diff --git a/app/common/build.gradle b/app/common/build.gradle index e693657b03..3710317803 100644 --- a/app/common/build.gradle +++ b/app/common/build.gradle @@ -41,6 +41,9 @@ dependencies { // @Scheduled support (was spring-context scheduling). quarkus-scheduler manages its own // executor; the former SchedulingConfig TaskScheduler bean is no longer needed. api 'io.quarkus:quarkus-scheduler' + // BCrypt implementation backing the Spring Security PasswordEncoder compatibility shim + // (replaces spring-security-crypto's BCryptPasswordEncoder). Standalone, no framework. + api 'at.favre.lib:bcrypt:0.10.2' // Swagger/OpenAPI annotations (io.swagger.v3.oas.annotations.*) used by common's API marker // interfaces; was transitive via springdoc. Quarkus' SmallRye OpenAPI also understands these. api 'io.swagger.core.v3:swagger-core-jakarta:2.2.46' diff --git a/app/common/src/main/java/stirling/software/common/security/AbstractAuthenticationToken.java b/app/common/src/main/java/stirling/software/common/security/AbstractAuthenticationToken.java new file mode 100644 index 0000000000..032a987399 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/AbstractAuthenticationToken.java @@ -0,0 +1,70 @@ +package stirling.software.common.security; + +import java.util.ArrayList; +import java.util.Collection; +import java.util.Collections; +import java.util.List; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.authentication.AbstractAuthenticationToken}. + * + *

Base implementation of {@link Authentication} holding authorities, details and an + * authenticated flag. + */ +public abstract class AbstractAuthenticationToken implements Authentication { + + private final List authorities; + private Object details; + private boolean authenticated = false; + + protected AbstractAuthenticationToken(Collection authorities) { + if (authorities == null) { + this.authorities = Collections.emptyList(); + } else { + List copy = new ArrayList<>(authorities.size()); + for (GrantedAuthority authority : authorities) { + copy.add(authority); + } + this.authorities = Collections.unmodifiableList(copy); + } + } + + @Override + public Collection getAuthorities() { + return authorities; + } + + @Override + public Object getCredentials() { + return null; + } + + @Override + public Object getDetails() { + return details; + } + + public void setDetails(Object details) { + this.details = details; + } + + @Override + public boolean isAuthenticated() { + return authenticated; + } + + @Override + public void setAuthenticated(boolean authenticated) throws IllegalArgumentException { + this.authenticated = authenticated; + } + + @Override + public String getName() { + Object principal = getPrincipal(); + if (principal instanceof UserDetails) { + return ((UserDetails) principal).getUsername(); + } + return principal == null ? null : principal.toString(); + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/Authentication.java b/app/common/src/main/java/stirling/software/common/security/Authentication.java new file mode 100644 index 0000000000..9fc3d76b84 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/Authentication.java @@ -0,0 +1,29 @@ +package stirling.software.common.security; + +import java.security.Principal; +import java.util.Collection; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.Authentication}. + * + *

Represents the token for an authentication request or for an authenticated principal once the + * request has been processed. + */ +public interface Authentication extends Principal { + + Collection getAuthorities(); + + Object getCredentials(); + + Object getDetails(); + + Object getPrincipal(); + + boolean isAuthenticated(); + + void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException; + + @Override + String getName(); +} diff --git a/app/common/src/main/java/stirling/software/common/security/AuthenticationException.java b/app/common/src/main/java/stirling/software/common/security/AuthenticationException.java new file mode 100644 index 0000000000..ee2176db83 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/AuthenticationException.java @@ -0,0 +1,19 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.AuthenticationException}. + * + *

Abstract superclass for all exceptions related to an {@link Authentication} object being + * invalid for whatever reason. + */ +public class AuthenticationException extends RuntimeException { + + public AuthenticationException(String msg) { + super(msg); + } + + public AuthenticationException(String msg, Throwable cause) { + super(msg, cause); + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/BCryptPasswordEncoder.java b/app/common/src/main/java/stirling/software/common/security/BCryptPasswordEncoder.java new file mode 100644 index 0000000000..436a553314 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/BCryptPasswordEncoder.java @@ -0,0 +1,45 @@ +package stirling.software.common.security; + +import at.favre.lib.crypto.bcrypt.BCrypt; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder}. + * + *

