refactor: merge jwt-signer-spi into jwt-signer (#5657)

Author: ndr-brt

core/common/lib/crypto-common-lib/build.gradle.kts

@@ -19,7 +19,7 @@ dependencies {
     api(project(":spi:common:keys-spi"))
     api(libs.nimbus.jwt) // nimbus classes are exposed on the API surface of CryptoConverter and DefaultJwsSignerProvider
     implementation(project(":spi:common:boot-spi"))
-    implementation(project(":spi:common:jwt-signer-spi"))
+    implementation(project(":spi:common:jwt-spi"))
 
     // used for the Ed25519 Verifier in conjunction with OctetKeyPairs (OKP)
     runtimeOnly(libs.tink)

core/common/lib/crypto-common-lib/src/main/java/org/eclipse/edc/security/token/jwt/CryptoConverter.java

@@ -367,18 +367,6 @@ private static ECPublicKey generatePublicKeyFrom(ECPrivateKey priv) throws Inval
         return (ECPublicKey) KeyFactory.getInstance("EC").generatePublic(spec);
     }
 
-    /**
-     * reverses an array in-place
-     */
-    private static byte[] reverseArray(byte[] array) {
-        for (var i = 0; i < array.length / 2; i++) {
-            var temp = array[i];
-            array[i] = array[array.length - 1 - i];
-            array[array.length - 1 - i] = temp;
-        }
-        return array;
-    }
-
     private static Ed25519Verifier createEdDsaVerifier(PublicKey publicKey) throws JOSEException {
         var edKey = (EdECPublicKey) publicKey;
         var curve = getCurveAllowing(edKey, ALGORITHM_ED25519);

core/common/lib/crypto-common-lib/src/main/java/org/eclipse/edc/security/token/jwt/DefaultJwsSignerProvider.java

@@ -15,7 +15,7 @@
 package org.eclipse.edc.security.token.jwt;
 
 import com.nimbusds.jose.JWSSigner;
-import org.eclipse.edc.jwt.signer.spi.JwsSignerProvider;
+import org.eclipse.edc.jwt.spi.signer.JwsSignerProvider;
 import org.eclipse.edc.keys.spi.PrivateKeyResolver;
 import org.eclipse.edc.spi.result.Result;
 

core/common/lib/token-lib/build.gradle.kts

@@ -21,7 +21,6 @@ dependencies {
     api(project(":spi:common:keys-spi"))
     api(project(":spi:common:token-spi"))
     api(project(":spi:common:jwt-spi"))
-    api(project(":spi:common:jwt-signer-spi"))
 
     implementation(project(":core:common:lib:crypto-common-lib")) // for the CryptoConverter
     implementation(libs.nimbus.jwt)

core/common/lib/token-lib/src/main/java/org/eclipse/edc/token/JwtGenerationService.java

@@ -21,7 +21,7 @@
 import com.nimbusds.jose.JWSSigner;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.jwt.SignedJWT;
-import org.eclipse.edc.jwt.signer.spi.JwsSignerProvider;
+import org.eclipse.edc.jwt.spi.signer.JwsSignerProvider;
 import org.eclipse.edc.security.token.jwt.CryptoConverter;
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.iam.TokenParameters;

core/common/lib/token-lib/src/main/java/org/eclipse/edc/token/TokenValidationServiceImpl.java

@@ -39,18 +39,10 @@ public Result<ClaimToken> validate(TokenRepresentation tokenRepresentation, Publ
         var additional = tokenRepresentation.getAdditional();
         try {
             var signedJwt = SignedJWT.parse(token);
-            var publicKeyId = signedJwt.getHeader().getKeyID();
 
-            var publicKeyResolutionResult = publicKeyResolver.resolveKey(publicKeyId);
-
-            if (publicKeyResolutionResult.failed()) {
-                return publicKeyResolutionResult.mapFailure();
-            }
-
-            var verifierCreationResult = CryptoConverter.createVerifierFor(publicKeyResolutionResult.getContent());
-
-            if (!signedJwt.verify(verifierCreationResult)) {
-                return Result.failure("Token verification failed");
+            var signatureVerification = verifySignature(signedJwt, publicKeyResolver);
+            if (signatureVerification.failed()) {
+                return signatureVerification.mapFailure();
             }
 
             var tokenBuilder = ClaimToken.Builder.newInstance();
@@ -76,11 +68,30 @@ public Result<ClaimToken> validate(TokenRepresentation tokenRepresentation, Publ
 
             return Result.success(claimToken);
 
