Added database tables and java object to handle ISS tokens

java/code/src/com/redhat/rhn/common/hibernate/AnnotationRegistry.java

@@ -1,16 +1,12 @@
 /*
- * Copyright (c) 2018 SUSE LLC
+ * Copyright (c) 2018--2024 SUSE LLC
  *
  * This software is licensed to you under the GNU General Public License,
  * version 2 (GPLv2). There is NO WARRANTY for this software, express or
  * implied, including the implied warranties of MERCHANTABILITY or FITNESS
  * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
  * along with this software; if not, see
  * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
- *
- * Red Hat trademarks are not licensed under GPLv2. No permission is
- * granted to use or replicate Red Hat trademarks that are incorporated
- * in this software or its documentation.
  */
 package com.redhat.rhn.common.hibernate;
 
@@ -100,6 +96,7 @@
 import com.suse.manager.model.attestation.CoCoResultTypeConverter;
 import com.suse.manager.model.attestation.ServerCoCoAttestationConfig;
 import com.suse.manager.model.attestation.ServerCoCoAttestationReport;
+import com.suse.manager.model.hub.IssAccessToken;
 import com.suse.manager.model.hub.IssHub;
 import com.suse.manager.model.hub.IssPeripheral;
 import com.suse.manager.model.hub.IssPeripheralChannels;
@@ -209,7 +206,8 @@ private AnnotationRegistry() {
         TokenChannelAppStream.class,
         IssHub.class,
         IssPeripheral.class,
-        IssPeripheralChannels.class
+        IssPeripheralChannels.class,
+        IssAccessToken.class
     );
 
     /**

java/code/src/com/redhat/rhn/domain/iss/IssRole.java

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ */
+
+package com.redhat.rhn.domain.iss;
+
+public enum IssRole {
+    HUB,
+    PERIPHERAL
+}

java/code/src/com/suse/manager/model/hub/IssAccessToken.java

@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ */
+
+package com.suse.manager.model.hub;
+
+import org.hibernate.annotations.Type;
+
+import java.time.Instant;
+import java.time.ZonedDateTime;
+import java.util.Date;
+import java.util.Objects;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+import javax.persistence.Transient;
+
+@Entity
+@Table(name = "suseISSAccessToken")
+public class IssAccessToken {
+
+    private long id;
+
+    private String token;
+
+    private TokenType type;
+
+    private String serverFqdn;
+
+    private Date expirationDate;
+
+    private boolean valid;
+
+    /**
+     * Default constructor
+     */
+    protected IssAccessToken() {
+        // Used by Hibernate
+    }
+
+    /**
+     * Build a new access token with the default expiration period of 1 year
+     * @param typeIn the type of token
+     * @param tokenIn the token
+     * @param serverFqdnIn the FQDN of the server related to this token
+     */
+    public IssAccessToken(TokenType typeIn, String tokenIn, String serverFqdnIn) {
+        this(typeIn, tokenIn, serverFqdnIn, Date.from(ZonedDateTime.now().plusYears(1).toInstant()));
+    }
+
+    /**
+     * Build a new access token
+     * @param typeIn the type of token
+     * @param tokenIn the token
+     * @param serverFqdnIn the FQDN of the server related to this token
+     * @param expirationDateIn the instant the token expires
+     */
+    public IssAccessToken(TokenType typeIn, String tokenIn, String serverFqdnIn, Instant expirationDateIn) {
+        this(typeIn, tokenIn, serverFqdnIn, Date.from(expirationDateIn));
+    }
+
+    /**
+     * Build a new access token
+     * @param typeIn the type of token
+     * @param tokenIn the token
+     * @param serverFqdnIn the FQDN of the server related to this token
+     * @param expirationDateIn the instant the token expires
+     */
+    public IssAccessToken(TokenType typeIn, String tokenIn, String serverFqdnIn, Date expirationDateIn) {
+        this.token = tokenIn;
+        this.type = typeIn;
+        this.serverFqdn = serverFqdnIn;
+        this.expirationDate = expirationDateIn;
+        this.valid = true;
+    }
+
+    @Id
+    @Column(name = "id")
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    public long getId() {
+        return id;
+    }
+
+    public void setId(long idIn) {
+        this.id = idIn;
+    }
+
+    @Column(name = "token")
+    public String getToken() {
+        return token;
+    }
+
+    public void setToken(String tokenIn) {
+        this.token = tokenIn;
+    }
+
+    @Column(name = "type")
+    @Type(type = "com.suse.manager.model.hub.TokenTypeEnumType")
+    public TokenType getType() {
+        return type;
+    }
+
+    public void setType(TokenType typeIn) {
+        this.type = typeIn;
+    }
+
+    @Column(name = "server_fqdn")
+    public String getServerFqdn() {
+        return serverFqdn;
+    }
+
+    public void setServerFqdn(String serverFqdnIn) {
+        this.serverFqdn = serverFqdnIn;
+    }
+
+    @Column(name = "expiration_date")
+    @Temporal(TemporalType.TIMESTAMP)
+    public Date getExpirationDate() {
+        return expirationDate;
+    }
+
+    public void setExpirationDate(Date expirationDateIn) {
+        this.expirationDate = expirationDateIn;
+    }
+
+    @Column(name = "valid")
+    public boolean isValid() {
+        return valid;
+    }
+
+    public void setValid(boolean validIn) {
+        this.valid = validIn;
+    }
+
+    /**
+     * Checks if the current instance is expired.
+     * @return true if the current date is after the expiration date
+     */
+    @Transient
+    public boolean isExpired() {
+        if (expirationDate == null) {
+            return false;
+        }
+
+        return new Date().after(expirationDate);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof IssAccessToken issAccessToken)) {
+            return false;
+        }
+        return Objects.equals(getToken(), issAccessToken.getToken()) &&
+            Objects.equals(getType(), issAccessToken.getType()) &&
+            Objects.equals(getServerFqdn(), issAccessToken.getServerFqdn());
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(getToken(), getType(), getServerFqdn());
+    }
+
+    @Override
+    public String toString() {
+        final StringBuilder sb = new StringBuilder("IssAccessToken{");
+        sb.append(", type=").append(type);
+        sb.append(", serverFqdn='").append(serverFqdn).append('\'');
+        sb.append('}');
+        return sb.toString();
+    }
+}