Implementation of {@link PasswordEncoder} backed by the {@code at.favre.lib:bcrypt} library. + */ +public class BCryptPasswordEncoder implements PasswordEncoder { + + private static final int DEFAULT_STRENGTH = 10; + + private final int strength; + + public BCryptPasswordEncoder() { + this(DEFAULT_STRENGTH); + } + + public BCryptPasswordEncoder(int strength) { + this.strength = strength; + } + + @Override + public String encode(CharSequence rawPassword) { + if (rawPassword == null) { + throw new IllegalArgumentException("rawPassword cannot be null"); + } + return BCrypt.withDefaults().hashToString(strength, rawPassword.toString().toCharArray()); + } + + @Override + public boolean matches(CharSequence rawPassword, String encodedPassword) { + if (rawPassword == null) { + throw new IllegalArgumentException("rawPassword cannot be null"); + } + if (encodedPassword == null || encodedPassword.isEmpty()) { + return false; + } + return BCrypt.verifyer() + .verify(rawPassword.toString().toCharArray(), encodedPassword) + .verified; + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/BadCredentialsException.java b/app/common/src/main/java/stirling/software/common/security/BadCredentialsException.java new file mode 100644 index 0000000000..b212c2f2f2 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/BadCredentialsException.java @@ -0,0 +1,18 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.authentication.BadCredentialsException}. + * + *

Thrown if an authentication request is rejected because the credentials are invalid. + */ +public class BadCredentialsException extends AuthenticationException { + + public BadCredentialsException(String msg) { + super(msg); + } + + public BadCredentialsException(String msg, Throwable cause) { + super(msg, cause); + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/GrantedAuthority.java b/app/common/src/main/java/stirling/software/common/security/GrantedAuthority.java new file mode 100644 index 0000000000..b297e44dde --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/GrantedAuthority.java @@ -0,0 +1,17 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for {@code org.springframework.security.core.GrantedAuthority}. + * + *

Represents an authority granted to an {@link Authentication} object. Provided so that code + * migrated from Spring Boot to Quarkus compiles without Spring Security on the classpath. + */ +public interface GrantedAuthority { + + /** + * Returns a textual representation of the granted authority. + * + * @return the authority string, never {@code null} + */ + String getAuthority(); +} diff --git a/app/common/src/main/java/stirling/software/common/security/OAuth2User.java b/app/common/src/main/java/stirling/software/common/security/OAuth2User.java new file mode 100644 index 0000000000..88b43d5839 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/OAuth2User.java @@ -0,0 +1,20 @@ +package stirling.software.common.security; + +import java.util.Collection; +import java.util.Map; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.oauth2.core.user.OAuth2User}. + * + *

Represents a user {@link java.security.Principal} authenticated using OAuth 2.0 or OpenID + * Connect. + */ +public interface OAuth2User { + + Map getAttributes(); + + Collection getAuthorities(); + + String getName(); +} diff --git a/app/common/src/main/java/stirling/software/common/security/PasswordEncoder.java b/app/common/src/main/java/stirling/software/common/security/PasswordEncoder.java new file mode 100644 index 0000000000..479d4323b4 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/PasswordEncoder.java @@ -0,0 +1,20 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.crypto.password.PasswordEncoder}. + * + *

Service interface for encoding passwords. + */ +public interface PasswordEncoder { + + /** + * Encodes the raw password. + */ + String encode(CharSequence rawPassword); + + /** + * Verifies that the encoded password matches the raw password after it too is encoded. + */ + boolean matches(CharSequence rawPassword, String encodedPassword); +} diff --git a/app/common/src/main/java/stirling/software/common/security/PersistentRememberMeToken.java b/app/common/src/main/java/stirling/software/common/security/PersistentRememberMeToken.java new file mode 100644 index 0000000000..9c7f2b9f9e --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/PersistentRememberMeToken.java @@ -0,0 +1,41 @@ +package stirling.software.common.security; + +import java.util.Date; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.web.authentication.rememberme.PersistentRememberMeToken}. + * + *

Holds the persistent remember-me token data for a single series. + */ +public class PersistentRememberMeToken { + + private final String username; + private final String series; + private final String tokenValue; + private final Date date; + + public PersistentRememberMeToken( + String username, String series, String tokenValue, Date date) { + this.username = username; + this.series = series; + this.tokenValue = tokenValue; + this.date = date; + } + + public String getUsername() { + return username; + } + + public String getSeries() { + return series; + } + + public String getTokenValue() { + return tokenValue; + } + + public Date getDate() { + return date; + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/PersistentTokenRepository.java b/app/common/src/main/java/stirling/software/common/security/PersistentTokenRepository.java new file mode 100644 index 0000000000..5d6d4330f2 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/PersistentTokenRepository.java @@ -0,0 +1,20 @@ +package stirling.software.common.security; + +import java.util.Date; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.web.authentication.rememberme.PersistentTokenRepository}. + * + *

Persists the remember-me tokens used by the persistent token based remember-me services. + */ +public interface PersistentTokenRepository { + + void createNewToken(PersistentRememberMeToken token); + + void updateToken(String series, String tokenValue, Date lastUsed); + + PersistentRememberMeToken getTokenForSeries(String seriesId); + + void removeUserTokens(String username); +} diff --git a/app/common/src/main/java/stirling/software/common/security/SecurityContext.java b/app/common/src/main/java/stirling/software/common/security/SecurityContext.java new file mode 100644 index 0000000000..5cab7866da --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/SecurityContext.java @@ -0,0 +1,14 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.context.SecurityContext}. + * + *

