Commit graph

27 commits

Author SHA1 Message Date
nickfelt
726e925b4a Refactor a few new XsrfTokenManager methods
Followup to comments on []

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148792464
2017-03-07 13:24:21 -05:00
mountford
c7a62e9b98 Add XSRF protection to legacy authentication mechanism
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148689952
2017-03-07 13:18:04 -05:00
mountford
3ac74fa449 Add more tests to new authentication framework
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148459400
2017-02-27 11:19:27 -05:00
nickfelt
ea3a8dfa9d Make Router reject classes with no @Action-returning methods
This provides a safeguard against using TypeInstantiator to resolve the component class, where if resolution is done incorrectly, you end up with java.lang.Object.  Formerly, that would have "succeeded" in generating a Router for Object, which of course has no methods that return @Action classes.  Such a router is pretty useless, so it's better to make Router stricter and have it fail if you give it such a class by accident.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148353224
2017-02-27 11:16:30 -05:00
nickfelt
1e7fc4d64d Remove Builder type param on RequestComponentBuilder/RequestHandler
It turns out this type parameter was never necessary.  A builder only needs the reflexive second type parameter when you want to have a builder inheritance hierarchy where the descendant builders have methods that the ancestor builder doesn't.  In that case, the type param enables the ancestor builder's setter methods to automatically return the correct derived type, so that if you start with a derived builder, you can call a setter method inherited from an ancestor and then continue the chain with setters from the derived builder (e.g. new ContactResource.Builder().setCreationTime(now).setContactId(), which otherwise would have returned an EppResource.Builder from setCreationTime(), at which point the call to setContactId() would not compile).

Even then, it's not strictly necessary to use the type parameter, since you could instead just have each derived type override every inherited method to specify itself as the return type.  But that would be a lot of extra boilerplate and brittleness.

Anyway, in this case, there is a builder hierarchy, but RequestComponentBuilder specifies all the methods that we're ever going to want on our builders, so there's never any need to be able to call specific derived builder methods.  We only even need the individual builder classes so that Dagger can generate them separately for each component.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148269178
2017-02-27 11:12:07 -05:00
mountford
0417f3d3a1 Daggerize XsrfTokenManager
The one-day validity period is also moved from the caller into XsrfTokenManager.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147857716
2017-02-22 11:43:10 -05:00
mountford
a1537a51a9 Remove unnecessary @Inject qualifiers in test classes
No actual injection is happening in test, and at least some compilers complain that @Inject qualifiers are not allowed on non-static inner classes.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147835985
2017-02-17 12:25:05 -05:00
mcilwain
4c7861c2c6 Add servlet API as dependency to auth tests to fix broken build
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147174354
2017-02-14 12:03:48 -05:00
nickfelt
3c4bf1e690 Add request/auth tests to Nomulus release
Followup to []

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147169636
2017-02-14 12:02:19 -05:00
mcilwain
dc66cef8ae Add request/auth package to Nomulus release
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147087621
2017-02-14 12:00:49 -05:00
mountford
c41f5bb31c Make first pass at new OAuth-aware server authentication framework
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147081745
2017-02-14 11:59:19 -05:00
mmuller
b70f57b7c7 Update copyright year on all license headers
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=146111211
2017-02-02 16:27:22 -05:00
jart
734130aa73 Restructure Maven dependencies in build
We're now using java_import_external instead of maven_jar. This allows
us to specify the relationships between jars, thereby allowing us to
eliminate scores of vendor BUILD files that did nothing but re-export
@foo//jar targets, thus addressing the concerns of djhworld on Hacker
News: https://news.ycombinator.com/item?id=12738072

We now have redundant failover mirrors, which is a feature I added to
Bazel 0.4.2 in ed7ced0018

A new standard naming convention is now being used for all Maven repos.
Those names are calculated from the group_artifact name using the
following algorithm that eliminates redundancy:
https://gist.github.com/jart/41bfd977b913c2301627162f1c038e55

The JSR330 dep has been removed from java targets if they also depend
on Dagger, since Dagger always exports JSR330.