-        } catch (JOSEException e) {
-            return Result.failure(e.getMessage());
         } catch (ParseException e) {
             return Result.failure("Failed to decode token");
         }
     }
 
+    private Result<Void> verifySignature(SignedJWT jwt, PublicKeyResolver publicKeyResolver) {
+        var publicKeyId = jwt.getHeader().getKeyID();
+        var publicKeyResolutionResult = publicKeyResolver.resolveKey(publicKeyId);
+
+        if (publicKeyResolutionResult.failed()) {
+            return publicKeyResolutionResult.mapFailure();
+        }
+
+        var verifierCreationResult = CryptoConverter.createVerifierFor(publicKeyResolutionResult.getContent());
+
+        try {
+            var result = jwt.verify(verifierCreationResult);
+            if (result) {
+                return Result.success();
+            }
+            return Result.failure("JWT signature not valid");
+        } catch (JOSEException e) {
+            return Result.failure("Cannot verify JWT signature: " + e.getMessage());
+        }
+    }
+
 }

core/common/token-core/src/main/java/org/eclipse/edc/token/TokenServicesExtension.java

@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.token;
 
-import org.eclipse.edc.jwt.signer.spi.JwsSignerProvider;
+import org.eclipse.edc.jwt.spi.signer.JwsSignerProvider;
 import org.eclipse.edc.jwt.validation.jti.JtiValidationStore;
 import org.eclipse.edc.keys.spi.PrivateKeyResolver;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;

core/common/token-core/src/test/java/org/eclipse/edc/jwt/TokenValidationServiceImplTest.java

@@ -25,7 +25,6 @@
 import com.nimbusds.jwt.SignedJWT;
 import org.eclipse.edc.keys.spi.PublicKeyResolver;
 import org.eclipse.edc.spi.result.Result;
-import org.eclipse.edc.token.TokenValidationRulesRegistryImpl;
 import org.eclipse.edc.token.TokenValidationServiceImpl;
 import org.eclipse.edc.token.spi.TokenValidationRule;
 import org.eclipse.edc.token.spi.TokenValidationService;
@@ -62,7 +61,6 @@ public void setUp() throws JOSEException {
 
         when(publicKeyResolver.resolveKey(any())).thenReturn(Result.failure("not found"));
         when(publicKeyResolver.resolveKey(eq(publicKeyId))).thenReturn(Result.success(publicKey));
-        var rulesRegistry = new TokenValidationRulesRegistryImpl();
         tokenValidationService = new TokenValidationServiceImpl();
     }
 

core/common/token-core/src/test/java/org/eclipse/edc/token/JwtGenerationServiceTest.java

@@ -24,7 +24,7 @@
 import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
 import com.nimbusds.jose.util.Base64URL;
 import com.nimbusds.jwt.SignedJWT;
-import org.eclipse.edc.jwt.signer.spi.JwsSignerProvider;
+import org.eclipse.edc.jwt.spi.signer.JwsSignerProvider;
 import org.eclipse.edc.security.token.jwt.CryptoConverter;
 import org.eclipse.edc.spi.result.Result;
 import org.eclipse.edc.token.spi.TokenDecorator;

extensions/common/crypto/jwt-verifiable-credentials/src/test/java/org/eclipse/edc/verifiablecredentials/jwt/JwtPresentationVerifierTest.java

@@ -201,7 +201,7 @@ void verifyPresentation_oneVcIsInvalid() throws JOSEException {
                 .audience(MY_OWN_DID)
                 .build();
         var result = verifier.verify(vpJwt, context);
-        assertThat(result).isFailed().detail().contains("Token verification failed");
+        assertThat(result).isFailed().detail().contains("JWT signature not valid");
     }
 
     @DisplayName("VP-JWT with a spoofed signature - expect a failure")
@@ -221,7 +221,7 @@ void verifyPresentation_vpJwtInvalid() throws JOSEException {
                 .audience(MY_OWN_DID)
                 .build();
         var result = verifier.verify(vpJwt, context);
-        assertThat(result).isFailed().detail().contains("Token verification failed");
+        assertThat(result).isFailed().detail().contains("JWT signature not valid");
     }
 
     @DisplayName("VP-JWT with a missing claim - expect a failure")