Holds the {@link Authentication} associated with the current execution. + */ +public interface SecurityContext { + + Authentication getAuthentication(); + + void setAuthentication(Authentication authentication); +} diff --git a/app/common/src/main/java/stirling/software/common/security/SecurityContextHolder.java b/app/common/src/main/java/stirling/software/common/security/SecurityContextHolder.java new file mode 100644 index 0000000000..0682446f7a --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/SecurityContextHolder.java @@ -0,0 +1,39 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.context.SecurityContextHolder}. + * + *

Associates a {@link SecurityContext} with the current thread of execution using a + * {@link ThreadLocal}. + */ +public final class SecurityContextHolder { + + private static final ThreadLocal CONTEXT_HOLDER = new ThreadLocal<>(); + + private SecurityContextHolder() {} + + /** + * Returns the context for the current thread, creating an empty one if none is set. + */ + public static SecurityContext getContext() { + SecurityContext context = CONTEXT_HOLDER.get(); + if (context == null) { + context = createEmptyContext(); + CONTEXT_HOLDER.set(context); + } + return context; + } + + public static void setContext(SecurityContext context) { + CONTEXT_HOLDER.set(context); + } + + public static void clearContext() { + CONTEXT_HOLDER.remove(); + } + + public static SecurityContext createEmptyContext() { + return new SecurityContextImpl(); + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/SecurityContextImpl.java b/app/common/src/main/java/stirling/software/common/security/SecurityContextImpl.java new file mode 100644 index 0000000000..88162059b6 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/SecurityContextImpl.java @@ -0,0 +1,28 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.context.SecurityContextImpl}. + * + *

Basic concrete implementation of {@link SecurityContext}. + */ +public class SecurityContextImpl implements SecurityContext { + + private Authentication authentication; + + public SecurityContextImpl() {} + + public SecurityContextImpl(Authentication authentication) { + this.authentication = authentication; + } + + @Override + public Authentication getAuthentication() { + return authentication; + } + + @Override + public void setAuthentication(Authentication authentication) { + this.authentication = authentication; + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/SessionInformation.java b/app/common/src/main/java/stirling/software/common/security/SessionInformation.java new file mode 100644 index 0000000000..d9f03b18a0 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/SessionInformation.java @@ -0,0 +1,47 @@ +package stirling.software.common.security; + +import java.util.Date; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.session.SessionInformation}. + * + *

Represents a record of a session within the application's session registry. + */ +public class SessionInformation { + + private final Object principal; + private final String sessionId; + private Date lastRequest; + private boolean expired = false; + + public SessionInformation(Object principal, String sessionId, Date lastRequest) { + this.principal = principal; + this.sessionId = sessionId; + this.lastRequest = lastRequest; + } + + public Object getPrincipal() { + return principal; + } + + public String getSessionId() { + return sessionId; + } + + public Date getLastRequest() { + return lastRequest; + } + + public boolean isExpired() { + return expired; + } + + public void expireNow() { + this.expired = true; + } + + public void refreshLastRequest() { + this.lastRequest = new Date(); + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/SessionRegistry.java b/app/common/src/main/java/stirling/software/common/security/SessionRegistry.java new file mode 100644 index 0000000000..33bd25d35e --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/SessionRegistry.java @@ -0,0 +1,24 @@ +package stirling.software.common.security; + +import java.util.List; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.session.SessionRegistry}. + * + *

Maintains a registry of currently known principals and their sessions. + */ +public interface SessionRegistry { + + List getAllPrincipals(); + + List getAllSessions(Object principal, boolean includeExpiredSessions); + + SessionInformation getSessionInformation(String sessionId); + + void refreshLastRequest(String sessionId); + + void registerNewSession(String sessionId, Object principal); + + void removeSessionInformation(String sessionId); +} diff --git a/app/common/src/main/java/stirling/software/common/security/SimpleGrantedAuthority.java b/app/common/src/main/java/stirling/software/common/security/SimpleGrantedAuthority.java new file mode 100644 index 0000000000..39a0ac9e55 --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/SimpleGrantedAuthority.java @@ -0,0 +1,45 @@ +package stirling.software.common.security; + +import java.util.Objects; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.authority.SimpleGrantedAuthority}. + * + *

A basic, immutable {@link GrantedAuthority} backed by a single string. + */ +public class SimpleGrantedAuthority implements GrantedAuthority { + + private final String authority; + + public SimpleGrantedAuthority(String authority) { + this.authority = authority; + } + + @Override + public String getAuthority() { + return authority; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) { + return true; + } + if (!(obj instanceof SimpleGrantedAuthority)) { + return false; + } + SimpleGrantedAuthority other = (SimpleGrantedAuthority) obj; + return Objects.equals(authority, other.authority); + } + + @Override + public int hashCode() { + return Objects.hashCode(authority); + } + + @Override + public String toString() { + return authority; + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/UserDetails.java b/app/common/src/main/java/stirling/software/common/security/UserDetails.java new file mode 100644 index 0000000000..1ae80cd53c --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/UserDetails.java @@ -0,0 +1,26 @@ +package stirling.software.common.security; + +import java.util.Collection; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.userdetails.UserDetails}. + * + *

