
 ENV JAVA_APP_JAR="/deployments/quarkus-run.jar"
 
-ENTRYPOINT [ "/opt/jboss/container/java/run/run-java.sh" ]
-
+ENTRYPOINT [ "/opt/jboss/container/java/run/run-java.sh" ]

backend/src/main/java/org/example/app/general/common/security/AppEntryResource.java

@@ -0,0 +1,14 @@
+package org.example.app.general.common.security;
+
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
+
+@Path("/app")
+public class AppEntryResource {
+  @GET
+  public Response entry() {
+    return Response.ok("OK - logged in").build();
+  }
+}
+

backend/src/main/java/org/example/app/general/common/security/ApplicationAccessControlConfig.java

@@ -6,11 +6,11 @@
 public class ApplicationAccessControlConfig {
 
   /** Unique identifier of this application used as namespace prefix. */
-  public static final String APP_ID = "demo";
+  public static final String APP_ID = "app";
 
   /**
-   * The namespace prefix build from {@link #APP_ID} and prepended to every permission to avoid name-clashing of
-   * permissions with other applications within the same application landscape in identity & access management (IAM).
+   * The namespace prefix build from {@link #APP_ID} and prepended to every permission to avoid name-clashing of permissions with other applications within the
+   * same application landscape in identity & access management (IAM).
    */
   private static final String PREFIX = APP_ID + ".";
 

backend/src/main/java/org/example/app/general/common/security/AuthLogoutResource.java

@@ -0,0 +1,50 @@
+package org.example.app.general.common.security;
+
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Response;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+
+@Path("/auth")
+public class AuthLogoutResource {
+
+
+  @ConfigProperty(name = "quarkus.oidc.auth-server-url")
+  String authServerUrl;
+
+  @ConfigProperty(name = "app.frontend-client-id")
+  String frontendClientId;
+
+  @ConfigProperty(name = "app.logout-redirect")
+  String appLogoutRedirect;
+
+  @GET
+  @Path("/logout")
+  public Response logout(@QueryParam("idToken") String idToken) {
+    if (idToken == null || idToken.isBlank()) {
+      return Response.status(Response.Status.BAD_REQUEST)
+          .entity("Missing idToken")
+          .build();
+    }
+
+    String logoutUrl =
+        authServerUrl +
+            "/protocol/openid-connect/logout" +
+            "?client_id=" + encode(frontendClientId) +
+            "&id_token_hint=" + encode(idToken) +
+            "&post_logout_redirect_uri=" + encode(appLogoutRedirect);
+
+    return Response.status(Response.Status.FOUND)
+        .header("Location", logoutUrl)
+        .build();
+  }
+
+  private String encode(String value) {
+    return URLEncoder.encode(value, StandardCharsets.UTF_8);
+  }
+
+}

backend/src/main/java/org/example/app/general/common/security/logout/GlobalLogoutEndpoint.java

@@ -0,0 +1,99 @@
+package org.example.app.general.common.security.logout;
+
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
+import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.IDToken;
+import org.keycloak.services.managers.AppAuthManager;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.util.DefaultClientSessionContext;
+import org.keycloak.util.TokenUtil;
+
+import java.net.URI;
+
+public class GlobalLogoutEndpoint {
+  private final KeycloakSession session;
+  private final AuthenticationManager.AuthResult auth;
+
+  public GlobalLogoutEndpoint(KeycloakSession session) {
+    this.session = session;
+    this.auth = authenticateSession(session);
+  }
+
+  private AuthenticationManager.AuthResult authenticateSession(KeycloakSession session) {
+    AuthenticationManager.AuthResult authResult =
+        new AppAuthManager.BearerTokenAuthenticator(session).authenticate();
+
+    if (authResult == null) {
+      authResult = new AppAuthManager()
+          .authenticateIdentityCookie(session, session.getContext().getRealm());
+    }
+    return authResult;
+  }
+
+  @GET
+  @Path("")
+  @NoCache
+  @Consumes(MediaType.APPLICATION_JSON)
+  @Produces(MediaType.APPLICATION_JSON)
+  public Response initiateGlobalLogout() {
+    if (auth == null || auth.getUser() == null) {
+      return Response.status(Response.Status.UNAUTHORIZED).build();
+    }
+
+    RealmModel realm = session.getContext().getRealm();
+    ClientModel client = session.clients().getClientByClientId(realm, "frontend");
+    session.getContext().setClient(client);
+
+    URI redirectURI = buildLogoutRedirectURI(realm, client);
+    return Response.seeOther(redirectURI).build();
+  }
+
+  private URI buildLogoutRedirectURI(RealmModel realm, ClientModel client) {
+    URI baseRedirectURI = UriBuilder.fromUri(session.getContext().getAuthServerUrl())
+        .path(client.getBaseUrl())
+        .build();
+
+    IDToken idToken = generateIdToken(client);
+
+    return UriBuilder.fromUri(session.getContext().getAuthServerUrl())
+        .path("/realms/%s/protocol/openid-connect/logout".formatted(realm.getName()))
+        .queryParam("post_logout_redirect_uri", baseRedirectURI)
+        .queryParam("client_id", client.getClientId())
+        .queryParam("id_token_hint", session.tokens().encode(idToken))
+        .build();
+  }
+
+  private IDToken generateIdToken(ClientModel client) {
+    ClientSessionContext clientSessionCtx = DefaultClientSessionContext
+        .fromClientSessionScopeParameter(
+            auth.getSession().getAuthenticatedClientSessionByClient(client.getId()),
+            session
+        );
+
+    IDToken idToken = new IDToken();
+    idToken.id(KeycloakModelUtils.generateId());
+    idToken.type(TokenUtil.TOKEN_TYPE_ID);
+    idToken.subject(auth.getUser().getId());
+    idToken.audience(client.getClientId());
+    idToken.issuedNow();
+    idToken.issuedFor(client.getClientId());
+    idToken.issuer(auth.getToken().getIssuer());
+    idToken.setNonce(clientSessionCtx.getAttribute(OIDCLoginProtocol.NONCE_PARAM, String.class));
+    idToken.setSessionId(auth.getToken().getSessionId());
+    idToken.exp(auth.getToken().getExp());
+
+    return idToken;
+  }
+}

