<commit_before>package io.cattle.platform.iaas.api.auth;

import io.cattle.platform.api.auth.Identity;
import io.cattle.platform.archaius.util.ArchaiusUtil;
import io.cattle.platform.core.constants.AccountConstants;
import io.cattle.platform.core.constants.ProjectConstants;
import io.cattle.platform.core.dao.AccountDao;
import io.cattle.platform.core.model.Account;
import io.cattle.platform.core.model.AuthToken;
import io.cattle.platform.core.util.SettingsUtils;
import io.cattle.platform.iaas.api.auth.dao.AuthDao;
import io.cattle.platform.iaas.api.auth.dao.AuthTokenDao;
import io.cattle.platform.iaas.api.auth.identity.Token;
import io.cattle.platform.iaas.api.auth.integration.interfaces.TokenUtil;
import io.cattle.platform.iaas.api.auth.projects.ProjectResourceManager;
import io.cattle.platform.object.ObjectManager;
import io.cattle.platform.object.util.DataAccessor;
import io.cattle.platform.token.TokenException;
import io.cattle.platform.token.TokenService;
import io.cattle.platform.util.type.CollectionUtils;
import io.github.ibuildthecloud.gdapi.context.ApiContext;
import io.github.ibuildthecloud.gdapi.exception.ClientVisibleException;
import io.github.ibuildthecloud.gdapi.request.ApiRequest;
import io.github.ibuildthecloud.gdapi.util.ResponseCodes;
import io.github.ibuildthecloud.gdapi.validation.ValidationErrorCodes;

import java.util.ArrayList;
import java.util.Date;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.inject.Inject;
import javax.servlet.http.Cookie;

import org.apache.commons.lang.ObjectUtils;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.netflix.config.DynamicBooleanProperty;

public abstract class AbstractTokenUtil implements TokenUtil {

    public static final String ACCESSMODE = "accessMode";
    public static final String TOKEN = "token";
    public static final String ACCOUNT_ID = "account_id";
    public static final String ACCESS_TOKEN_INVALID = "InvalidAccessToken";
    public static final String ID_LIST = "idList";
    public static final String USER_IDENTITY = "userIdentity";
    public static final String USER_TYPE = "userType";

    public static final String REQUIRED_ACCESSMODE = "required";
    public static final String RESTRICTED_ACCESSMODE = "restricted";
    public static final String UNRESTRICTED_ACCESSMODE = "unrestricted";

    private static final Logger log = LoggerFactory.getLogger(AbstractTokenUtil.class);
    private static final DynamicBooleanProperty CREATE_PROJECT = ArchaiusUtil.getBoolean("project.create.default");

    @Inject
    protected AuthDao authDao;

    @Inject
    TokenService tokenService;

    @Inject
    ProjectResourceManager projectResourceManager;

    @Inject
    AuthTokenDao authTokenDao;

    @Inject
    ObjectManager objectManager;

    @Inject
    SettingsUtils settingsUtils;

    @Inject
    AccountDao accountDao;

    @Override
    public Account getAccountFromJWT() {
        Map<String, Object> jsonData = getJsonData();
        if (jsonData == null) {
            return null;
        }
        String accountId = ObjectUtils.toString(jsonData.get(ACCOUNT_ID), null);
        if (null == accountId) {
            return null;
        }
        Account account = authDao.getAccountByExternalId(accountId, userType());
        if (account != null && !accountDao.isActiveAccount(account)) {
            throw new ClientVisibleException(ResponseCodes.UNAUTHORIZED);
        }
        return account;
    }

    protected Map<String, Object> getJsonData() {
        return getJsonData(getJWT(), tokenType());
    }

    private Map<String, Object> getJsonData(String jwtKey, String tokenType) {
        if (StringUtils.isEmpty(jwtKey)){
            return null;
        }
        String toParse;
        toParse = removeBearer(jwtKey);
        if (StringUtils.isBlank(toParse)) {
            return null;
        }
        String dbJwt = retrieveJwt(toParse);
        if (StringUtils.isNotBlank(dbJwt)){
            toParse = dbJwt;
        }
        toParse = removeBearer(toParse);
        if (StringUtils.isEmpty(toParse)) {
            return null;
        }
        Map<String, Object> jsonData;
        try {
            jsonData = tokenService.getJsonPayload(toParse, true);
        } catch (TokenException e) { // in case of invalid token
            return null;
        }
        if (jsonData == null) {
            throw new ClientVisibleException(ResponseCodes.BAD_REQUEST, ACCESS_TOKEN_INVALID,
                    "Json Web Token invalid.", null);
        }
        String tokenTypeActual = (String) jsonData.get(TOKEN);
        if (!StringUtils.equals(tokenType, tokenTypeActual)) {
            return null;
        }
        if (!isAllowed(jsonData)) {
            throw new ClientVisibleException(ResponseCodes.UNAUTHORIZED);
        }
        return jsonData;
    }

    private String removeBearer(String jwtKey) {
        String toParse;
        String[] tokenArr = jwtKey.split("\\s+");
        if (tokenArr.length == 2) {<commit_msg>Removed token_type check while decrypting token<commit_after>package io.cattle.platform.iaas.api.auth;