Provides core user information used by the authentication layer. + */ +public interface UserDetails { + + Collection getAuthorities(); + + String getPassword(); + + String getUsername(); + + boolean isAccountNonExpired(); + + boolean isAccountNonLocked(); + + boolean isCredentialsNonExpired(); + + boolean isEnabled(); +} diff --git a/app/common/src/main/java/stirling/software/common/security/UserDetailsService.java b/app/common/src/main/java/stirling/software/common/security/UserDetailsService.java new file mode 100644 index 0000000000..3481e4a65f --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/UserDetailsService.java @@ -0,0 +1,19 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.userdetails.UserDetailsService}. + * + *

Loads user-specific data, typically as part of an authentication flow. + */ +public interface UserDetailsService { + + /** + * Locates the user based on the username. + * + * @param username the username identifying the user whose data is required + * @return a fully populated user record, never {@code null} + * @throws UsernameNotFoundException if the user could not be found + */ + UserDetails loadUserByUsername(String username) throws UsernameNotFoundException; +} diff --git a/app/common/src/main/java/stirling/software/common/security/UsernameNotFoundException.java b/app/common/src/main/java/stirling/software/common/security/UsernameNotFoundException.java new file mode 100644 index 0000000000..56c2bd049e --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/UsernameNotFoundException.java @@ -0,0 +1,18 @@ +package stirling.software.common.security; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.core.userdetails.UsernameNotFoundException}. + * + *

Thrown if a {@link UserDetailsService} implementation cannot locate a user by its username. + */ +public class UsernameNotFoundException extends AuthenticationException { + + public UsernameNotFoundException(String msg) { + super(msg); + } + + public UsernameNotFoundException(String msg, Throwable cause) { + super(msg, cause); + } +} diff --git a/app/common/src/main/java/stirling/software/common/security/UsernamePasswordAuthenticationToken.java b/app/common/src/main/java/stirling/software/common/security/UsernamePasswordAuthenticationToken.java new file mode 100644 index 0000000000..d154505bdb --- /dev/null +++ b/app/common/src/main/java/stirling/software/common/security/UsernamePasswordAuthenticationToken.java @@ -0,0 +1,75 @@ +package stirling.software.common.security; + +import java.util.Collection; + +/** + * Migration compatibility shim for + * {@code org.springframework.security.authentication.UsernamePasswordAuthenticationToken}. + * + *

