Vert.x OIDC から Quarkus OIDC への移行

package howto.oauth_oidc;

import io.vertx.core.Future;
import io.vertx.core.VerticleBase;
import io.vertx.ext.auth.authorization.PermissionBasedAuthorization;
import io.vertx.ext.auth.oauth2.OAuth2Auth;
import io.vertx.ext.auth.oauth2.authorization.ScopeAuthorization;
import io.vertx.ext.auth.oauth2.providers.GithubAuth;
import io.vertx.ext.web.Router;
import io.vertx.ext.web.handler.AuthorizationHandler;
import io.vertx.ext.web.handler.OAuth2AuthHandler;
import io.vertx.ext.web.handler.SessionHandler;
import io.vertx.ext.web.sstore.LocalSessionStore;
import io.vertx.ext.web.templ.handlebars.HandlebarsTemplateEngine;

public class MainVerticle extends VerticleBase {

    private static final String CLIENT_ID = System.getenv("GITHUB_CLIENT_ID");
    private static final String CLIENT_SECRET = System.getenv("GITHUB_CLIENT_SECRET");

    @Override
    public Future<?> start() {

        HandlebarsTemplateEngine engine = HandlebarsTemplateEngine.create(vertx); (1)

        Router router = Router.router(vertx); (2)

        router.route().handler(SessionHandler.create(LocalSessionStore.create(vertx))); (3)

        router.get("/").handler(ctx -> { (4)
            // we pass the client id to the template
            ctx.put("client_id", CLIENT_ID);
            // and now delegate to the engine to render it.
            engine.render(ctx.data(), "views/index.hbs").onSuccess(buffer -> {
                ctx.response().putHeader("Content-Type", "text/html").end(buffer);
            }).onFailure(ctx::fail);
        });

        OAuth2Auth authProvider = GithubAuth.create(vertx, CLIENT_ID, CLIENT_SECRET); (5)

        router.get("/protected").handler(

                OAuth2AuthHandler.create(vertx, authProvider, "http://localhost:8080/login")
                        .setupCallback(router.route("/login")).withScope("user:email")) (6)
                .handler(AuthorizationHandler.create(PermissionBasedAuthorization.create("user:email"))
                        .addAuthorizationProvider(ScopeAuthorization.create(" "))) (7)
                .handler(new ProtectedProfileHandler(authProvider, engine)); (8)

        return vertx.createHttpServer().requestHandler(router).listen(Integer.getInteger("port", 8080))
                .onSuccess(server -> System.out.println("HTTP server started on port: " + server.actualPort()));
    }
}

package howto.oauth_oidc;

import io.vertx.core.Handler;
import io.vertx.ext.auth.authentication.TokenCredentials;
import io.vertx.ext.auth.oauth2.OAuth2Auth;
import io.vertx.ext.web.RoutingContext;
import io.vertx.ext.web.client.WebClient;
import io.vertx.ext.web.codec.BodyCodec;
import io.vertx.ext.web.templ.handlebars.HandlebarsTemplateEngine;

class ProtectedProfileHandler implements Handler<RoutingContext> {

    private final OAuth2Auth authProvider;
    private final HandlebarsTemplateEngine engine;

    ProtectedProfileHandler(OAuth2Auth authProvider, HandlebarsTemplateEngine engine) {
        this.authProvider = authProvider;
        this.engine = engine;
    }

    @Override
    public void handle(RoutingContext ctx) {
        authProvider.userInfo(ctx.user())
                .onFailure(err -> {
                    ctx.session().destroy();
                    ctx.fail(err);
                }).onSuccess(userInfo -> {
                    WebClient.create(ctx.vertx()).getAbs("https://api.github.com/user/emails") (1)
                            .authentication(new TokenCredentials(ctx.user().<String>get("access_token"))) (2)
                            .as(BodyCodec.jsonArray()).send().onFailure(err -> {
                                ctx.session().destroy();
                                ctx.fail(err);
                            }).onSuccess(res -> {
                                userInfo.put("private_emails", res.body());
                                // we pass the client info to the template
                                ctx.put("userInfo", userInfo); (3)
                                // and now delegate to the engine to render it.
                                engine.render(ctx.data(), "views/protected.hbs").onSuccess(buffer -> {
                                    ctx.response().putHeader("Content-Type", "text/html").end(buffer);
                                }).onFailure(err -> {
                                    ctx.session().destroy();
                                    ctx.fail(err);
                                });
                            });
                });
    }
}