import io.cattle.platform.api.auth.Identity;
import io.cattle.platform.archaius.util.ArchaiusUtil;
import io.cattle.platform.core.constants.AccountConstants;
import io.cattle.platform.core.constants.ProjectConstants;
import io.cattle.platform.core.dao.AccountDao;
import io.cattle.platform.core.model.Account;
import io.cattle.platform.core.model.AuthToken;
import io.cattle.platform.core.util.SettingsUtils;
import io.cattle.platform.iaas.api.auth.dao.AuthDao;
import io.cattle.platform.iaas.api.auth.dao.AuthTokenDao;
import io.cattle.platform.iaas.api.auth.identity.Token;
import io.cattle.platform.iaas.api.auth.integration.interfaces.TokenUtil;
import io.cattle.platform.iaas.api.auth.projects.ProjectResourceManager;
import io.cattle.platform.object.ObjectManager;
import io.cattle.platform.object.util.DataAccessor;
import io.cattle.platform.token.TokenException;
import io.cattle.platform.token.TokenService;
import io.cattle.platform.util.type.CollectionUtils;
import io.github.ibuildthecloud.gdapi.context.ApiContext;
import io.github.ibuildthecloud.gdapi.exception.ClientVisibleException;
import io.github.ibuildthecloud.gdapi.request.ApiRequest;
import io.github.ibuildthecloud.gdapi.util.ResponseCodes;
import io.github.ibuildthecloud.gdapi.validation.ValidationErrorCodes;

import java.util.ArrayList;
import java.util.Date;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.inject.Inject;
import javax.servlet.http.Cookie;

import org.apache.commons.lang.ObjectUtils;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.netflix.config.DynamicBooleanProperty;

public abstract class AbstractTokenUtil implements TokenUtil {

    public static final String ACCESSMODE = "accessMode";
    public static final String TOKEN = "token";
    public static final String ACCOUNT_ID = "account_id";
    public static final String ACCESS_TOKEN_INVALID = "InvalidAccessToken";
    public static final String ID_LIST = "idList";
    public static final String USER_IDENTITY = "userIdentity";
    public static final String USER_TYPE = "userType";

    public static final String REQUIRED_ACCESSMODE = "required";
    public static final String RESTRICTED_ACCESSMODE = "restricted";
    public static final String UNRESTRICTED_ACCESSMODE = "unrestricted";

    private static final Logger log = LoggerFactory.getLogger(AbstractTokenUtil.class);
    private static final DynamicBooleanProperty CREATE_PROJECT = ArchaiusUtil.getBoolean("project.create.default");

    @Inject
    protected AuthDao authDao;

    @Inject
    TokenService tokenService;

    @Inject
    ProjectResourceManager projectResourceManager;

    @Inject
    AuthTokenDao authTokenDao;

    @Inject
    ObjectManager objectManager;

    @Inject
    SettingsUtils settingsUtils;

    @Inject
    AccountDao accountDao;

    @Override
    public Account getAccountFromJWT() {
        Map<String, Object> jsonData = getJsonData();
        if (jsonData == null) {
            return null;
        }
        String accountId = ObjectUtils.toString(jsonData.get(ACCOUNT_ID), null);
        if (null == accountId) {
            return null;
        }
        Account account = authDao.getAccountByExternalId(accountId, userType());
        if (account != null && !accountDao.isActiveAccount(account)) {
            throw new ClientVisibleException(ResponseCodes.UNAUTHORIZED);
        }
        return account;
    }

    protected Map<String, Object> getJsonData() {
        return getJsonData(getJWT(), tokenType());
    }

    private Map<String, Object> getJsonData(String jwtKey, String tokenType) {
        if (StringUtils.isEmpty(jwtKey)){
            return null;
        }
        String toParse;
        toParse = removeBearer(jwtKey);
        if (StringUtils.isBlank(toParse)) {
            return null;
        }
        String dbJwt = retrieveJwt(toParse);
        if (StringUtils.isNotBlank(dbJwt)){
            toParse = dbJwt;
        }
        toParse = removeBearer(toParse);
        if (StringUtils.isEmpty(toParse)) {
            return null;
        }
        Map<String, Object> jsonData;
        try {
            jsonData = tokenService.getJsonPayload(toParse, true);
        } catch (TokenException e) { // in case of invalid token
            return null;
        }
        if (jsonData == null) {
            throw new ClientVisibleException(ResponseCodes.BAD_REQUEST, ACCESS_TOKEN_INVALID,
                    "Json Web Token invalid.", null);
        }
        if (!isAllowed(jsonData)) {
            throw new ClientVisibleException(ResponseCodes.UNAUTHORIZED);
        }
        return jsonData;
    }

    private String removeBearer(String jwtKey) {
        String toParse;
        String[] tokenArr = jwtKey.split("\\s+");
        if (tokenArr.length == 2) {
{'fraction_non_alphanumeric': 0.09460392621091053, 'fraction_numerical': 0.000789188122718753, 'mean_word_length': 3.384948096885813, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2281760', 'n_tokens_mistral': 2937, 'n_tokens_neox': 2947, 'n_words': 610}