Introduce new identity document layout

1 files changed, 46 insertions, 22 deletions

diff --git a/vespa-athenz/src/test/java/com/yahoo/vespa/athenz/identityprovider/client/IdentityDocumentSignerTest.java b/vespa-athenz/src/test/java/com/yahoo/vespa/athenz/identityprovider/client/IdentityDocumentSignerTest.java
index ff85cb79f02..acb0905700f 100644
--- a/vespa-athenz/src/test/java/com/yahoo/vespa/athenz/identityprovider/client/IdentityDocumentSignerTest.java
+++ b/vespa-athenz/src/test/java/com/yahoo/vespa/athenz/identityprovider/client/IdentityDocumentSignerTest.java
@@ -6,10 +6,13 @@ import com.yahoo.security.KeyUtils;
 import com.yahoo.vespa.athenz.api.AthenzIdentity;
 import com.yahoo.vespa.athenz.api.AthenzService;
 import com.yahoo.vespa.athenz.identityprovider.api.ClusterType;
+import com.yahoo.vespa.athenz.identityprovider.api.DefaultSignedIdentityDocument;
+import com.yahoo.vespa.athenz.identityprovider.api.EntityBindingsMapper;
+import com.yahoo.vespa.athenz.identityprovider.api.IdentityDocument;
 import com.yahoo.vespa.athenz.identityprovider.api.IdentityType;
+import com.yahoo.vespa.athenz.identityprovider.api.LegacySignedIdentityDocument;
 import com.yahoo.vespa.athenz.identityprovider.api.SignedIdentityDocument;
 import com.yahoo.vespa.athenz.identityprovider.api.VespaUniqueInstanceId;
-import com.yahoo.vespa.athenz.utils.AthenzIdentities;
 import org.junit.jupiter.api.Test;
 
 import java.security.KeyPair;
@@ -18,6 +21,7 @@ import java.util.Arrays;
 import java.util.HashSet;
 
 import static com.yahoo.vespa.athenz.identityprovider.api.IdentityType.TENANT;
+import static com.yahoo.vespa.athenz.identityprovider.api.SignedIdentityDocument.LEGACY_DEFAULT_DOCUMENT_VERSION;
 import static com.yahoo.vespa.athenz.identityprovider.api.SignedIdentityDocument.DEFAULT_DOCUMENT_VERSION;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -42,32 +46,53 @@ public class IdentityDocumentSignerTest {
     private static final AthenzIdentity serviceIdentity = new AthenzService("vespa", "node");
 
     @Test
-    void generates_and_validates_signature() {
+    void legacy_generates_and_validates_signature() {
         IdentityDocumentSigner signer = new IdentityDocumentSigner();
+        IdentityDocument identityDocument = new IdentityDocument(
+                id, providerService, configserverHostname,
+                instanceHostname, createdAt, ipAddresses, identityType, clusterType, ztsUrl, serviceIdentity);
         String signature =
-                signer.generateSignature(id, providerService, configserverHostname, instanceHostname, createdAt,
-                                         ipAddresses, identityType, keyPair.getPrivate(), serviceIdentity);
+                signer.generateLegacySignature(identityDocument, keyPair.getPrivate());
 
-        SignedIdentityDocument signedIdentityDocument = new SignedIdentityDocument(
-                signature, KEY_VERSION, id, providerService, DEFAULT_DOCUMENT_VERSION, configserverHostname,
-                instanceHostname, createdAt, ipAddresses, identityType, clusterType, ztsUrl, serviceIdentity);
+        SignedIdentityDocument signedIdentityDocument = new LegacySignedIdentityDocument(
+                signature, KEY_VERSION, LEGACY_DEFAULT_DOCUMENT_VERSION, identityDocument);
 
         assertTrue(signer.hasValidSignature(signedIdentityDocument, keyPair.getPublic()));
     }
 