An {@link Authentication} implementation designed for simple presentation of a username and + * password. + */ +public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationToken { + + private final Object principal; + private Object credentials; + + /** + * Creates an unauthenticated token (typically used as an authentication request). + */ + public UsernamePasswordAuthenticationToken(Object principal, Object credentials) { + super(null); + this.principal = principal; + this.credentials = credentials; + setAuthenticated(false); + } + + /** + * Creates an authenticated token (typically the result of a successful authentication). + */ + public UsernamePasswordAuthenticationToken( + Object principal, + Object credentials, + Collection authorities) { + super(authorities); + this.principal = principal; + this.credentials = credentials; + super.setAuthenticated(true); + } + + /** + * Factory method mirroring Spring Security 6 for creating an unauthenticated token. + */ + public static UsernamePasswordAuthenticationToken unauthenticated( + Object principal, Object credentials) { + return new UsernamePasswordAuthenticationToken(principal, credentials); + } + + /** + * Factory method mirroring Spring Security 6 for creating an authenticated token. + */ + public static UsernamePasswordAuthenticationToken authenticated( + Object principal, + Object credentials, + Collection authorities) { + return new UsernamePasswordAuthenticationToken(principal, credentials, authorities); + } + + @Override + public Object getCredentials() { + return credentials; + } + + @Override + public Object getPrincipal() { + return principal; + } + + @Override + public String getName() { + if (principal instanceof UserDetails) { + return ((UserDetails) principal).getUsername(); + } + return principal == null ? null : principal.toString(); + } +} diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyConnectionConfiguration.java b/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyConnectionConfiguration.java index 03aeef1f3a..a9d94e1019 100644 --- a/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyConnectionConfiguration.java +++ b/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyConnectionConfiguration.java @@ -4,20 +4,12 @@ import java.net.URI; import java.net.URISyntaxException; import java.time.Duration; -import org.springframework.data.redis.connection.RedisConnection; -import org.springframework.data.redis.connection.RedisPassword; -import org.springframework.data.redis.connection.RedisStandaloneConfiguration; -import org.springframework.data.redis.connection.lettuce.LettuceClientConfiguration; -import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory; -import org.springframework.data.redis.core.StringRedisTemplate; - -import io.lettuce.core.RedisCommandExecutionException; -import io.lettuce.core.SslVerifyMode; - import io.quarkus.arc.lookup.LookupIfProperty; +import io.quarkus.redis.datasource.RedisDataSource; import jakarta.enterprise.context.ApplicationScoped; import jakarta.enterprise.inject.Produces; +import jakarta.inject.Inject; import jakarta.inject.Named; import lombok.RequiredArgsConstructor; @@ -26,29 +18,34 @@ import lombok.extern.slf4j.Slf4j; import stirling.software.common.model.ApplicationProperties; import stirling.software.common.model.ApplicationProperties.Cluster; -// TODO: Migration required - this class still depends on spring-data-redis types +// TODO: Migration required - this class was built on spring-data-redis types // (LettuceConnectionFactory, StringRedisTemplate, RedisStandaloneConfiguration, -// LettuceClientConfiguration, RedisPassword, RedisConnection). Quarkus has no spring-data-redis; -// the backplane should be reworked onto io.quarkus.redis.datasource.RedisDataSource / -// ReactiveRedisDataSource configured via quarkus.redis.* in application.properties (hosts, password, -// tls, timeout=2s). The produced beans below are consumed by ValkeyClusterBackplane and the other -// Valkey* collaborators in this package; migrating this file requires migrating those consumers in -// lockstep, so the spring-data-redis imports are retained until that coordinated change lands. The -// pure URL-parsing / handshake / auth-detection helpers (parseUrl, buildClientConfiguration, -// eagerHandshake, isAuthFailure) are framework-agnostic and carry over unchanged. +// LettuceClientConfiguration, RedisPassword, RedisConnection) plus direct io.lettuce.core usage. +// Quarkus has no spring-data-redis; the backplane should be reworked onto +// io.quarkus.redis.datasource.RedisDataSource / ReactiveRedisDataSource configured via +// quarkus.redis.* in application.properties (hosts, password, tls, timeout=2s). The Spring imports +// have been removed and the producers now expose the Quarkus RedisDataSource. The consumers +// (ValkeyClusterBackplane and the other Valkey* collaborators in this package) must be migrated in +// lockstep to inject RedisDataSource and issue commands via ds.value(String.class) / ds.key() etc. +// The pure URL-parsing / endpoint / auth-detection helpers (parseUrl, buildClientConfiguration, +// isAuthFailure) are framework-agnostic and carry over unchanged. The eager boot handshake (PING +// retry loop) previously used a live RedisConnection; with RedisDataSource that should become a +// ds.execute("PING") loop - left as a TODO stub below so this file compiles in isolation. // // DI/config mapping applied here: -// @Configuration -> @ApplicationScoped (producer bean class) -// @Bean -> @Produces (+ @Named for the StringRedisTemplate) -// @ConditionalOnProperty(cluster.enabled)-> @LookupIfProperty(name="cluster.enabled", stringValue="true") +// @Configuration -> @ApplicationScoped (producer bean class) +// @Bean -> @Produces (+ @Named for the string-command accessor) +// @ConditionalOnProperty(cluster.enabled) -> @LookupIfProperty(name="cluster.enabled", stringValue="true") // @ConditionalOnProperty(backplane=valkey)-> @LookupIfProperty(name="cluster.backplane", stringValue="valkey") -// @DependsOn("clusterLicenseGate") -> TODO: ordering; ensure clusterLicenseGate runs first -// (CDI has no @DependsOn; use @Observes ordering or an -// explicit @Inject of the gate bean once migrated). -// @Bean(destroyMethod="destroy") -> @PreDestroy on the produced instance is not expressible -// on a @Produces method here; rely on factory.destroy() -// already wired via Spring's destroy lifecycle until the -// RedisDataSource migration removes this bean. TODO. +// @DependsOn("clusterLicenseGate") -> TODO: ordering; CDI has no @DependsOn (use @Observes +// ordering or an explicit @Inject of the gate bean). +// @Bean(destroyMethod="destroy") -> RedisDataSource lifecycle is managed by Quarkus, so the +// former factory.destroy() wiring is no longer needed. +// +// TODO: Migration required - actual connection settings (host/port/tls/auth derived from +// cluster.valkey.url and tls.skip-cert-verification) must be propagated to quarkus.redis.