Merge branch 'f-one-time-tokens' of gitlab.com:caosdb/caosdb-server into f-one-time-tokens

src/main/java/caosdb/server/accessControl/SelfValidatingAuthenticationToken.java

@@ -147,7 +147,14 @@ public abstract class SelfValidatingAuthenticationToken extends Principal
   @Override
   public abstract String toString();
 
-  /** Implementation specific version of a peppered checksum. */
+  /**
+   * Implementation specific version of a peppered checksum.
+   *
+   * <p>For secure operation, implementing classes must make sure that the pepper is actually used
+   * in calculating the checksum and that the checksum can not be used to infer information about
+   * the pepper. This can be achieved for example by using the {@link calcChecksum(final Object...
+   * fields)} method.
+   */
   public abstract String calcChecksum(String pepper);
 
   /** No credentials (returns null), since this token is self-validating. */
@@ -214,7 +221,7 @@ public abstract class SelfValidatingAuthenticationToken extends Principal
       case "S":
         return SessionToken.parse(array);
       default:
-        throw new AuthenticationException("Could not parse the authtoken string.");
+        throw new AuthenticationException("Could not parse the authtoken string (unknown type).");
     }
   }
 

src/test/java/caosdb/server/authentication/AuthTokenTest.java

@@ -128,15 +128,21 @@ public class AuthTokenTest {
     Assert.assertTrue(t6.isHashValid());
     Assert.assertFalse(t6.isValid());
 
-    Assert.assertEquals(t1.toString(), SessionToken.parse(t1.toString()).toString());
-    Assert.assertEquals(t3.toString(), SessionToken.parse(t3.toString()).toString());
-    Assert.assertEquals(t5.toString(), SessionToken.parse(t5.toString()).toString());
-    Assert.assertEquals(t6.toString(), SessionToken.parse(t6.toString()).toString());
-
-    Assert.assertFalse(SessionToken.parse(t1.toString()).isHashValid());
-    Assert.assertTrue(SessionToken.parse(t3.toString()).isHashValid());
-    Assert.assertTrue(SessionToken.parse(t5.toString()).isHashValid());
-    Assert.assertTrue(SessionToken.parse(t6.toString()).isHashValid());
+    // All tokens can be successfully parsed back.
+    final SelfValidatingAuthenticationToken t1p = SessionToken.parse(t1.toString());
+    final SelfValidatingAuthenticationToken t3p = SessionToken.parse(t3.toString());
+    final SelfValidatingAuthenticationToken t5p = SessionToken.parse(t5.toString());
+    final SelfValidatingAuthenticationToken t6p = SessionToken.parse(t6.toString());
+    Assert.assertEquals(t1.toString(), t1p.toString());
+    Assert.assertEquals(t3.toString(), t3p.toString());
+    Assert.assertEquals(t5.toString(), t5p.toString());
+    Assert.assertEquals(t6.toString(), t6p.toString());
+
+    // ... and parsed tokens have the correct hash validation
+    Assert.assertFalse(t1p.isHashValid());
+    Assert.assertTrue(t3p.isHashValid());
+    Assert.assertTrue(t5p.isHashValid());
+    Assert.assertTrue(t6p.isHashValid());
 
     Assert.assertFalse(
         AuthenticationUtils.parseSessionTokenCookie(
@@ -170,12 +176,13 @@ public class AuthTokenTest {
     Assert.assertTrue(t1.isValid());
 
     String serialized = t1.toString();
-    SelfValidatingAuthenticationToken parsed = OneTimeAuthenticationToken.parse(serialized);
+    OneTimeAuthenticationToken parsed =
+        (OneTimeAuthenticationToken) OneTimeAuthenticationToken.parse(serialized);
 
     Assert.assertEquals(t1, parsed);
     Assert.assertEquals(serialized, parsed.toString());
 
-    Assert.assertEquals(1L, t1.getMaxReplays());
+    Assert.assertEquals(1L, parsed.getMaxReplays());
     Assert.assertFalse(parsed.isExpired());
     Assert.assertTrue(parsed.isHashValid());
     Assert.assertTrue(parsed.isValid());