Annotation processor dependencies should now be leaner and meaner, by
more appropriately managing what needs to be on the classpath at
runtime. This should trim down the production jar by >1MB. As it stands
currently in the open source world:

- backend_jar_deploy.jar: 50MB
- frontend_jar_deploy.jar: 30MB
- tools_jar_deploy.jar: 45MB

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=143487929
2017-01-09 11:59:04 -05:00
mcilwain
28f6c770c8 Add MOE equivalence for sync on 2016-12-19
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=142449539
2017-01-09 11:59:04 -05:00
mcilwain
2b7d580bb3 Run buildifier on codebase to format BUILD files
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=140362453
2016-11-28 18:15:21 -05:00
mcilwain
3942f0768b Fix Nomulus build type inference error on resolvePendingTransfer()
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=139219997
2016-11-15 15:19:29 -05:00
mcilwain
5262cd2854 Fix RequestHandlerTest type inference errors in Nomulus build
(Caused by []

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=139206844
2016-11-15 13:49:01 -05:00
nickfelt
f742ac8056 Refactor RequestHandler to handle request component construction
This refactors RequestHandler so that it handles the construction of the request
component itself, rather than being handed a pre-built request component
instance constructed by the invoking servlet.

The motivation for this change is so that RequestHandler can be extended in
future CLs to compute authentication results, and can provide those results as
an available binding in the constructed request component.  An alternative
approach could have been to compute the authentication results within
RequestModule itself, but I think it's clearer to keep business logic like
that outside of Dagger providers.

This CL makes the following individual changes:

- Adds request component builders, which implement a RequestComponentBuilder
  interface so they can all be manipulated by RequestHandler

- Instead of obtaining request components via factory methods on the global
  components, one now can have global-scoped bindings just inject the request
  component builders (which requires adding a module to each global component
  declaring the subcomponent).  This follows the recommended approach here:
  http://google.github.io/dagger/subcomponents.html

- Instead of exposing request components on the global component interface,
  we now expose module-specific subclasses of RequestHandler that @Inject the
  appropriate request component builder's provider and pass it to the superclass
  (note that inheritance isn't strictly necessary here but saves boilerplate)

- RequestHandler now takes the Provider<RequestComponentBuilder> and builds
  the component itself using its own fresh RequestModule instance. This provides
  some nice encapsulation but is mainly needed for adding a RequestAuthModule
  in future work.

- RequestHandler also takes UserService now, which can be provided via Dagger
  by the subclass.  Longer-term that will go away in favor of instead providing
  AuthStrategy instances, some of which will use UserService internally.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=138815648
2016-11-15 10:49:05 -05:00
nickfelt
9122372e38 Change Router to do reflective setAccessible() calls itself
This change moves the reflective setAccessible() calls on the request component
methods (needed so that they can be invoked reflectively from RequestHandler)
to within Router itself, eliminating the need to manually call this from each
Servlet class and then pass in the resulting Method objects.  Instead, we just
pass in the request component class and let Router do the rest.

Old comments say that cross-package reflection is not allowed on AppEngine, but
while it's quite possible this was once the case, I can't reproduce that
limitation, and the documentation seems to contradict any such restriction:

"""
An application is allowed full, unrestricted, reflective access to its own
classes.  It can query any private members, call the method
java.lang.reflect.AccessibleObject.setAccessible(), and read/set private
members.
"""
https://cloud.google.com/appengine/docs/java/runtime#reflection

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=138693006
2016-11-10 12:30:44 -05:00
jianglai
59d998954c Use correct <a> tag syntax in javadoc @see tag
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=137946021
2016-11-02 15:19:34 -04:00
mmuller
bbd20ec71d Convert RegistrarServlet to RegistrarAction
Convert to an action and remove ResourceServlet, JsonTransportServlet and
JsonTransportServlet, all of which exist only to support it.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=137519385
2016-11-02 15:19:34 -04:00
shikhman
f76bc70f91 Preserve test logs and test summary output for Kokoro CI runs
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=135494972
2016-10-14 16:57:43 -04:00
cgoldfeder
5ff8b9377c Remove unused request parameter extractor
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=130672143
2016-08-22 14:24:44 -04:00
mcilwain
aa2f283f7c Convert entire project to strict lexicographical import sort ordering
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=127234970
2016-07-13 15:59:53 -04:00
Chris Tingue
2a83d122ef Add MR to expand billing events into OneTimes
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=124837292
2016-06-14 16:31:00 -04:00
Michael Muller
c458c05801 Rename Java packages to use the .google TLD
The dark lord Gosling designed the Java package naming system so that
ownership flows from the DNS system. Since we own the domain name
registry.google, it seems only appropriate that we should use
google.registry as our package name.
2016-05-13 20:04:42 -04:00
Justine Tunney
5012893c1d mv com/google/domain/registry google/registry
This change renames directories in preparation for the great package
rename. The repository is now in a broken state because the code
itself hasn't been updated. However this should ensure that git
correctly preserves history for each file.
2016-05-13 18:55:08 -04:00