c. Rotas Abertas

// account: AccountController (interface module)
@PostMapping("/accounts/login")
public ResponseEntity<AccountOut> login(
    @RequestBody AccountIn in
);

package store.account;

import java.util.List;
import java.util.Optional;

import org.springframework.data.repository.CrudRepository;

public interface AccountRepository extends CrudRepository<AccountModel, String> {

    List<AccountModel> findAll();

    // Implementa JPQL
    // https://docs.spring.io/spring-data/jpa/reference/jpa/query-methods.html
    Optional<AccountModel> findByEmailAndHashPassword(
        String email,
        String hashPassword
    );

}

// account-service: AccountService (calcHash already exists)
public Account findByEmailAndPassword(String email, String password) {

    if (password == null || password.isEmpty()) {
        throw new ResponseStatusException(
            HttpStatus.BAD_REQUEST, "Password is empty"
        );
    }

    final String hash = calcHash(password);
    return accountRepository.findByEmailAndHashPassword(email, hash)
        .map(AccountModel::to)
        .orElseThrow(() -> new ResponseStatusException(
            HttpStatus.UNAUTHORIZED, "Invalid credentials"
        ));

}

// account-service: AccountResource
@Override
public ResponseEntity<AccountOut> login(AccountIn in) {
    return ResponseEntity
        .ok(AccountParser.to(
            accountService.findByEmailAndPassword(in.email(), in.password())
        ));
}

package store.auth;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.openfeign.EnableFeignClients;

@SpringBootApplication
@EnableFeignClients(basePackages = {
    "store.account"
})
public class AuthApplication {

    public static void main(String[] args) {
        SpringApplication.run(AuthApplication.class, args);
    }

}

package store.auth;

public final class AuthParser {

    public static Register to(RegisterIn in) {
        return in == null ? null :
            Register.builder()
                .name(in.name())
                .email(in.email())
                .password(in.password())
                .build();
    }

}

package store.auth;

import java.time.Duration;
import java.util.Map;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseCookie;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.RestController;

import store.account.AccountOut;

@RestController
public class AuthResource implements AuthController {

    @Autowired
    private AuthService authService;

    @Override
    public ResponseEntity<Void> create(RegisterIn in) {
        final Register register = AuthParser.to(in);
        authService.create(register);
        return ResponseEntity.ok().build();
    }

    @Override
    public ResponseEntity<Void> login(LoginIn in) {
        final String token = authService.login(in.email(), in.password());
        return ResponseEntity
            .ok()
            .header(
                HttpHeaders.SET_COOKIE,
                buildTokenCookie(AuthController.AUTH_COOKIE_TOKEN, token, authService.getDuration()).toString()
            )
            .build();
    }

    @Override
    public ResponseEntity<AccountOut> me(String idAccount) {
        return ResponseEntity.ok(authService.me(idAccount));
    }

    @Override
    public ResponseEntity<Void> logout() {
        return ResponseEntity
            .ok()
            .header(
                HttpHeaders.SET_COOKIE,
                buildTokenCookie(
                    AuthController.AUTH_COOKIE_TOKEN,
                    null,
                    0l
                ).toString()
            )
            .build();
    }

    @Override
    public ResponseEntity<Void> healthCheck() {
        return ResponseEntity.ok().build();
    }

    @Override
    public ResponseEntity<Map<String, String>> solveToken(TokenOut map) {
        return ResponseEntity.ok(authService.solve(map.token()));
    }

    private ResponseCookie buildTokenCookie(String alias, String content, Long duration) {
        return ResponseCookie.from(alias, content)
            .httpOnly(authService.getHttpOnly())
            .sameSite("None")
            .secure(true)
            .path("/")
            .maxAge(Duration.ofMillis(duration))
            .build();
    }

}

package store.auth;

import java.util.Map;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Service;
import org.springframework.web.server.ResponseStatusException;

import feign.FeignException;
import store.account.AccountController;
import store.account.AccountIn;
import store.account.AccountOut;

@Service
public class AuthService {

    @Autowired
    private AccountController accountController;

    @Autowired
    private JwtService jwtService;

    @Value("${store.jwt.duration}")
    private Long duration;

    @Value("${store.jwt.httpOnly}")
    private Boolean httpOnly;

    public void create(Register register) {

        accountController.create(
            AccountIn.builder()
                .name(register.name())
                .email(register.email())
                .password(register.password())
                .build()
        );

    }

    public String login(String email, String password) {
        final AccountOut account;
        try {
            // account hashes the password and compares it with the stored hash
            account = accountController.login(
                AccountIn.builder().email(email).password(password).build()
            ).getBody();
        } catch (FeignException.Unauthorized | FeignException.BadRequest e) {
            throw new ResponseStatusException(
                HttpStatus.UNAUTHORIZED, "Invalid credentials"
            );
        }
        return jwtService.generate(account, getDuration());
    }

    public long getDuration() {
        return duration;
    }

    public boolean getHttpOnly() {
        return httpOnly;
    }

    public Map<String, String> solve(final String jwt) {
        return Map.of(
            "idAccount", jwtService.getId(jwt)
        );
    }

    public AccountOut me(String idAccount) {
        return accountController.findById(idAccount).getBody();
    }

}

package store.auth;

import java.util.Base64;
import java.util.Date;
import java.util.Map;

import javax.crypto.SecretKey;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Service;
import org.springframework.web.server.ResponseStatusException;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwtException;
import io.jsonwebtoken.JwtParser;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import store.account.AccountOut;

@Service
public class JwtService {

    @Value("${store.jwt.secretKey}")
    private String secretKey;

    public String generate(AccountOut account, long duration) {

        Date now = new Date();
        return Jwts.builder()
            .header().and()
            .id(account.id())
            .issuer("Insper::PMA")
            .claims(Map.of("email", account.email()))
            .signWith(getKey())
            .subject(account.name())
            .notBefore(now)
            .expiration(new Date(now.getTime() + duration))
            .compact();
    }

    private SecretKey getKey() {
        return Keys.hmacShaKeyFor(Base64.getDecoder().decode(secretKey));
    }

    public String getId(String jwt) {
        try {
            JwtParser parser = Jwts.parser().verifyWith(getKey()).build();
            // checks the signature, nbf and exp: a JwtException otherwise
            Claims claims = parser.parseSignedClaims(jwt).getPayload();
            return claims.getId();
        } catch (JwtException e) {
            throw new ResponseStatusException(
                HttpStatus.UNAUTHORIZED, "Invalid token");
        }
    }

}

package store.auth;

import lombok.Builder;
import lombok.Data;
import lombok.experimental.Accessors;

@Builder @Data
@Accessors(fluent = true)
public class Register {

    private String id;
    private String name;
    private String email;
    private String password;
    private String hashPassword;

}