This adds API tokens as a new credential type. Their format is:
`oh.<name>.<random chars>`
The "oh." prefix is used to tell them apart from a JWT access token,
because they're both used as a Bearer authorization scheme, but there
is no semantic value attached to any of the other parts.
They are stored hashed in the user's profile, and can be listed, added
or removed managed with the new `openhab:users` console command.
Currently the scopes are still not checked, but ultimately they could
be, for instance a scope of e.g. `user admin.items` would mean that the
API token can be used to perform user operations like retrieving info
or sending a command, _and_ managing the items, but nothing else -
even if the user has more permissions because of their role (which
will of course still be checked).
Tokens are normally passed in the Authorization header with the Bearer
scheme, or the X-OPENHAB-TOKEN header, like access tokens.
As a special exception, API tokens can also be used with the Basic
authorization scheme, **even if the allowBasicAuth** option is not
enabled in the "API Security" service, because there's no additional
security risk in allowing that. In that case, the token should be
passed as the username and the password MUST be empty.
In short, this means that all these curl commands will work:
- `curl -H 'Authorization: Bearer <token>' http://localhost:8080/rest/inbox`
- `curl -H 'X-OPENHAB-TOKEN: <token>' http://localhost:8080/rest/inbox`
- `curl -u '<token>[:]' http://localhost:8080/rest/inbox`
- `curl http://<token>@localhost:8080/rest/inbox`
2 REST API operations were adding to the AuthResource, to allow
authenticated users to list their tokens or remove (revoke) one.
Self-service for creating a token or changing the password is more
sensitive so these should be handled with a servlet and pages devoid
of any JavaScript instead of REST API calls, therefore for now they'll
have to be done with the console.
This also fixes regressions introduced with #1713 - the operations
annotated with @RolesAllowed({ Role.USER }) only were not authorized
for administrators anymore.
* Generate a unique salt for each token
Reusing the password salt is bad practice, and changing the
password changes the salt as well which makes all tokens
invalid.
Put the salt in the same field as the hash (concatenated
with a separator) to avoid modifying the JSON DB schema.
* Fix API token authentication, make scope available to security context
The X-OPENHAB-TOKEN header now has priority over the Authorization
header to credentials, if both are set.
* Add self-service pages to change password & create new API token
Signed-off-by: Yannick Schaus <github@schaus.net>
* Migrates all tests to the JUnit 5 Jupiter API
* Updates bnd to 5.1.2
* Updates maven-surefire-plugin to 3.0.0-M5
* Updates Mockito to 3.4.6
* Updates Hamcrest to 2.2
* Removes org.openhab.core.boot POM dependencies
Signed-off-by: Wouter Born <github@maindrain.net>
Replaces the way an array is declared with the way "prefered for java", because the [] is part of the TYPE and not the NAME.
Signed-off-by: Paul Vogel <pavog@users.noreply.github.com>
* Fix for handling inverted cron ranges
This fix adds support for inverted cron ranged. For example SUN-WEN.
It also works all ranges and also with additional increments.
Closes#1516
Signed-off-by: Hilbrand Bouwkamp <hilbrand@h72.nl>
* Add and fix more null annotations
* Add more @NonNullByDefault and @Nullable annotations
* Remove unnecessary @NonNull annotations
* Fix a few other trivial SAT issues
* Add constructor injection for MDNSDiscoveryService
Signed-off-by: Wouter Born <github@maindrain.net>
* Clarify return values for implementation
* Dynamic state/command provider should not return original descritpion
* Added ERROR log message
* Added integration test for CommandDescriptionProvider
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
* Metadata-based state & command description providers
Implements #1185.
These providers will look into item metadata, which
can be managed by UIs with the API, to set or override
the item's state description (pattern, options, read
only...) or command description.
Signed-off-by: Yannick Schaus <github@schaus.net>
* UI component registries initial implementation
This is an initial implementation of #1355.
It was simple enough to make to be proposed as
a PR already without waiting for remarks on the RFC.
The SitemapProvider for the `system:sitemap`
namespace as described in #1355 is not part of
this PR.
Signed-off-by: Yannick Schaus <github@schaus.net>
* var and varh were missing
* var is basically an alternate form of WATT
* kvarh was incorrectly marked as a division between kvar and hour
* Volt-Ampere added to the units
This unit for apparent power in an electrical circuit. Useful for smart meters and solar inverters.
Signed-off-by: Nagy Attila Gabor <mrbig@sneaker.hu>
* Added public method to remove all members from a group
* Spelling in itest method names
* File encoding
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
Make sure Throwables are not be substituted into log messages so they can be formatted according to the logging configuration.
Signed-off-by: Wouter Born <github@maindrain.net>
Fixes SAT errors/warnings in resources and tests reported by SAT 0.8.0-SNAPSHOT.
Related to openhab/static-code-analysis#363
Signed-off-by: Wouter Born <github@maindrain.net>
* Added nullness annotations to o.o.c.binding.xml
* Use local variables
* Removed unuused import
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
Adds null annotations to all registries, the interfaces they implement and a few other classes.
Also-by: Christoph Weitkamp <github@christophweitkamp.de>
Signed-off-by: Wouter Born <github@maindrain.net>
* Use !isEmpty() instead of "size() > 0" or "size() != 0"
!isEmpty() expresses the intent more clearly and is therefore preferred.
Counting the number of elements can also be an expensive operation e.g. when using linked lists.
