feat: AM-3373 add plugin validation capability

gravitee-am-authdevice-notifier/gravitee-am-authdevice-notifier-api/src/main/java/io/gravitee/am/authdevice/notifier/api/AuthenticationDeviceNotifierProvider.java

@@ -19,6 +19,7 @@
 import io.gravitee.am.authdevice.notifier.api.model.ADNotificationRequest;
 import io.gravitee.am.authdevice.notifier.api.model.ADNotificationResponse;
 import io.gravitee.am.authdevice.notifier.api.model.ADUserResponse;
+import io.gravitee.am.common.plugin.AmPluginProvider;
 import io.gravitee.common.component.Lifecycle;
 import io.gravitee.common.service.Service;
 import io.reactivex.rxjava3.core.Single;
@@ -29,7 +30,7 @@
  * @author Eric LELEU (eric.leleu at graviteesource.com)
  * @author GraviteeSource Team
  */
-public interface AuthenticationDeviceNotifierProvider extends Service<AuthenticationDeviceNotifierProvider> {
+public interface AuthenticationDeviceNotifierProvider extends Service<AuthenticationDeviceNotifierProvider>, AmPluginProvider {
 
     @Override
     default Lifecycle.State lifecycleState() {

gravitee-am-botdetection/gravitee-am-botdetection-api/src/main/java/io/gravitee/am/botdetection/api/BotDetectionProvider.java

@@ -15,6 +15,7 @@
  */
 package io.gravitee.am.botdetection.api;
 
+import io.gravitee.am.common.plugin.AmPluginProvider;
 import io.gravitee.common.component.Lifecycle;
 import io.gravitee.common.service.Service;
 import io.reactivex.rxjava3.core.Single;
@@ -23,7 +24,7 @@
  * @author Eric LELEU (eric.leleu at graviteesource.com)
  * @author GraviteeSource Team
  */
-public interface BotDetectionProvider extends Service<BotDetectionProvider> {
+public interface BotDetectionProvider extends Service<BotDetectionProvider>, AmPluginProvider {
     @Override
     default Lifecycle.State lifecycleState() {
         return Lifecycle.State.INITIALIZED;

gravitee-am-certificate/gravitee-am-certificate-api/src/main/java/io/gravitee/am/certificate/api/CertificateProvider.java

@@ -15,6 +15,7 @@
  */
 package io.gravitee.am.certificate.api;
 
+import io.gravitee.am.common.plugin.AmPluginProvider;
 import io.gravitee.am.model.jose.JWK;
 import io.reactivex.rxjava3.core.Flowable;
 import io.reactivex.rxjava3.core.Single;
@@ -30,7 +31,7 @@
  * @author GraviteeSource Team
  */
 
-public interface CertificateProvider {
+public interface CertificateProvider extends AmPluginProvider {
 
     Optional<Date> getExpirationDate();
 
@@ -54,6 +55,4 @@ default Single<List<CertificateKey>> publicKeys() {
         return Single.just(Collections.emptyList());
     }
 
-    default void unregister() { }
-
 }

gravitee-am-certificate/gravitee-am-certificate-api/src/main/java/io/gravitee/am/certificate/api/CertificateProviders.java

@@ -0,0 +1,83 @@
+/**
+ * Copyright (C) 2015 The Gravitee team (http://gravitee.io)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.gravitee.am.certificate.api;
+
+import io.gravitee.am.common.jwt.SignatureAlgorithm;
+import io.gravitee.am.model.jose.JWK;
+import io.reactivex.rxjava3.core.Flowable;
+import io.reactivex.rxjava3.core.Single;
+import lombok.experimental.UtilityClass;
+
+import java.security.InvalidKeyException;
+import java.util.Collections;
+import java.util.Date;
+import java.util.Optional;
+
+@UtilityClass
+public class CertificateProviders {
+
+    public static CertificateProvider createNoneCertificateProvider(){
+        return new NoneCertificateProvider();
+    }
+
+    public static CertificateProvider createShaCertificateProvider(String singingKeyId, String signingKeySecret) throws InvalidKeyException {
+        byte[] keySecretBytes = signingKeySecret.getBytes();
+        java.security.Key key = Keys.hmacShaKeyFor(keySecretBytes);
+        SignatureAlgorithm signatureAlgorithm = Keys.hmacShaSignatureAlgorithmFor(keySecretBytes);
+        io.gravitee.am.certificate.api.Key certificateKey = new DefaultKey(singingKeyId, key);
+
+        // create default certificate provider
+        CertificateMetadata certificateMetadata = new CertificateMetadata();
+        certificateMetadata.setMetadata(Collections.singletonMap(CertificateMetadata.DIGEST_ALGORITHM_NAME, signatureAlgorithm.getDigestName()));
+
+        return new io.gravitee.am.certificate.api.CertificateProvider() {
+            @Override
+            public Optional<Date> getExpirationDate() {
+                return Optional.empty();
+            }
+
+            @Override
+            public Single<Key> key() {
+                return Single.just(certificateKey);
+            }
+
+            @Override
+            public Flowable<JWK> privateKey() {
+                return null;
+            }
+
+            @Override
+            public Single<String> publicKey() {
+                return null;
+            }
+
+            @Override
+            public Flowable<JWK> keys() {
+                return null;
+            }
+
+            @Override
+            public String signatureAlgorithm() {
+                return signatureAlgorithm.getValue();
+            }
+
+            @Override
+            public CertificateMetadata certificateMetadata() {
+                return certificateMetadata;
+            }
+        };
+    }
+}