package howto.oauth_oidc;

import org.eclipse.microprofile.config.inject.ConfigProperty;

import io.quarkus.qute.Template;
import io.vertx.core.Vertx;
import io.vertx.ext.auth.authorization.PermissionBasedAuthorization;
import io.vertx.ext.auth.oauth2.OAuth2Auth;
import io.vertx.ext.auth.oauth2.authorization.ScopeAuthorization;
import io.vertx.ext.auth.oauth2.providers.GithubAuth;
import io.vertx.ext.web.Router;
import io.vertx.ext.web.handler.AuthorizationHandler;
import io.vertx.ext.web.handler.OAuth2AuthHandler;
import io.vertx.ext.web.handler.SessionHandler;
import io.vertx.ext.web.sstore.LocalSessionStore;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.enterprise.event.Observes;
import jakarta.inject.Inject;

@ApplicationScoped
public class GitHubProfileService {

    OAuth2Auth authProvider;
    @Inject
    Template userEmail;

    public GithubProfileService(Vertx vertx,
            @ConfigProperty(name = "github_client_id") String githubClientId,
            @ConfigProperty(name = "github_client_secret") String githubClientSecret) {
        authProvider = GithubAuth.create(vertx, githubClientId, githubClientSecret); (1)
    }

    void start(@Observes Router router, Vertx vertx) { (2)

        router.route().handler(SessionHandler.create(LocalSessionStore.create(vertx)));

        router.get("/protected").handler(
                OAuth2AuthHandler.create(vertx, authProvider, "http://localhost:8080/login")
                        .setupCallback(router.route("/login")).withScope("user:email"))
                .handler(AuthorizationHandler.create(PermissionBasedAuthorization.create("user:email"))
                        .addAuthorizationProvider(ScopeAuthorization.create(" ")))
                .handler(new ProtectedProfileHandler(authProvider, userEmail)); (3)
    }
}

package howto.oauth_oidc;

import io.quarkus.qute.Template;
import io.vertx.core.Handler;
import io.vertx.ext.auth.authentication.TokenCredentials;
import io.vertx.ext.auth.oauth2.OAuth2Auth;
import io.vertx.ext.web.RoutingContext;
import io.vertx.ext.web.client.WebClient;
import io.vertx.ext.web.codec.BodyCodec;

class ProtectedProfileHandler implements Handler<RoutingContext> {

    private final OAuth2Auth authProvider;
    private final Template userEmail;

    ProtectedProfileHandler(OAuth2Auth authProvider, Template userEmail) {
        this.authProvider = authProvider;
        this.userEmail = userEmail;
    }

    @Override
    public void handle(RoutingContext ctx) {
        authProvider.userInfo(ctx.user()).onSuccess(userInfo -> {
            // fetch the user emails from the github API
            WebClient.create(ctx.vertx()).getAbs("https://api.github.com/user/emails") (1)
                    .authentication(new TokenCredentials(ctx.user().<String>get("access_token"))) (2)
                    .as(BodyCodec.jsonArray()).send().onSuccess(res -> {
                        userInfo.put("private_emails", res.body());

                        userEmail.data("userInfo", userInfo).renderAsync() (3)
                           .whenComplete((result, failure) -> {
		               if (failure == null) {
		                   ctx.response().putHeader("Content-Type", "text/html").end(result);
		               } else {
		                   ctx.session().destroy();
		                   ctx.fail(failure);
		               }
                           });
                    });
        });
    }
}

<html lang="en">
<body>
<p>Well, well, well, {userInfo.login}!</p>
<p>
  {#if userInfo.email} It looks like your public email
    address is {userInfo.email}.
  {#else} It looks like you don't have a public email.
    That's cool.
  {/if}
</p>
<p>
  {#if userInfo.containsKey('private_emails')}
    With your permission, we were also able to dig up your
    private email addresses:
    {#for email in userInfo.private_emails}
      {email.email}
      {#if email_hasNext},{/if}
    {/for}
  {#else}
    Also, you're a bit secretive about your private email
    addresses.
  {/if}
</p>
</body>
</html>

package howto.oauth_oidc;

import java.util.Set;
import java.util.function.Function;

import org.eclipse.microprofile.rest.client.inject.RestClient;

import howto.oauth_oidc.GitHubApiClient.Email;
import io.quarkus.oidc.OidcSession;
import io.quarkus.oidc.UserInfo;
import io.quarkus.qute.Template;
import io.quarkus.qute.TemplateInstance;
import io.quarkus.security.Authenticated;
import io.smallrye.mutiny.Uni;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.NotAuthorizedException;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.Response;

