Class AuthWebService

java.lang.Object

ubic.gemma.rest.AuthWebService

@Service
@Path("/")
public class AuthWebService
extends Object

Bearer-token auth endpoints for the curation-UI SPA. Implements Option C of AUTH_FOR_SPA_RECCE.md: opaque token minted on credential check, sent on every subsequent call as Authorization: Bearer <token>.

Wire contract (matches what the SPA's gemma-curation-ui/apps/curation/src/api/session.ts expects):

  POST /rest/v2/login   {"username", "password"}        → 200 {"token", "user"}
  POST /rest/v2/logout                                  → 200 (idempotent)
  GET  /rest/v2/me                                      → 200 user|null

Note: the legacy HTTP Basic chain is preserved for CLI / RClient / cron clients; see RestSecurityConfig for the filter ordering.

See Also:

• TokenStore
• BearerTokenAuthenticationFilter

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	AuthWebService.LoginRequest	JSON body for POST /login.
static final class	AuthWebService.LoginResponse	Wire payload for POST /login — {token, user}.

Constructor Summary

Constructors

Constructor	Description
AuthWebService()

Method Summary

Modifier and Type	Method	Description
jakarta.ws.rs.core.Response	login(AuthWebService.LoginRequest req)	Verify credentials, mint a new opaque bearer token, and return both the token and the canonical user shape (mirrors GET /rest/v2/users/me).
jakarta.ws.rs.core.Response	logout(jakarta.servlet.http.HttpServletRequest request)	Revoke the bearer token presented in the Authorization header.
ResponseDataObject<RootWebService.UserValueObject>	me()	Convenience alias for GET /rest/v2/users/me; the curation-UI SPA's useMe() hook points at /rest/v2/me verbatim, so we mirror the shape here rather than asking the SPA to track the longer path.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AuthWebService

public AuthWebService()

Method Details

login

@POST
@Path("/login")
@Consumes("application/json")
@Produces("application/json")
public jakarta.ws.rs.core.Response login(AuthWebService.LoginRequest req)

Verify credentials, mint a new opaque bearer token, and return both the token and the canonical user shape (mirrors GET /rest/v2/users/me).

Anonymous callers and bad credentials produce 401. Empty payload produces 400.

logout

@POST
@Path("/logout")
@Produces("application/json")
public jakarta.ws.rs.core.Response logout(@Context
 jakarta.servlet.http.HttpServletRequest request)

Revoke the bearer token presented in the Authorization header. Idempotent — revoking an unknown / already-revoked token is a 200 with empty body, matching the SPA's expectation that logout always "succeeds" so it can clear local state unconditionally.

me

@GET
@Path("/me")
@Produces("application/json")
@PreAuthorize("isAuthenticated()")
public ResponseDataObject<RootWebService.UserValueObject> me()

Convenience alias for GET /rest/v2/users/me; the curation-UI SPA's useMe() hook points at /rest/v2/me verbatim, so we mirror the shape here rather than asking the SPA to track the longer path.

Returns the canonical RootWebService.UserValueObject (same as RootWebService.getMyself()).