java/code/src/com/suse/manager/model/hub/TokenType.java

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ */
+
+package com.suse.manager.model.hub;
+
+import com.redhat.rhn.domain.Labeled;
+
+public enum TokenType implements Labeled {
+    ISSUED,
+    CONSUMED;
+
+    @Override
+    public String getLabel() {
+        return this.name().toLowerCase();
+    }
+}

java/code/src/com/suse/manager/model/hub/TokenTypeEnumType.java

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ */
+
+package com.suse.manager.model.hub;
+
+import com.redhat.rhn.domain.DatabaseEnumType;
+
+/**
+ * Maps the {@link TokenType} enum to its label
+ */
+public class TokenTypeEnumType extends DatabaseEnumType<TokenType> {
+
+    /**
+     * Default Constructor
+     */
+    public TokenTypeEnumType() {
+        super(TokenType.class);
+    }
+}

java/spacewalk-java.changes.mackdk.issv3-auth

@@ -0,0 +1 @@
+- Added entities to handle token authentication

schema/spacewalk/common/tables/suseISSAccessToken.sql

@@ -0,0 +1,24 @@
+--
+-- Copyright (c) 2024 SUSE LLC
+--
+-- This software is licensed to you under the GNU General Public License,
+-- version 2 (GPLv2). There is NO WARRANTY for this software, express or
+-- implied, including the implied warranties of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+-- along with this software; if not, see
+-- http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+--
+
+CREATE TABLE suseISSAccessToken
+(
+    id 	                BIGINT CONSTRAINT suse_isstoken_id_pk PRIMARY KEY
+                          GENERATED ALWAYS AS IDENTITY,
+    token               VARCHAR(1024) NOT NULL,
+    type                iss_access_token_type_t NOT NULL,
+    server_fqdn         VARCHAR(512) NOT NULL,
+    valid               BOOLEAN,
+    expiration_date     TIMESTAMPTZ NULL
+);
+
+CREATE INDEX suse_isstoken_server_fqdn_type_idx
+    ON suseISSAccessToken (server_fqdn, type);

schema/spacewalk/common/tables/tables.deps

@@ -1,4 +1,5 @@
 #
+# Copyright (c) 2024 SUSE LLC
 # Copyright (c) 2008--2018 Red Hat, Inc.
 #
 # This software is licensed to you under the GNU General Public License,
@@ -245,6 +246,7 @@ suseImageStore                     :: suseCredentials web_customer suseImageStor
 suseISSHub                         :: suseCredentials
 suseISSPeripheral                  :: suseCredentials
 suseISSPeripheralChannels          :: suseISSPeripheral rhnChannel
+suseISSAccessToken                 :: iss_access_token_type_t
 suseMaintenanceCalendar            :: web_customer
 suseMaintenanceSchedule            :: web_customer suseMaintenanceCalendar
 suseMgrServerInfo                  :: rhnServer rhnPackageEVR suseCredentials

schema/spacewalk/postgres/class/iss_access_token_type_t.sql

@@ -0,0 +1,15 @@
+--
+-- Copyright (c) 2024 SUSE LLC
+--
+-- This software is licensed to you under the GNU General Public License,
+-- version 2 (GPLv2). There is NO WARRANTY for this software, express or
+-- implied, including the implied warranties of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+-- along with this software; if not, see
+-- http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+--
+
+CREATE TYPE iss_access_token_type_t AS ENUM (
+    'issued',
+    'consumed'
+);

schema/spacewalk/susemanager-schema.changes.mackdk.issv3-auth

@@ -0,0 +1 @@
+- Added tables to handle token authentication

schema/spacewalk/upgrade/susemanager-schema-5.1.1-to-susemanager-schema-5.1.2/001-issv3-add-tables.sql

@@ -59,3 +59,29 @@ CREATE TABLE IF NOT EXISTS suseISSPeripheralChannels
 
 CREATE UNIQUE INDEX IF NOT EXISTS suse_issperchan_pid_cid_uq
 ON suseISSPeripheralChannels (peripheral_id, channel_id);
+
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'iss_access_token_type_t') THEN
+        CREATE TYPE iss_access_token_type_t AS ENUM (
+            'issued',
+            'consumed'
+        );
+    ELSE
+        RAISE NOTICE 'type "iss_access_token_type_t" already exists, skipping';
+    END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS suseISSAccessToken
+(
+    id 	                BIGINT CONSTRAINT suse_isstoken_id_pk PRIMARY KEY
+                          GENERATED ALWAYS AS IDENTITY,
+    token               VARCHAR(1024) NOT NULL,
+    type                iss_access_token_type_t NOT NULL,
+    server_fqdn         VARCHAR(512) NOT NULL,
+    valid               BOOLEAN,
+    expiration_date     TIMESTAMPTZ NULL
+);
+
+CREATE INDEX IF NOT EXISTS suse_isstoken_server_fqdn_type_idx
+    ON suseISSAccessToken (server_fqdn, type);