Adding helper class for verifying and parsing Clockify signatures and deprecating previous JwtUtils implementation.

Author: gericlockify

addon-sdk/src/main/java/com/cake/clockify/addonsdk/clockify/ClockifySignatureParser.java

@@ -0,0 +1,39 @@
+package com.cake.clockify.addonsdk.clockify;
+
+import io.jsonwebtoken.JwtParser;
+import io.jsonwebtoken.Jwts;
+
+import java.security.interfaces.RSAPublicKey;
+import java.util.Map;
+
+public class ClockifySignatureParser {
+    public static final String CLAIM_TYPE = "type";
+    public static final String CLAIM_BACKEND_URL = "backendUrl";
+    public static final String CLAIM_PTO_URL = "ptoUrl";
+    public static final String CLAIM_REPORTS_URL = "reportsUrl";
+    public static final String CLAIM_WORKSPACE_ID = "workspaceId";
+    public static final String CLAIM_ADDON_ID = "addonId";
+    public static final String CLAIM_USER_ID = "user";
+    public static final String CLAIM_WORKSPACE_ROLE = "workspaceRole";
+
+    public static final String ISSUER = "clockify";
+    public static final String ADDON = "addon";
+    private final JwtParser parser;
+
+    /**
+     * @param addonKey  the key declared inside the addon manifest
+     * @param publicKey the RSA256 public key
+     */
+    public ClockifySignatureParser(String addonKey, RSAPublicKey publicKey) {
+        this.parser = Jwts.parserBuilder()
+                .requireIssuer(ISSUER)
+                .requireSubject(addonKey)
+                .require(CLAIM_TYPE, ADDON)
+                .setSigningKey(publicKey)
+                .build();
+    }
+
+    public Map<String, Object> parseClaims(String token) {
+        return parser.parseClaimsJws(token).getBody();
+    }
+}

addon-sdk/src/main/java/com/cake/clockify/addonsdk/shared/utils/JwtUtils.java

@@ -179,6 +179,19 @@ Filter filter = ...; // servlet filter
 clockifyAddon.addFilter(filter);
 ```
 
+### Validating Clockify tokens
+[https://dev-docs.marketplace.cake.com/development-toolkit/authentication-and-authorization/](https://dev-docs.marketplace.cake.com/development-toolkit/authentication-and-authorization/)
+
+ClockifySignatureParser can be used to verify that the received tokens have been signed by Clockify:
+```java
+RSAPublicKey publicKey = ...;
+ClockifySignatureParser parser = new ClockifySignatureParser("{manifest-key}", publicKey);
+
+String token = ...;
+Map<String, Object> claims = parser.parseClaims(token);
+String workspaceId = (String) claims.get(ClockifySignatureParser.CLAIM_WORKSPACE_ID);
+```
+
 ### Serving the addon
 #### Using the embedded jetty server
 ```java