backend/src/main/java/org/example/app/general/common/security/logout/GlobalLogoutResourceProvider.java

@@ -0,0 +1,22 @@
+package org.example.app.general.common.security.logout;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resource.RealmResourceProvider;
+
+public class GlobalLogoutResourceProvider implements RealmResourceProvider {
+  private final KeycloakSession session;
+
+  public GlobalLogoutResourceProvider(KeycloakSession session) {
+    this.session = session;
+  }
+
+  @Override
+  public Object getResource() {
+    return new GlobalLogoutEndpoint(session);
+  }
+
+  @Override
+  public void close() {
+    // NOOP
+  }
+}

backend/src/main/java/org/example/app/general/common/security/logout/GlobalLogoutResourceProviderFactory.java

@@ -0,0 +1,35 @@
+package org.example.app.general.common.security.logout;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.services.resource.RealmResourceProvider;
+import org.keycloak.services.resource.RealmResourceProviderFactory;
+
+public class GlobalLogoutResourceProviderFactory implements RealmResourceProviderFactory {
+  public static final String PROVIDER_ID = "global-logout";
+
+  @Override
+  public RealmResourceProvider create(KeycloakSession session) {
+    return new GlobalLogoutResourceProvider(session);
+  }
+
+  @Override
+  public void init(org.keycloak.Config.Scope config) {
+    // NOOP
+  }
+
+  @Override
+  public void postInit(KeycloakSessionFactory factory) {
+    // NOOP
+  }
+
+  @Override
+  public void close() {
+    // NOOP
+  }
+
+  @Override
+  public String getId() {
+    return PROVIDER_ID;
+  }
+}

backend/src/main/java/org/example/app/task/common/TaskItem.java

@@ -0,0 +1,61 @@
+package org.example.app.task.common;
+
+import java.time.LocalDateTime;
+
+import org.example.app.general.common.ApplicationEntity;
+
+/**
+ * {@link ApplicationEntity} for a single task item.
+ */
+public interface TaskItem extends ApplicationEntity {
+
+  /**
+   * @return the title of this task item. Gives a brief summary to describe what to do or buy.
+   */
+  String getTitle();
+
+  /**
+   * @param title new value of {@link #getTitle()}.
+   */
+  void setTitle(String title);
+
+  /**
+   * @return {@code true} if this task is completed (done), {@code false} otherwise.
+   */
+  boolean isCompleted();
+
+  /**
+   * @param completed new value of {@link #isCompleted()}.
+   */
+  void setCompleted(boolean completed);
+
+  /**
+   * @return {@code true} if this task is starred (marked as favorite), {@code false} otherwise.
+   */
+  boolean isStarred();
+
+  /**
+   * @param starred new value of {@link #isStarred()}.
+   */
+  void setStarred(boolean starred);
+
+  /**
+   * @return the deadline as until this task shall be {@link #isCompleted() completed}.
+   */
+  LocalDateTime getDeadline();
+
+  /**
+   * @param deadline the new value of {@link #getDeadline()}.
+   */
+  void setDeadline(LocalDateTime deadline);
+
+  /**
+   * @return the {@link TaskList#getId() primary key} of the owning {@link TaskList}.
+   */
+  Long getTaskListId();
+
+  /**
+   * @param taskListId the new value of {@link #getTaskListId()}.
+   */
+  void setTaskListId(Long taskListId);
+}