Merge pull request #161 from DP-3T/release/v1.0.4

Release/v1.0.4

dpppt-backend-sdk/dpppt-backend-sdk-data/src/main/java/org/dpppt/backend/sdk/data/JDBCRedeemDataServiceImpl.java

@@ -10,7 +10,9 @@
 
 package org.dpppt.backend.sdk.data;
 
+import java.time.Clock;
 import java.time.Duration;
+import java.time.LocalDate;
 import java.time.OffsetDateTime;
 import java.time.ZoneOffset;
 import java.util.Date;
@@ -30,6 +32,7 @@ public class JDBCRedeemDataServiceImpl implements RedeemDataService {
 
 	private final NamedParameterJdbcTemplate jt;
 	private final SimpleJdbcInsert reedemUUIDInsert;
+	private Clock currentClock = Clock.systemUTC();
 
 	public JDBCRedeemDataServiceImpl(DataSource dataSource) {
 		this.jt = new NamedParameterJdbcTemplate(dataSource);
@@ -46,16 +49,20 @@ public boolean checkAndInsertPublishUUID(String uuid) {
 		if (count > 0) {
 			return false;
 		} else {
-			params.addValue("received_at", new Date());
+			// set the received_at to the next day, with no time information
+			// it will stay longer in the DB but we mitigate the risk that the JWT
+			// can be used twice (c.f. testTokensArentDeletedBeforeExpire). 
+			long startOfDay = LocalDate.now(currentClock).atStartOfDay(ZoneOffset.UTC).plusDays(1).toInstant().toEpochMilli();
+			params.addValue("received_at", new Date(startOfDay));
 			reedemUUIDInsert.execute(params);
 			return true;
 		}
 	}
-	
+
 	@Override
 	@Transactional(readOnly = false)
 	public void cleanDB(Duration retentionPeriod) {
-		OffsetDateTime retentionTime = OffsetDateTime.now().withOffsetSameInstant(ZoneOffset.UTC).minus(retentionPeriod);
+		OffsetDateTime retentionTime = OffsetDateTime.now(currentClock).minus(retentionPeriod);
 		logger.info("Cleanup DB entries before: " + retentionTime);
 		MapSqlParameterSource params = new MapSqlParameterSource("retention_time", Date.from(retentionTime.toInstant()));
 		String sqlRedeem = "delete from t_redeem_uuid where received_at < :retention_time";

dpppt-backend-sdk/dpppt-backend-sdk-data/src/test/java/org/dpppt/backend/sdk/data/gaen/PostgresGaenDataServiceTest.java

@@ -14,11 +14,13 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.lang.reflect.Field;
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Timestamp;
+import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
 import java.time.LocalDate;
@@ -32,6 +34,7 @@
 
 import javax.sql.DataSource;
 
+import org.dpppt.backend.sdk.data.JDBCRedeemDataServiceImpl;
 import org.dpppt.backend.sdk.data.RedeemDataService;
 import org.dpppt.backend.sdk.data.config.DPPPTDataServiceConfig;
 import org.dpppt.backend.sdk.data.config.FlyWayConfig;
@@ -114,6 +117,41 @@ public void testRedeemUUID() {
 		assertTrue(actual);
 	}
 
+	private Field getFieldToClock() throws Exception{
+		Field field = JDBCRedeemDataServiceImpl.class.getDeclaredField("currentClock");
+		field.setAccessible(true);
+		return field;
+	}
+
+	@Test
+	public void testTokensArentDeletedBeforeExpire() throws Exception {
+		var field = getFieldToClock();
+		var localDateNow = LocalDate.now(ZoneOffset.UTC);
+		Clock twoMinutesToMidnight = Clock.fixed(localDateNow.atStartOfDay(ZoneOffset.UTC).plusDays(1).minusMinutes(2).toInstant(), ZoneOffset.UTC);
+		Clock twoMinutesAfterMidnight = Clock.fixed(localDateNow.atStartOfDay(ZoneOffset.UTC).plusDays(1).plusMinutes(2).toInstant(), ZoneOffset.UTC);
+		Clock nextDay = Clock.fixed(localDateNow.atStartOfDay(ZoneOffset.UTC).plusDays(2).plusMinutes(2).toInstant(), ZoneOffset.UTC);
+
+		field.set(redeemDataService, twoMinutesToMidnight);
+
+		boolean actual = redeemDataService.checkAndInsertPublishUUID("bc77d983-2359-48e8-835a-de673fe53ccb");
+		assertTrue(actual);
+
+		//token is still valid for 1 minute
+		field.set(redeemDataService, twoMinutesAfterMidnight);
+
+		redeemDataService.cleanDB(Duration.ofDays(1));
+
+		actual = redeemDataService.checkAndInsertPublishUUID("bc77d983-2359-48e8-835a-de673fe53ccb");
+		assertFalse(actual);
+
+		field.set(redeemDataService, nextDay);
+
+		redeemDataService.cleanDB(Duration.ofDays(1));
+
+		actual = redeemDataService.checkAndInsertPublishUUID("bc77d983-2359-48e8-835a-de673fe53ccb");
+		assertTrue(actual);
+	}
+
 	@Test
 	public void cleanup() throws SQLException {
 		OffsetDateTime now = OffsetDateTime.now().withOffsetSameInstant(ZoneOffset.UTC);

dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/java/org/dpppt/backend/sdk/ws/config/WSBaseConfig.java

@@ -283,7 +283,7 @@ public void configureTasks(ScheduledTaskRegistrar taskRegistrar) {
 			logger.info("Start DB cleanup");
 			dppptSDKDataService().cleanDB(Duration.ofDays(retentionDays));
 			gaenDataService().cleanDB(Duration.ofDays(retentionDays));
-			redeemDataService().cleanDB(Duration.ofDays(1));
+			redeemDataService().cleanDB(Duration.ofDays(2));
 			logger.info("DB cleanup up");
 		}, 60 * 60 * 1000L));