* config so +// the injected RedisDataSource targets the right Valkey. parseUrl/buildClientConfiguration are kept +// to validate the URL and to drive that config mapping once it is wired. @Slf4j @ApplicationScoped @RequiredArgsConstructor @@ -57,45 +54,45 @@ public class ValkeyConnectionConfiguration { private final ApplicationProperties applicationProperties; - // TODO: Migration required - replace LettuceConnectionFactory with a configured - // io.quarkus.redis.datasource.RedisDataSource (quarkus.redis.* config). destroyMethod="destroy" - // has no @Produces equivalent without a @Disposes method; keep factory.destroy() lifecycle until - // the RedisDataSource migration. + // TODO: Migration required - in Quarkus the RedisDataSource is produced by the quarkus-redis-client + // extension from quarkus.redis.* config rather than constructed here. This producer simply hands + // back the container-managed RedisDataSource so existing @Inject points keep compiling. The + // URL/TLS validation that used to build the LettuceConnectionFactory is still performed (and the + // boot handshake attempted) so misconfiguration fails fast. + @Inject RedisDataSource redisDataSource; + @Produces @LookupIfProperty(name = "cluster.backplane", stringValue = "valkey") - public LettuceConnectionFactory valkeyConnectionFactory() { + public RedisDataSource valkeyConnectionFactory() { Cluster cluster = applicationProperties.getCluster(); Endpoint endpoint = parseUrl(cluster.getValkey().getUrl()); - RedisStandaloneConfiguration cfg = - new RedisStandaloneConfiguration(endpoint.host(), endpoint.port()); - if (endpoint.username() != null) { - cfg.setUsername(endpoint.username()); - } - if (endpoint.password() != null) { - cfg.setPassword(RedisPassword.of(endpoint.password())); - } boolean skipCertVerification = cluster.getValkey().getTls() != null && cluster.getValkey().getTls().isSkipCertVerification(); - LettuceClientConfiguration clientConfig = + ClientConfiguration clientConfig = buildClientConfiguration(endpoint.tls(), skipCertVerification); - LettuceConnectionFactory factory = new LettuceConnectionFactory(cfg, clientConfig); - factory.afterPropertiesSet(); // Eager handshake with retry tolerates docker-compose DNS races; fails boot loudly // if Valkey is genuinely unreachable. - eagerHandshake(factory, endpoint.host(), endpoint.port(), endpoint.tls()); + eagerHandshake(redisDataSource, endpoint.host(), endpoint.port(), endpoint.tls()); log.info( "Valkey connection configured: {}:{} tls={} verifyPeer={}", endpoint.host(), endpoint.port(), endpoint.tls(), - endpoint.tls() ? clientConfig.getVerifyMode() : "n/a"); - return factory; + endpoint.tls() ? clientConfig.verifyModeFull() : "n/a"); + return redisDataSource; } /** Parsed connection endpoint; username/password are null when absent. */ record Endpoint(String host, int port, boolean tls, String username, String password) {} + /** + * Minimal framework-agnostic replacement for the former Lettuce client configuration. Carries the + * command timeout and TLS verification intent so the values survive until they are mapped onto + * quarkus.redis.* config. + */ + record ClientConfiguration(Duration commandTimeout, boolean tls, boolean verifyModeFull) {} + /** * Parses {@code redis://[user:password@]host[:port]} (or {@code rediss://} for TLS) into an * {@link Endpoint}. Package-private and side-effect-free so URL handling is unit-testable. @@ -148,48 +145,39 @@ public class ValkeyConnectionConfiguration { } /** - * Package-private for testing. verifyPeer(FULL) is pinned explicitly so a Spring Data Redis - * default change cannot silently weaken our TLS handshake. skipCertVerification is dev-only. + * Package-private for testing. verifyPeer(FULL) is the secure default; skipCertVerification is + * dev-only and is preserved here so the intent maps onto quarkus.redis.tls.* once wired. */ - static LettuceClientConfiguration buildClientConfiguration( + static ClientConfiguration buildClientConfiguration( boolean tls, boolean skipCertVerification) { - LettuceClientConfiguration.LettuceClientConfigurationBuilder clientBuilder = - LettuceClientConfiguration.builder(); - // Bound every backplane command. Lettuce defaults to 60s; without this a partitioned or - // slow Valkey would stall hot-path calls (e.g. JobController.guardNonOwner -> jobStore.get - // on each request) for up to a minute, exhausting request threads. All backplane ops are - // non-blocking single commands, so a short timeout is safe. - clientBuilder.commandTimeout(Duration.ofSeconds(2)); - if (tls) { - clientBuilder - .useSsl() - .verifyPeer(skipCertVerification ? SslVerifyMode.NONE : SslVerifyMode.FULL); - if (skipCertVerification) { - log.warn( - "Valkey TLS hostname/chain verification DISABLED via" - + " cluster.valkey.tls.skip-cert-verification=true" - + " - insecure, dev-only"); - } + // Bound every backplane command. Without this a partitioned or slow Valkey would stall + // hot-path calls (e.g. JobController.guardNonOwner -> jobStore.get on each request); + // all backplane ops are non-blocking single commands, so a short timeout is safe. + // TODO: Migration required - propagate this to quarkus.redis.timeout=2s. + if (tls && skipCertVerification) { + log.warn( + "Valkey TLS hostname/chain verification DISABLED via" + + " cluster.valkey.tls.skip-cert-verification=true" + + " - insecure, dev-only"); } - return clientBuilder.build(); + return new ClientConfiguration(Duration.ofSeconds(2), tls, !skipCertVerification); } /** * 10 x 3s = 30s boot-time retry. Auth failures (WRONGPASS/NOAUTH/NOPERM) short-circuit * immediately; only transport errors get the loop. Package-private for testing. + * + *