Co-Authored-By: Christoph Weitkamp <github@christophweitkamp.de>
Signed-off-by: Wouter Born <github@maindrain.net>
* Changed pid from 'org.eclipse.smarthome.core.i18nprovider' to 'org.eclipse.smarthome.i18n'
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
Fixes wrong names identified by the following rules:
* ConstantNameCheck
* LocalFinalVariableNameCheck
* LocalVariableNameCheck
* StaticVariableNameCheck
Most mismatches identified by the MemberNameCheck have also been fixed except for those where the variables are used in events/DTOs etc which would cause issues.
Signed-off-by: Wouter Born <github@maindrain.net>
Fixes the SAT warning: First javadoc author should have "Initial contribution" contribution description.
Signed-off-by: Wouter Born <github@maindrain.net>
* [OAuth2] redirectURI should be optional on getAccessTokenResponseByAuthorizationCode
The redirectURI should be optional (Nullable) on getAccessTokenResponseByAuthorizationCode as in the JavaDoc is stated (as is stated in the refered specification).
* [OAuth2] Removed redundant NonNull
Signed-off-by: Hilbrand Bouwkamp <hilbrand@h72.nl>
* Fix DateTimeType parsing of strings with 2 nano digits
Some formatters such as the DateTimeFormatter.ISO_LOCAL_DATE_TIME may also output a string containing 2 nano digits which fail to be parsed by DateTimeValue.
* Fix parsing of arbitrary number of nano digits for Java 11
Signed-off-by: Wouter Born <github@maindrain.net>
* Bump SAT version; Fixed high priority findings
* Defined path to feature file to avoid warnings
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
* Use constructor injection to simplify lifecycle
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
* PR extended by ItemStateConverter
Signed-off-by: Christoph Weitkamp <github@christophweitkamp.de>
* Move null annotations between modifiers and variable type
* Remove redundant public modifiers from interfaces where applicable
* Remove redundant `@NonNull` annotations
Signed-off-by: Wouter Born <github@maindrain.net>
Since Java 9 (JDK-8164428) the maximum resolution from the underlying clock is used.
Instead of just milliseconds the resolution can now even be tenth of microseconds.
According to the Type JavaDocs toFullString() should return the full string representation of the type to be consumed by 'valueOf(String)'.
With the changes in this PR toFullString() may return higher resolution date time strings on newer Java versions and valueOf(value) is able to parse these.
Code depending on a certain resolution returned by toFullString() should use the format(pattern) method instead so the resolution will not change.
Fixes#667
Signed-off-by: Wouter Born <github@maindrain.net>
The change with unit classes parent (#617) causes it to report missing imports of tec.uom.se when using static import. Before the change this was not a problem because the parent class was SmartHomeUnits. This change adds a new parent class for all units.
Signed-off-by: Hilbrand Bouwkamp <hilbrand@h72.nl>
The classes ImperialUnits and SIUnits both extended SmartHomeUnits. But the classes are used a singletons.
Signed-off-by: Hilbrand Bouwkamp <hilbrand@h72.nl>
This addresses https://github.com/eclipse/smarthome/issues/5099 by adding a command description with command options along with the state description.
Command options will give a hint to UIs about the specific commands a channel provides. Command options could be rendered as a drop down and also represent the current state or rendered as push buttons to simply send a command to the ThingHandler.
The infrstructure basically copies the StateDescription infrastructure with CommandDescriptionProviders and an `DynamicCommandDescriptionProvider` interface for bindings to hook in and provide dynamic command options.
Signed-off-by: Henning Treu <henning.treu@googlemail.com>
The ready marker logic is created to hide the real usage. The ready
marker uses an "identifier" that is not specific or limited to bundles.
Currently the bundle symbolic name is used as bundle identifier.
That "convention" needs to be known at several different places.
There should be one method that created an identifier for a bundle and
"no one" needs to care about the implementation details.
Another point is that the bundle symbolic name that has been used is
optional. It may be null e.g. for bundles that has been installed by the
synthetic bundle installer mechanism etc.
The runtime assigns a bundle ID to an installed bundle that remains the
same for the bundle (see JavaDoc). The bundle ID is present all the
time.
The implementation of the "get identifier for bundle" has been choosen
to use the BSN -- if available -- (as before) but fallback to a custom
one using also the bundle ID (to be unique).
So we can provide always a non null identifier for a bundle.
It should be easily to change the identifier creation now if there is
every any need for.
Signed-off-by: Markus Rathgeb <maggu2810@gmail.com>
* updated license headers
* added NOTICE files
* moved about.html to NOTICE files
* changed main project license
* updated build.properties
* added files to check to prevent error about missing about.html
* removed license info on p2 feature
Signed-off-by: Kai Kreuzer <kai@openhab.org>
Applies the POM Code Covention as used in OH2/ESH projects.
See also: https://maven.apache.org/developers/conventions/code.html
The executed command is:
mvn \
com.github.ekryd.sortpom:sortpom-maven-plugin:sort \
-Dsort.keepBlankLines=true \
-Dsort.predefinedSortOrder=recommended_2008_06
Signed-off-by: Wouter Born <eclipse@maindrain.net>
* adapted FeatureInstaller to adapt addons info in ConfigAdmin, so that this info is stored in a file
* removed experimental features
* removed package selection from UI as it is meant to be only set once
* introduced new packages: minimal, simple and expert
* introduced a setup page on the dashboard, if no package is set (and thus openHAB is uninitialized)
* added auto-refresh of dashboard to have new entries appear automatically
Signed-off-by: Kai Kreuzer <kai@openhab.org>