gravitee-am-certificate/gravitee-am-certificate-api/src/main/java/io/gravitee/am/certificate/api/NoneCertificateProvider.java

@@ -0,0 +1,69 @@
+/**
+ * Copyright (C) 2015 The Gravitee team (http://gravitee.io)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.gravitee.am.certificate.api;
+
+import io.gravitee.am.common.jwt.SignatureAlgorithm;
+import io.gravitee.am.model.jose.JWK;
+import io.reactivex.rxjava3.core.Flowable;
+import io.reactivex.rxjava3.core.Single;
+
+import java.util.Collections;
+import java.util.Date;
+import java.util.Optional;
+
+class NoneCertificateProvider implements CertificateProvider {
+    private final CertificateMetadata metadata;
+
+    NoneCertificateProvider() {
+        this.metadata = new CertificateMetadata();
+        metadata.setMetadata(Collections.singletonMap(CertificateMetadata.DIGEST_ALGORITHM_NAME, SignatureAlgorithm.NONE.getValue()));
+    }
+
+    @Override
+    public Optional<Date> getExpirationDate() {
+        return Optional.empty();
+    }
+
+    @Override
+    public Flowable<JWK> privateKey() {
+        throw new UnsupportedOperationException("No private key for \"none\" algorithm");
+    }
+
+    @Override
+    public Single<io.gravitee.am.certificate.api.Key> key() {
+        throw new UnsupportedOperationException("No key for \"none\" algorithm");
+    }
+
+    @Override
+    public Single<String> publicKey() {
+        throw new UnsupportedOperationException("No public key for \"none\" algorithm");
+    }
+
+    @Override
+    public Flowable<JWK> keys() {
+        throw new UnsupportedOperationException("No keys for \"none\" algorithm");
+    }
+
+    @Override
+    public String signatureAlgorithm() {
+        return SignatureAlgorithm.NONE.getValue();
+    }
+
+    @Override
+    public CertificateMetadata certificateMetadata() {
+        return metadata;
+    }
+}

gravitee-am-certificate/gravitee-am-certificate-javakeystore/src/main/java/io/gravitee/am/certificate/javakeystore/JavaKeyStore.java

@@ -17,6 +17,7 @@
 
 import io.gravitee.am.certificate.api.Certificate;
 import io.gravitee.am.certificate.javakeystore.provider.JavaKeyStoreProvider;
+
 /**
  * @author Titouan COMPIEGNE (titouan.compiegne at graviteesource.com)
  * @author GraviteeSource Team
@@ -32,4 +33,5 @@ public Class<JavaKeyStoreConfiguration> configuration() {
     public Class<JavaKeyStoreProvider> provider() {
         return JavaKeyStoreProvider.class;
     }
+
 }

gravitee-am-certificate/gravitee-am-certificate-javakeystore/src/main/java/io/gravitee/am/certificate/javakeystore/provider/JavaKeyStoreProvider.java

@@ -18,18 +18,27 @@
 import io.gravitee.am.certificate.api.AbstractCertificateProvider;
 import io.gravitee.am.certificate.api.CertificateMetadata;
 import io.gravitee.am.certificate.javakeystore.JavaKeyStoreConfiguration;
+import io.gravitee.am.common.plugin.ValidationResult;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.beans.factory.annotation.Autowired;
 
 import java.security.KeyStore;
 import java.security.KeyStoreException;
+import java.time.Instant;
+import java.util.Date;
+import java.util.Map;
 import java.util.Set;
 
