From d8a1b874ca6066542a05a4b995bd3e2874f1fc7e Mon Sep 17 00:00:00 2001 From: Sattvik Chakravarthy Date: Mon, 16 Sep 2024 08:28:41 +0530 Subject: [PATCH] fix: pr comment --- src/main/java/io/supertokens/oauth/OAuthToken.java | 13 +++++++------ .../webserver/api/oauth/OAuthTokenAPI.java | 4 ++-- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/main/java/io/supertokens/oauth/OAuthToken.java b/src/main/java/io/supertokens/oauth/OAuthToken.java index 0c838702b..d2433a1a3 100644 --- a/src/main/java/io/supertokens/oauth/OAuthToken.java +++ b/src/main/java/io/supertokens/oauth/OAuthToken.java @@ -49,9 +49,8 @@ public int getValue() { private static Set NON_OVERRIDABLE_TOKEN_PROPS = Set.of( "kid", "typ", "alg", "aud", "iss", "iat", "exp", "nbf", "jti", "ext", - "sid", "rat", "at_hash", - "client_id", "scp", "sub", "rsub", - "sessionHandle", "tId", "stt" + "sid", "rat", "at_hash", "rt_hash", + "client_id", "scp", "sub", "stt" ); public static JsonObject getPayloadFromJWTToken(AppIdentifier appIdentifier, @@ -103,9 +102,11 @@ public static String reSignToken(AppIdentifier appIdentifier, Main main, String payload.addProperty("iss", iss); payload.addProperty("stt", tokenType.getValue()); - for (Map.Entry entry : payloadUpdate.entrySet()) { - if (!NON_OVERRIDABLE_TOKEN_PROPS.contains(entry.getKey())) { - payload.add(entry.getKey(), entry.getValue()); + if (payloadUpdate != null) { + for (Map.Entry entry : payloadUpdate.entrySet()) { + if (!NON_OVERRIDABLE_TOKEN_PROPS.contains(entry.getKey())) { + payload.add(entry.getKey(), entry.getValue()); + } } } diff --git a/src/main/java/io/supertokens/webserver/api/oauth/OAuthTokenAPI.java b/src/main/java/io/supertokens/webserver/api/oauth/OAuthTokenAPI.java index 8389b0432..4567e7f61 100644 --- a/src/main/java/io/supertokens/webserver/api/oauth/OAuthTokenAPI.java +++ b/src/main/java/io/supertokens/webserver/api/oauth/OAuthTokenAPI.java @@ -60,7 +60,9 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I String iss = InputParser.parseStringOrThrowError(input, "iss", false); // input validation JsonObject bodyFromSDK = InputParser.parseJsonObjectOrThrowError(input, "inputBody", false); + // useStaticKeyInput defaults to true, so we check if it has been explicitly set to false Boolean useStaticKeyInput = InputParser.parseBooleanOrThrowError(input, "useStaticSigningKey", true); + boolean useDynamicKey = Boolean.FALSE.equals(useStaticKeyInput); Map formFields = new HashMap<>(); for (Map.Entry entry : bodyFromSDK.entrySet()) { @@ -89,8 +91,6 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws I JsonObject accessTokenUpdate = InputParser.parseJsonObjectOrThrowError(input, "access_token", true); JsonObject idTokenUpdate = InputParser.parseJsonObjectOrThrowError(input, "id_token", true); - // useStaticKeyInput defaults to true, so we check if it has been explicitly set to false - boolean useDynamicKey = Boolean.FALSE.equals(useStaticKeyInput); jsonBody = OAuth.transformTokens(super.main, appIdentifier, storage, jsonBody.getAsJsonObject(), iss, accessTokenUpdate, idTokenUpdate, useDynamicKey); } catch (IOException | InvalidConfigException | TenantOrAppNotFoundException | BadPermissionException | StorageQueryException | InvalidKeyException | NoSuchAlgorithmException | InvalidKeySpecException | JWTCreationException | JWTException | StorageTransactionLogicException | UnsupportedJWTSigningAlgorithmException e) {