<commit_before>/*
 * Copyright (c) 2015-2015, Index Data
 * All rights reserved.
 * See the file LICENSE for details.
 */
package com.indexdata.sling.auth;

import io.vertx.core.json.DecodeException;
import io.vertx.core.json.Json;
import io.vertx.ext.web.RoutingContext;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.logging.Level;
import java.util.logging.Logger;

/**
 * A dummy auth module.
 * Provides a minimal authentication mechanism.  
 * @author heikki
 * 
 * TODO: Check the X-Sling-Tenant header matches the tenant parameter, or use
 * that one instead of the parameter.
 * TODO: Separate the headers so that
 *   - X-Sling-Tenant is the tenant
 *   - X-Sling-User is the user
 *   - X-Sling-token is the crypto token
 * OKAPI needs to get hold of the tenant already before a login, so it should
 * be separate.

 * 
 * TODO: Add a time stamp and some salt to the crypto. 
 * 
 * TODO: Accept also the previous token, so sessions don't die at turnover.
 */

public class Auth {

    static final String SLINGTOKENHEADER = "X-Sling-Token";
    
  /**
   * Calculate a token from tenant and username.
   * The token is like ttt:uuu:ccc, where ttt is the tenant, uuu is the user,
   * and ccc is a crypto thing that depends on those two. 
   * @param tenant
   * @param user
   * @return
   * @throws NoSuchAlgorithmException which should never happen
   */
  private String token (String tenant, String user ) throws NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance("MD5");
    String salt = "salt"; // TODO - Add something from the current date
    md.update(salt.getBytes());
    md.update(tenant.getBytes());
    md.update(user.getBytes());
    byte[] mdbytes = md.digest();     

    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < mdbytes.length; i++) {
      sb.append(Integer.toString((mdbytes[i] & 0xff) + 0x100, 16).substring(1));
    }
    return "" + tenant + ":" + user + ":" + sb.toString();
  };

  public void login(RoutingContext ctx) {
    //System.out.println("Auth.login called");
    final String json = ctx.getBodyAsString();
    LoginParameters p;
    try {
      //System.out.println("Got some json" + json);
      p = Json.decodeValue(json, LoginParameters.class);<commit_msg>Just a small comment to test github/slack<commit_after>/*
 * Copyright (c) 2015-2015, Index Data
 * All rights reserved.
 * See the file LICENSE for details.
 */
package com.indexdata.sling.auth;

import io.vertx.core.json.DecodeException;
import io.vertx.core.json.Json;
import io.vertx.ext.web.RoutingContext;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.logging.Level;
import java.util.logging.Logger;

/**
 * A dummy auth module.
 * Provides a minimal authentication mechanism.  
 * @author heikki
 * 
 * TODO: Check the X-Sling-Tenant header matches the tenant parameter, or use
 * that one instead of the parameter.
 * TODO: Separate the headers so that
 *   - X-Sling-Tenant is the tenant
 *   - X-Sling-User is the user
 *   - X-Sling-token is the crypto token
 * OKAPI needs to get hold of the tenant already before a login, so it should
 * be separate.

 * 
 * TODO: Add a time stamp and some salt to the crypto. 
 * 
 * TODO: Accept also the previous token, so sessions don't die at turnover.
 */

public class Auth {

    static final String SLINGTOKENHEADER = "X-Sling-Token";
    
  /**
   * Calculate a token from tenant and username.
   * The token is like ttt:uuu:ccc, where ttt is the tenant, uuu is the user,
   * and ccc is a crypto thing that depends on those two. 
   * @param tenant
   * @param user
   * @return the token
   * @throws NoSuchAlgorithmException which should never happen
   */
  private String token (String tenant, String user ) throws NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance("MD5");
    String salt = "salt"; // TODO - Add something from the current date
    md.update(salt.getBytes());
    md.update(tenant.getBytes());
    md.update(user.getBytes());
    byte[] mdbytes = md.digest();     

    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < mdbytes.length; i++) {
      sb.append(Integer.toString((mdbytes[i] & 0xff) + 0x100, 16).substring(1));
    }
    return "" + tenant + ":" + user + ":" + sb.toString();
  };

  public void login(RoutingContext ctx) {
    //System.out.println("Auth.login called");
    final String json = ctx.getBodyAsString();
    LoginParameters p;
    try {
      //System.out.println("Got some json" + json);
      p = Json.decodeValue(json, LoginParameters.class);
{'fraction_non_alphanumeric': 0.11199484092863285, 'fraction_numerical': 0.007738607050730868, 'mean_word_length': 3.2454379562043796, 'pattern_counts': {'":': 4, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6536235', 'n_tokens_mistral': 1439, 'n_tokens_neox': 1383, 'n_words': 479}