+import static io.gravitee.am.common.plugin.ValidationResult.invalid;
+import static io.gravitee.am.common.plugin.ValidationResult.valid;
+
 /**
  * @author Titouan COMPIEGNE (titouan.compiegne at graviteesource.com)
  * @author GraviteeSource Team
  */
+
 public class JavaKeyStoreProvider extends AbstractCertificateProvider implements InitializingBean {
+
     @Autowired
     private JavaKeyStoreConfiguration configuration;
 
@@ -77,4 +86,16 @@ protected Set<String> getUse() {
     protected String getAlgorithm() {
         return configuration.getAlgorithm();
     }
+
+    @Override
+    public ValidationResult validate() {
+        Date expDate = getExpirationDate().orElse(null);
+        if(expDate == null) {
+            return invalid("The certificate you uploaded lacks expiration date.");
+        }
+        if (Instant.now().isAfter(expDate.toInstant())) {
+            return invalid("The certificate you uploaded has already expired. Please select a different certificate to upload.");
+        }
+        return valid(Map.of("expDate", expDate));
+    }
 }

gravitee-am-common/src/main/java/io/gravitee/am/common/plugin/AmPluginProvider.java

@@ -0,0 +1,34 @@
+/**
+ * Copyright (C) 2015 The Gravitee team (http://gravitee.io)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.gravitee.am.common.plugin;
+
+import java.io.Closeable;
+import java.io.IOException;
+
+public interface AmPluginProvider extends Closeable {
+
+    default ValidationResult validate() {
+        return ValidationResult.SUCCEEDED;
+    }
+
+    default void unregister() {}
+
+    @Override
+    default void close() throws IOException {
+        unregister();
+    }
+
+}

gravitee-am-common/src/main/java/io/gravitee/am/common/plugin/ValidationResult.java

@@ -0,0 +1,50 @@
+/**
+ * Copyright (C) 2015 The Gravitee team (http://gravitee.io)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.gravitee.am.common.plugin;
+
+import lombok.extern.slf4j.Slf4j;
+
+import java.util.Map;
+import java.util.Optional;
+
+@Slf4j
+public record ValidationResult(boolean succeeded, String failedMessage, Map<String, Object> additionalInformation){
+    public static final ValidationResult SUCCEEDED = new ValidationResult(true, null, Map.of());
+    public boolean failed(){
+        return !succeeded;
+    }
+
+    public <T> Optional<T> getAdditionalInformation(String key, Class<T> clazz){
+        try {
+            return Optional.ofNullable(clazz.cast(additionalInformation.get(key)));
+        } catch (Exception e){
+            log.error("Incorrect clazz for key {}: {}", key, clazz);
+            return Optional.empty();
+        }
+    }
+
+    public static ValidationResult valid(Map<String, Object> additionalInformation){
+        return new ValidationResult(true, null, additionalInformation);
+    }
+
+    public static ValidationResult valid(){
+        return valid(Map.of());
+    }
+
+    public static ValidationResult invalid(String message){
+        return new ValidationResult(false, message, Map.of());
+    }
+}

gravitee-am-deviceidentifier/gravitee-am-deviceidentifier-api/src/main/java/io/gravitee/am/deviceidentifier/api/DeviceIdentifierProvider.java

@@ -15,13 +15,15 @@
  */
 package io.gravitee.am.deviceidentifier.api;
 
+import io.gravitee.am.common.plugin.AmPluginProvider;
+
 import java.util.Map;
 
 /**
  * @author Rémi Sultan (remi.sultan at graviteesource.com)
  * @author GraviteeSource Team
  */
-public interface DeviceIdentifierProvider {
+public interface DeviceIdentifierProvider extends AmPluginProvider {
 
     void addConfigurationVariables(Map<String, Object> variables, String configuration);
 

gravitee-am-extensiongrant/gravitee-am-extensiongrant-api/src/main/java/io/gravitee/am/extensiongrant/api/ExtensionGrantProvider.java

@@ -15,6 +15,7 @@
  */
 package io.gravitee.am.extensiongrant.api;
 
+import io.gravitee.am.common.plugin.AmPluginProvider;
 import io.gravitee.am.identityprovider.api.User;
 import io.gravitee.am.repository.oauth2.model.request.TokenRequest;
 import io.reactivex.rxjava3.core.Maybe;
@@ -23,7 +24,7 @@
  * @author Titouan COMPIEGNE (titouan.compiegne at graviteesource.com)
  * @author GraviteeSource Team
  */
-public interface ExtensionGrantProvider {
+public interface ExtensionGrantProvider extends AmPluginProvider {
 
     /**
      * Grant OAuth2 access tokens by validating the assertion stored inside the incoming token request