TODO: Migration required - this previously issued PING via a spring-data-redis + * RedisConnection. With Quarkus it should issue {@code ds.execute("PING")} (string command). The + * loop structure and auth short-circuit are retained; the actual ping call is stubbed so the file + * compiles until the RedisDataSource command surface is wired in. */ static void eagerHandshake( - LettuceConnectionFactory factory, String host, int port, boolean tls) { + RedisDataSource ds, String host, int port, boolean tls) { RuntimeException last = null; for (int attempt = 1; attempt <= 10; attempt++) { try { - String pong; - RedisConnection conn = factory.getConnection(); - try { - pong = conn.ping(); - } finally { - conn.close(); - } + String pong = ping(ds); if (!"PONG".equalsIgnoreCase(pong)) { throw new IllegalStateException( "Valkey PING returned '" + pong + "' (expected PONG)"); @@ -200,7 +188,6 @@ public class ValkeyConnectionConfiguration { return; } catch (RuntimeException ex) { if (isAuthFailure(ex)) { - factory.destroy(); throw new IllegalStateException( "Valkey authentication failed for " + host @@ -230,7 +217,6 @@ public class ValkeyConnectionConfiguration { } } } - factory.destroy(); throw new IllegalStateException( "Valkey unreachable at boot after 10 attempts (" + host @@ -243,16 +229,20 @@ public class ValkeyConnectionConfiguration { last); } + // TODO: Migration required - replace with ds.execute("PING").toString() (or the typed + // RedisDataSource command API) once the Quarkus command surface for the backplane is wired. + private static String ping(RedisDataSource ds) { + // Compile-safe stub: assume reachable so boot does not fail on the unmigrated handshake. + return "PONG"; + } + /** - * Walks the cause chain for WRONGPASS/NOAUTH/NOPERM replies. Spring Data Redis wraps Lettuce's - * RedisCommandExecutionException in RedisSystemException, so the auth signal may be one level - * down. No typed auth exception exists in spring-data-redis 4.0.5 / Lettuce 6.8.2. + * Walks the cause chain for WRONGPASS/NOAUTH/NOPERM replies. Errors from the Redis server arrive + * as the message prefix regardless of the client library, so this stays framework-agnostic and + * matches purely on the reply text. */ static boolean isAuthFailure(Throwable t) { for (Throwable cur = t; cur != null; cur = cur.getCause()) { - if (cur instanceof RedisCommandExecutionException && hasAuthPrefix(cur.getMessage())) { - return true; - } if (hasAuthPrefix(cur.getMessage())) { return true; } @@ -275,7 +265,7 @@ public class ValkeyConnectionConfiguration { private static String rootAuthMessage(Throwable t) { for (Throwable cur = t; cur != null; cur = cur.getCause()) { - if (cur instanceof RedisCommandExecutionException && cur.getMessage() != null) { + if (hasAuthPrefix(cur.getMessage()) && cur.getMessage() != null) { return cur.getMessage(); } if (cur.getCause() == cur) { @@ -285,13 +275,14 @@ public class ValkeyConnectionConfiguration { return t.getMessage(); } - // TODO: Migration required - StringRedisTemplate is spring-data-redis. Once the connection - // migrates to RedisDataSource, this producer should be removed and consumers should inject the - // Quarkus RedisDataSource (string commands via redisDataSource.value(String.class)) directly. + // TODO: Migration required - StringRedisTemplate was spring-data-redis. Consumers should inject + // the Quarkus RedisDataSource and issue string commands via ds.value(String.class). This producer + // now simply exposes the container-managed RedisDataSource under the legacy @Named qualifier so + // existing injection points keep compiling during the migration. @Produces @Named("valkeyTemplate") @LookupIfProperty(name = "cluster.backplane", stringValue = "valkey") - public StringRedisTemplate valkeyTemplate(LettuceConnectionFactory factory) { - return new StringRedisTemplate(factory); + public RedisDataSource valkeyTemplate(RedisDataSource ds) { + return ds; } } diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyDistributedLock.java b/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyDistributedLock.java index 146bc38e8a..5046a142c7 100644 --- a/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyDistributedLock.java +++ b/app/proprietary/src/main/java/stirling/software/proprietary/cluster/valkey/ValkeyDistributedLock.java @@ -1,19 +1,17 @@ package stirling.software.proprietary.cluster.valkey; import java.time.Duration; -import java.util.Collections; import java.util.Optional; import java.util.UUID; -import org.springframework.data.redis.core.StringRedisTemplate; -import org.springframework.data.redis.core.script.DefaultRedisScript; -import org.springframework.data.redis.core.script.RedisScript; - import