Implement token endpoints for auth-service #38

New issue

Closed

opened 2025-09-04 06:07:24 +00:00 by hurui200320 · 0 comments

hurui200320 commented

2025-09-04 06:07:24 +00:00

Member

verifyAccessToken(accessToken: String, checkLiveness: Boolean)
- Verify the given access token, has no return value if it's valid, otherwise throw cleverthis.clevermicro.invalid_access_token exception.
- checkLiveness=true will cause the auth service to call keycloak to check if the token is still alive (aka not revoked due to log out or account disabled).
getClientToken(clientId: String, clientSecret: String): TokenResp
- Get token with client id and key, the return value should be equivalent to the OIDC token endpoint response (contains fields like access_token, refresh_token, their expires_in, id_token, etc.)
~~refreshToken(refreshToken: String): TokenResp~~
- ~~Get token with refresh token, can be used for both client service account and user accounts, although for now it's mainly for client service accounts~~
- The grant type client_credentials does not return a refresh token based on this rfc: https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.3

The token-service-v1 does not require any authorization. The unit tests are included in this ticket.

According to this design document: https://wiki.cleverthis.com/en/architecture/microservices/feature-discussion/im-endpoints, this ticket should implement the following endpoints within the `token-service-v1`: + `verifyAccessToken(accessToken: String, checkLiveness: Boolean)` + Verify the given access token, has no return value if it's valid, otherwise throw `cleverthis.clevermicro.invalid_access_token` exception. + `checkLiveness=true` will cause the auth service to call keycloak to check if the token is still alive (aka not revoked due to log out or account disabled). + `getClientToken(clientId: String, clientSecret: String): TokenResp` + Get token with client id and key, the return value should be equivalent to the OIDC token endpoint response (contains fields like access_token, refresh_token, their expires_in, id_token, etc.) + ~~`refreshToken(refreshToken: String): TokenResp`~~ + ~~Get token with refresh token, can be used for both client service account and user accounts, although for now it's mainly for client service accounts~~ + The grant type `client_credentials` does not return a refresh token based on this rfc: https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.3 The token-service-v1 does not require any authorization. The unit tests are included in this ticket.

hurui200320 added this to the V.01 milestone

2025-09-04 06:07:24 +00:00

hurui200320 added the

Rows
Columns