|
| 1 | +package com.iterable; |
| 2 | + |
| 3 | +import javax.crypto.Mac; |
| 4 | +import javax.crypto.spec.SecretKeySpec; |
| 5 | +import java.nio.charset.StandardCharsets; |
| 6 | +import java.time.Duration; |
| 7 | +import java.util.Base64; |
| 8 | +import java.util.Base64.Encoder; |
| 9 | + |
| 10 | +/** |
| 11 | +* Utility class to generate JWTs for use with the Iterable API |
| 12 | +* |
| 13 | +* @author engineering@iterable.com |
| 14 | +*/ |
| 15 | +public class IterableJwtGenerator { |
| 16 | + static Encoder encoder = Base64.getUrlEncoder().withoutPadding(); |
| 17 | + |
| 18 | + private static final String algorithm = "HmacSHA256"; |
| 19 | + |
| 20 | + // Iterable enforces a 1-year maximum token lifetime |
| 21 | + private static final Duration maxTokenLifetime = Duration.ofDays(365); |
| 22 | + |
| 23 | + private static long millisToSeconds(long millis) { |
| 24 | + return millis / 1000; |
| 25 | + } |
| 26 | + |
| 27 | + private static final String encodedHeader = encoder.encodeToString( |
| 28 | + "{\"alg\":\"HS256\",\"typ\":\"JWT\"}".getBytes(StandardCharsets.UTF_8) |
| 29 | + ); |
| 30 | + |
| 31 | + /** |
| 32 | + * Generates a JWT from the provided secret, header, and payload. Does not |
| 33 | + * validate the header or payload. |
| 34 | + * |
| 35 | + * @param secret Your organization's shared secret with Iterable |
| 36 | + * @param payload The JSON payload |
| 37 | + * |
| 38 | + * @return a signed JWT |
| 39 | + */ |
| 40 | + public static String generateToken(String secret, String payload) { |
| 41 | + try { |
| 42 | + String encodedPayload = encoder.encodeToString( |
| 43 | + payload.getBytes(StandardCharsets.UTF_8) |
| 44 | + ); |
| 45 | + String encodedHeaderAndPayload = encodedHeader + "." + encodedPayload; |
| 46 | + |
| 47 | + // HMAC setup |
| 48 | + Mac hmac = Mac.getInstance(algorithm); |
| 49 | + SecretKeySpec keySpec = new SecretKeySpec( |
| 50 | + secret.getBytes(StandardCharsets.UTF_8), algorithm |
| 51 | + ); |
| 52 | + hmac.init(keySpec); |
| 53 | + |
| 54 | + String signature = encoder.encodeToString( |
| 55 | + hmac.doFinal( |
| 56 | + encodedHeaderAndPayload.getBytes(StandardCharsets.UTF_8) |
| 57 | + ) |
| 58 | + ); |
| 59 | + |
| 60 | + return encodedHeaderAndPayload + "." + signature; |
| 61 | + |
| 62 | + } catch (Exception e) { |
| 63 | + throw new RuntimeException(e.getMessage()); |
| 64 | + } |
| 65 | + } |
| 66 | + |
| 67 | + /** |
| 68 | + * Generates a JWT (issued now, expires after the provided duration). |
| 69 | + * |
| 70 | + * @param secret Your organization's shared secret with Iterable. |
| 71 | + * @param duration The token's expiration time. Up to one year. |
| 72 | + * @param email The email to included in the token, or null. |
| 73 | + * @param userId The userId to include in the token, or null. |
| 74 | + * |
| 75 | + * @return A JWT string |
| 76 | + */ |
| 77 | + public static String generateToken( |
| 78 | + String secret, Duration duration, String email, String userId) { |
| 79 | + |
| 80 | + if (duration.compareTo(maxTokenLifetime) > 0) |
| 81 | + throw new IllegalArgumentException( |
| 82 | + "Duration must be one year or less." |
| 83 | + ); |
| 84 | + |
| 85 | + if ((userId != null && email != null) || (userId == null && email == null)) |
| 86 | + throw new IllegalArgumentException( |
| 87 | + "The token must include a userId or email, but not both." |
| 88 | + ); |
| 89 | + |
| 90 | + long now = millisToSeconds(System.currentTimeMillis()); |
| 91 | + |
| 92 | + String payload; |
| 93 | + if (userId != null) |
| 94 | + payload = String.format( |
| 95 | + "{ \"userId\": \"%s\", \"iat\": %d, \"exp\": %d }", |
| 96 | + userId, now, now + millisToSeconds(duration.toMillis()) |
| 97 | + ); |
| 98 | + else |
| 99 | + payload = String.format( |
| 100 | + "{ \"email\": \"%s\", \"iat\": %d, \"exp\": %d }", |
| 101 | + email, now, now + millisToSeconds(duration.toMillis()) |
| 102 | + ); |
| 103 | + |
| 104 | + return generateToken(secret, payload); |
| 105 | + } |
| 106 | +} |
0 commit comments