001/*
002 * (C) Copyright 2006-2012 Nuxeo SA (http://nuxeo.com/) and others.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *     http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 *
016 * Contributors:
017 *     Antoine Taillefer
018 */
019package org.nuxeo.ecm.tokenauth.service;
020
021import java.io.Serializable;
022
023import org.nuxeo.ecm.core.api.DocumentModelList;
024import org.nuxeo.ecm.platform.ui.web.auth.token.TokenAuthenticator;
025import org.nuxeo.ecm.tokenauth.TokenAuthenticationException;
026import org.nuxeo.ecm.tokenauth.servlet.TokenAuthenticationServlet;
027
028/**
029 * Service to manage generation and storage of authentication tokens. Each token must be unique and persisted in the
030 * back-end with the user information it is bound to: user name, application name, device name, device description,
031 * permission.
032 * <p>
033 * Typically, the service is called by the {@link TokenAuthenticationServlet} to get a token from the user information
034 * passed as request parameters, and it allows the {@link TokenAuthenticator} to check for a valid identity given a
035 * token passed as a request header.
036 *
037 * @author Antoine Taillefer (ataillefer@nuxeo.com)
038 * @since 5.7
039 */
040public interface TokenAuthenticationService extends Serializable {
041
042    /**
043     * Acquires a unique token for the specified user, application, and device.
044     * <p>
045     * If such a token exist in the back-end for the specified (userName, applicationName, deviceId) triplet, just
046     * returns it, else generates it and stores it in the back-end with the triplet attributes, the specified device
047     * description and permission.
048     *
049     * @throws TokenAuthenticationException if one of the required parameters is null or empty (all parameters are
050     *             required except for the device description)
051     * @throws NuxeoException if multiple tokens are found for the same triplet
052     */
053    String acquireToken(String userName, String applicationName, String deviceId, String deviceDescription,
054            String permission) throws TokenAuthenticationException;
055
056    /**
057     * Gets the token for the specified user, application, and device.
058     *
059     * @return null if such a token doesn't exist
060     * @throws TokenAuthenticationException if one of the required parameters is null or empty (all parameters are
061     *             required except for the device description)
062     * @throws NuxeoException if multiple tokens are found for the same (userName, applicationName, deviceId) triplet
063     */
064    String getToken(String userName, String applicationName, String deviceId) throws TokenAuthenticationException;
065
066    /**
067     * Gets the user name bound to the specified token.
068     *
069     * @return The user name bound to the specified token, or null if the token does not exist in the back-end.
070     */
071    String getUserName(String token);
072
073    /**
074     * Removes the token from the back-end.
075     */
076    void revokeToken(String token);
077
078    /**
079     * Gets the token bindings for the specified user.
080     */
081    DocumentModelList getTokenBindings(String userName);
082
083}