     @Test
-    void ignores_cluster_type_and_zts_url() {
+    void generates_and_validates_signature() {
         IdentityDocumentSigner signer = new IdentityDocumentSigner();
+        IdentityDocument identityDocument = new IdentityDocument(
+                id, providerService, configserverHostname,
+                instanceHostname, createdAt, ipAddresses, identityType, clusterType, ztsUrl, serviceIdentity);
+        String data = EntityBindingsMapper.toIdentityDocmentData(identityDocument);
         String signature =
-                signer.generateSignature(id, providerService, configserverHostname, instanceHostname, createdAt,
-                                         ipAddresses, identityType, keyPair.getPrivate(), serviceIdentity);
+        signer.generateSignature(data, keyPair.getPrivate());
 
-        var docWithoutIgnoredFields = new SignedIdentityDocument(
-                signature, KEY_VERSION, id, providerService, DEFAULT_DOCUMENT_VERSION, configserverHostname,
-                instanceHostname, createdAt, ipAddresses, identityType, null, null, serviceIdentity);
-        var docWithIgnoredFields = new SignedIdentityDocument(
-                signature, KEY_VERSION, id, providerService, DEFAULT_DOCUMENT_VERSION, configserverHostname,
+        SignedIdentityDocument signedIdentityDocument = new DefaultSignedIdentityDocument(
+                signature, KEY_VERSION, DEFAULT_DOCUMENT_VERSION, data);
+
+        assertTrue(signer.hasValidSignature(signedIdentityDocument, keyPair.getPublic()));
+    }
+
+    @Test
+    void legacy_ignores_cluster_type_and_zts_url() {
+        IdentityDocumentSigner signer = new IdentityDocumentSigner();
+        IdentityDocument identityDocument = new IdentityDocument(
+                id, providerService, configserverHostname,
                 instanceHostname, createdAt, ipAddresses, identityType, clusterType, ztsUrl, serviceIdentity);
+        IdentityDocument withoutIgnoredFields = new IdentityDocument(
+                id, providerService, configserverHostname,
+                instanceHostname, createdAt, ipAddresses, identityType, null, null, serviceIdentity);
+
+        String signature =
+                signer.generateLegacySignature(identityDocument, keyPair.getPrivate());
+
+        var docWithoutIgnoredFields = new LegacySignedIdentityDocument(
+                signature, KEY_VERSION, LEGACY_DEFAULT_DOCUMENT_VERSION, withoutIgnoredFields);
+        var docWithIgnoredFields = new LegacySignedIdentityDocument(
+                signature, KEY_VERSION, LEGACY_DEFAULT_DOCUMENT_VERSION, identityDocument);
 
         assertTrue(signer.hasValidSignature(docWithoutIgnoredFields, keyPair.getPublic()));
         assertEquals(docWithIgnoredFields.signature(), docWithoutIgnoredFields.signature());
@@ -76,16 +101,15 @@ public class IdentityDocumentSignerTest {
     @Test
     void validates_signature_for_new_and_old_versions() {
         IdentityDocumentSigner signer = new IdentityDocumentSigner();
+        IdentityDocument identityDocument = new IdentityDocument(
+                id, providerService, configserverHostname,
+                instanceHostname, createdAt, ipAddresses, identityType, clusterType, ztsUrl, serviceIdentity);
         String signature =
-                signer.generateSignature(id, providerService, configserverHostname, instanceHostname, createdAt,
-                                         ipAddresses, identityType, keyPair.getPrivate(), serviceIdentity);
+                signer.generateLegacySignature(identityDocument, keyPair.getPrivate());
 
-        SignedIdentityDocument signedIdentityDocument = new SignedIdentityDocument(
-                signature, KEY_VERSION, id, providerService, DEFAULT_DOCUMENT_VERSION, configserverHostname,
-                instanceHostname, createdAt, ipAddresses, identityType, clusterType, ztsUrl, serviceIdentity);
+        SignedIdentityDocument signedIdentityDocument = new LegacySignedIdentityDocument(
+                signature, KEY_VERSION, LEGACY_DEFAULT_DOCUMENT_VERSION, identityDocument);
 
         assertTrue(signer.hasValidSignature(signedIdentityDocument, keyPair.getPublic()));
-
     }
-
 }
\ No newline at end of file