ServerTokenStoreImpl lack of proper logging

[longirun]

Environment

Platform version: all 6.xx to 7.xx
Addon version: all

Description the enhancement

There should be ability to switch on/off the debugging logging for cases something goes wrong and we need to locate the issue. For example (spring approach is ok):

if (logger.isDebugEnabled()) {
    logger.debug("Remove access token using refresh token " + refreshTokenValue);
}

Desired methods are:

public void removeAccessToken(String tokenValue)
public void deleteExpiredTokens()
public void storeAccessToken(String tokenValue, byte[] accessTokenBytes, String authenticationKey, byte[] authenticationBytes, Date tokenExpiry, String userLogin, Locale locale, String refreshTokenValue)
public void removeRefreshToken(String refreshTokenValue)
public void storeRefreshToken(String refreshTokenValue, byte[] refreshTokenBytes, byte[] authenticationBytes, Date tokenExpiry, String userLogin)
public void removeAccessTokenUsingRefreshToken(String refreshTokenValue)
public byte[] getRefreshTokenByTokenValue(String tokenValue)
public byte[] getAuthenticationByRefreshTokenValue(String tokenValue)

Possible implementation (in our project, it is better to obfuscate active tokens):

public class EgisServerTokenStoreImpl extends ServerTokenStoreImpl {
    @Override
    public void removeAccessToken(String tokenValue) {
        log.debug("Remove access token " + tokenValue);

        super.removeAccessToken(tokenValue);

        messagingTokenStore.removeToken(tokenValue);
    }

    @Override
    public void deleteExpiredTokens() {
        log.debug("Start deleting expired access and refresh tokens");

        super.deleteExpiredTokens();
    }

    @Override
    public void storeAccessToken(String tokenValue, byte[] accessTokenBytes, String authenticationKey, byte[] authenticationBytes, Date tokenExpiry, String userLogin, Locale locale, String refreshTokenValue) {
        log.debug("Store access token {} for user {}, expiring {}", ObfuscationHelper.obfuscateToken(tokenValue),
                ObfuscationHelper.obfuscateEmail(userLogin), tokenExpiry);

        super.storeAccessToken(tokenValue, accessTokenBytes, authenticationKey, authenticationBytes, tokenExpiry, userLogin, locale, refreshTokenValue);
    }

    @Override
    public void removeRefreshToken(String refreshTokenValue) {
        log.debug("Remove refresh token " + refreshTokenValue);

        super.removeRefreshToken(refreshTokenValue);

        clusterManagerAPI.send(new TokenStoreRemoveRefreshTokenMsg(refreshTokenValue));
    }

    @Override
    public void storeRefreshToken(String refreshTokenValue, byte[] refreshTokenBytes, byte[] authenticationBytes, Date tokenExpiry, String userLogin) {
        log.debug("Store refresh token {} for user {}, expiring {}", ObfuscationHelper.obfuscateToken(refreshTokenValue),
                ObfuscationHelper.obfuscateEmail(userLogin), tokenExpiry);

        super.storeRefreshToken(refreshTokenValue, refreshTokenBytes, authenticationBytes, tokenExpiry, userLogin);

        clusterManagerAPI.send(new TokenStoreAddRefreshTokenMsg(refreshTokenValue, refreshTokenBytes, authenticationBytes, tokenExpiry, userLogin, null));
    }

    @Override
    public void removeAccessTokenUsingRefreshToken(String refreshTokenValue) {
        log.debug("Remove access token using refresh token " + refreshTokenValue);

        super.removeAccessTokenUsingRefreshToken(refreshTokenValue);
    }

    @Override
    public byte[] getRefreshTokenByTokenValue(String tokenValue) {
        log.debug("Get refresh token by value " + ObfuscationHelper.obfuscateToken(tokenValue));

        return super.getRefreshTokenByTokenValue(tokenValue);
    }

    @Override
    public byte[] getAuthenticationByRefreshTokenValue(String tokenValue) {
        log.debug("Get auth by Refresh token " + ObfuscationHelper.obfuscateToken(tokenValue));

        byte[] auth = super.getAuthenticationByRefreshTokenValue(tokenValue);
        if (auth == null) {
            log.warn("Auth bytes not found for refresh token " + ObfuscationHelper.obfuscateToken(tokenValue));

            super.getRefreshTokenByTokenValue(tokenValue);
            auth = super.getAuthenticationByRefreshTokenValue(tokenValue);
        }

        return auth;
    }
}

Implementation:

• Logging has been added to desired methods.
• Two protected methods added into ServerTokenStoreImpl.java for obfuscation tuning:

protected String obfuscateToken(String token) //uses RestTokenMasker to mask token by default; considers "cuba.rest.tokenMaskingEnabled" setting
protected String obfuscateUser(String user) //default implementation does nothing: same user returned

QA Notes

1. Use project with restapi addon and enable debug logging for com.haulmont.addon.restapi.store. e.g add in logback.xml:

    <logger name="com.haulmont.addon.restapi.store" level="DEBUG">
        <appender-ref ref="Console"/>
        <appender-ref ref="File"/>
    </logger>

2. Check logs for bean ServerTokenStoreImpl after user authorisation
   ER: logs in app.log about

public void storeAccessToken(String tokenValue, byte[] accessTokenBytes, String authenticationKey, byte[] authenticationBytes, Date tokenExpiry, String userLogin, Locale locale, String refreshTokenValue)
public void storeRefreshToken(String refreshTokenValue, byte[] refreshTokenBytes, byte[] authenticationBytes, Date tokenExpiry, String userLogin)

3. Create JMX-bean/screen to invoke methods and check logs for:

public void removeAccessToken(String tokenValue)
public void deleteExpiredTokens()
public void removeRefreshToken(String refreshTokenValue)
public void removeAccessTokenUsingRefreshToken(String refreshTokenValue)
public byte[] getRefreshTokenByTokenValue(String tokenValue)
public byte[] getAuthenticationByRefreshTokenValue(String tokenValue)