@Path("/protected")
@Authenticated (1)
public class GitHubProfileService {

    @Inject
    Template userEmail;

    @Inject
    UserInfo userInfo; (2)

    @Inject
    @RestClient
    GitHubApiClient gitHubApiClient; (3)

    @Inject
    OidcSession oidcSession; (4)

    @GET
    @Produces("text/html")
    public Uni<TemplateInstance> getEmail() { (5)
        return gitHubApiClient.userEmails() (6)
            .onItemOrFailure().transformToUni((emails, throwable) -> {
                if (throwable == null) {
                    return Uni.createFrom().item(toUserEmails(emails)); (7)
                }
                return oidcSession.logout(). (8)
                    onItem().transform(new Function<Void, TemplateInstance>() {
                        @Override
                        public TemplateInstance apply(Void t) {
                            throw new NotAuthorizedException(Response.status(401).build());
                        }
                    });
        });
    }

    private TemplateInstance toUserEmails(Set<Email> emails) { (7)
        return userEmail.data("name", userInfo.getName()).data("email", userInfo.getEmail())
                .data("private_emails", emails);
    }

}

package howto.oauth_oidc;

import java.util.Set;

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;

import io.quarkus.oidc.token.propagation.common.AccessToken;
import io.smallrye.mutiny.Uni;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.MediaType;

@RegisterRestClient(configKey = "github-api-client") (1)
@Path("/")
@AccessToken (2)
public interface GitHubApiClient {

    @GET
    @Produces(MediaType.APPLICATION_JSON)
    @Path("user/emails")
    Uni<Set<Email>> userEmails(); (3)

    record Email(String email) {

    }
}

quarkus.oidc.provider=github (1)
quarkus.oidc.client-id=${github_client_id}
quarkus.oidc.credentials.secret=${github_client_secret} (2)

# By default, Quarkus GitHub provider submits the client id and secret in the HTTP Authorization header. (2)
# However, GitHub may require that both client id and secret are submitted as form parameters instead.
# In this case, replace 'quarkus.oidc.credentials.secret=${github_client_secret}'
# with the following two properties:
#quarkus.oidc.credentials.client-secret.method=post
#quarkus.oidc.credentials.client-secret.value=${github_client_secret}

quarkus.oidc.authentication.redirect-path=/login (3)
quarkus.oidc.authentication.restore-path-after-redirect=true (4)

quarkus.http.auth.permission.login.paths=/login (5)
quarkus.http.auth.permission.login.policy=authenticated

quarkus.rest-client.github-api-client.url=https://api.github.com (6)

quarkus.rest-client.logging.scope=request-response (7)
quarkus.rest-client.logging.body-limit=200
quarkus.log.category."org.jboss.resteasy.reactive.client.logging".level=DEBUG

package howto.oauth_oidc;

import io.quarkus.security.Authenticated;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.Context;
import jakarta.ws.rs.core.Response;
import jakarta.ws.rs.core.UriInfo;

@Path("/login")
@Authenticated (1)
public class LoginService {

    @GET
    public Response login(@Context UriInfo uriInfo) {
        return Response.seeOther(uriInfo.getBaseUriBuilder().path("protected").build()).build(); (2)
    }
}

quarkus.oidc.provider=github (1)
quarkus.oidc.client-id=${github_client_id}
quarkus.oidc.credentials.secret=${github_client_secret}

quarkus.oidc.authentication.redirect-path=/login (2)

quarkus.rest-client.github-api-client.url=https://api.github.com (3)

quarkus.rest-client.logging.scope=request-response (4)
quarkus.rest-client.logging.body-limit=200
quarkus.log.category."org.jboss.resteasy.reactive.client.logging".level=DEBUG

@Path("/protected")
@PermissionsAllowed("user:email") (1)
public class GitHubProfileService {
//...
}