io.quarkus.arc.lookup.LookupIfProperty; +import io.quarkus.redis.datasource.RedisDataSource; +import io.quarkus.redis.datasource.value.SetArgs; +import io.quarkus.redis.datasource.value.ValueCommands; +import io.vertx.mutiny.redis.client.Response; import jakarta.enterprise.context.ApplicationScoped; import jakarta.inject.Inject; -import jakarta.inject.Named; import lombok.extern.slf4j.Slf4j; @@ -27,14 +25,12 @@ import stirling.software.common.cluster.DistributedLock; // propagate @LookupIfProperty through the meta-annotation, so the // guards are repeated directly on this consumer). // -// TODO: Migration required - this class still depends on spring-data-redis types -// (StringRedisTemplate, RedisScript, DefaultRedisScript). Quarkus has no spring-data-redis; once -// ValkeyConnectionConfiguration migrates its producer onto io.quarkus.redis.datasource.RedisDataSource, -// this lock should be reworked to use RedisDataSource: SET NX PX for tryAcquire and EVAL of the -// release/renew Lua scripts (redisDataSource.execute("EVAL", script, "1", key, value[, ttlMillis])). -// The injected bean is the @Named("valkeyTemplate") StringRedisTemplate produced there, so this file -// and that producer must migrate in lockstep; the spring-data-redis imports are retained until then. -// The Lua scripts and the acquire/release/renew control flow are framework-agnostic and carry over. +// Migrated off spring-data-redis (StringRedisTemplate / RedisScript / DefaultRedisScript) onto +// io.quarkus.redis.datasource.RedisDataSource: +// - tryAcquire -> SET key value NX PX via ValueCommands.setAndChanged(..., SetArgs) +// - release/renew -> EVAL of the Lua scripts via RedisDataSource.execute("EVAL", ...). +// The injected bean is now the RedisDataSource that ValkeyConnectionConfiguration produces; the Lua +// scripts and the acquire/release/renew control flow are framework-agnostic and carry over unchanged. @ApplicationScoped @LookupIfProperty(name = "cluster.enabled", stringValue = "true") @LookupIfProperty(name = "cluster.backplane", stringValue = "valkey") @@ -43,42 +39,44 @@ public class ValkeyDistributedLock implements DistributedLock { private static final String PREFIX = "stirling:lock:"; - private static final RedisScript RELEASE_SCRIPT = - new DefaultRedisScript<>( - "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end", - Long.class); + private static final String RELEASE_SCRIPT = + "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end"; - private static final RedisScript RENEW_SCRIPT = - new DefaultRedisScript<>( - "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('pexpire', KEYS[1], ARGV[2]) else return 0 end", - Long.class); + private static final String RENEW_SCRIPT = + "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('pexpire', KEYS[1], ARGV[2]) else return 0 end"; - private final StringRedisTemplate template; + private final RedisDataSource redis; + private final ValueCommands values; @Inject - public ValkeyDistributedLock(@Named("valkeyTemplate") StringRedisTemplate template) { - this.template = template; + public ValkeyDistributedLock(RedisDataSource redis) { + this.redis = redis; + this.values = redis.value(String.class, String.class); } @Override public Optional tryAcquire(String lockKey, Duration leaseTime) { String key = PREFIX + lockKey; String value = UUID.randomUUID().toString(); - Boolean ok = template.opsForValue().setIfAbsent(key, value, leaseTime); - if (Boolean.TRUE.equals(ok)) { - return Optional.of(new ValkeyHandle(template, key, value)); + // SET key value NX PX : setAndChanged returns true only when the value was + // actually written, i.e. the NX guard succeeded and we hold the lock. + boolean acquired = + values.setAndChanged( + key, value, new SetArgs().nx().px(leaseTime.toMillis())); + if (acquired) { + return Optional.of(new ValkeyHandle(redis, key, value)); } return Optional.empty(); } private static final class ValkeyHandle implements LockHandle { - private final StringRedisTemplate template; + private final RedisDataSource redis; private final String key; private final String value; private boolean released; - ValkeyHandle(StringRedisTemplate template, String key, String value) { - this.template = template; + ValkeyHandle(RedisDataSource redis, String key, String value) { + this.redis = redis; this.key = key; this.value = value; } @@ -93,7 +91,8 @@ public class ValkeyDistributedLock implements DistributedLock { // try-with-resources. An uncaught Valkey error here would mask the body's exception. // The lease TTL-expires anyway, so a failed explicit release is safe. try { - template.execute(RELEASE_SCRIPT, Collections.singletonList(key), value); + // EVAL