Return login expiration times from tyler auth response (#402)

Tyler already sends back an `ExpirationDateTime` in the auth response -
we just weren't passing it through.

Added a `LoginResult` record to carry both the tokens and expiry out of
TylerLogin, threaded it through `SecurityHub`, and surfaced it as a
separate expirationTimes field in `NewTokens` so clients can see it in
the response.

Updated `SecurityHubTest` to set the expiry on the mock and assert it
comes back correctly.

Author: rajeswari1301

proxyserver/src/main/java/edu/suffolk/litlab/efsp/db/model/NewTokens.java

@@ -11,38 +11,51 @@
 public class NewTokens {
 
   @JsonUnwrapped private final Map<String, String> tokens;
+  private final Map<String, String> expirationTimes;
 
   public NewTokens() {
     this.tokens = Map.of();
+    this.expirationTimes = Map.of();
   }
 
   public NewTokens(Map<String, String> tokens) {
     this.tokens = tokens;
+    this.expirationTimes = Map.of();
+  }
+
+  public NewTokens(Map<String, String> tokens, Map<String, String> expirationTimes) {
+    this.tokens = tokens;
+    this.expirationTimes = expirationTimes;
   }
 
   public Map<String, String> getTokens() {
     return tokens;
   }
 
+  public Map<String, String> getExpirationTimes() {
+    return expirationTimes;
+  }
+
   @Override
   public boolean equals(Object other) {
     if (other == null) {
       return false;
     }
     if (other instanceof NewTokens otherTokens) {
-      return tokens.equals(otherTokens.tokens);
+      return tokens.equals(otherTokens.tokens)
+          && expirationTimes.equals(otherTokens.expirationTimes);
     } else {
       return false;
     }
   }
 
   @Override
   public int hashCode() {
-    return tokens.hashCode();
+    return tokens.hashCode() * 31 + expirationTimes.hashCode();
   }
 
   @Override
   public String toString() {
-    return tokens.toString();
+    return "tokens=" + tokens + ", expirationTimes=" + expirationTimes;
   }
 }

proxyserver/src/main/java/edu/suffolk/litlab/efsp/server/auth/LoginInterface.java

@@ -1,12 +1,11 @@
 package edu.suffolk.litlab.efsp.server.auth;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import java.util.Map;
 import java.util.Optional;
 
 public interface LoginInterface {
 
-  Optional<Map<String, String>> login(JsonNode loginInfo);
+  Optional<LoginResult> login(JsonNode loginInfo);
 
   String getLoginName();
 

proxyserver/src/main/java/edu/suffolk/litlab/efsp/server/auth/LoginResult.java

@@ -0,0 +1,6 @@
+package edu.suffolk.litlab.efsp.server.auth;
+
+import java.util.Map;
+import java.util.Optional;
+
+public record LoginResult(Map<String, String> tokens, Optional<String> expirationDateTime) {}

proxyserver/src/main/java/edu/suffolk/litlab/efsp/server/auth/SecurityHub.java

@@ -31,7 +31,7 @@ public class SecurityHub {
   private static final Logger log = LoggerFactory.getLogger(SecurityHub.class);
 
   private final List<LoginInterface> tylerLoginObjs;
-  private final Map<String, Function<JsonNode, Optional<Map<String, String>>>> loginFunctions;
+  private final Map<String, Function<JsonNode, Optional<LoginResult>>> loginFunctions;
   private final Supplier<LoginDatabase> ldSupplier;
 
   /**
@@ -49,7 +49,10 @@ public SecurityHub(Supplier<LoginDatabase> ldSupplier, List<Jurisdiction> jurisd
     }
 
     this.loginFunctions = new HashMap<>();
-    this.loginFunctions.put("jeffnet", info -> Optional.of(Map.of("JEFFNET-TOKEN", "deprecated")));
+    this.loginFunctions.put(
+        "jeffnet",
+        info ->
+            Optional.of(new LoginResult(Map.of("JEFFNET-TOKEN", "deprecated"), Optional.empty())));
     this.loginFunctions.putAll(
         this.tylerLoginObjs.stream()
             .collect(Collectors.toMap(lo -> lo.getLoginName(), lo -> (info) -> lo.login(info))));
@@ -89,6 +92,7 @@ public Optional<NewTokens> login(String apiKey, JsonNode loginInfo) {
       return Optional.empty();
     }
     var newTokens = new HashMap<String, String>();
+    var expirationTimes = new HashMap<String, String>();
     Iterable<String> orgs = loginInfo::fieldNames;
     for (String orgName : orgs) {
       orgName = orgName.toLowerCase();
@@ -111,18 +115,20 @@ public Optional<NewTokens> login(String apiKey, JsonNode loginInfo) {
         log.error("There is no {} to login to: enabled map: {}", permissionsName, atRest.enabled);
         return Optional.empty();
       }
-      Optional<Map<String, String>> maybeNewTokens =
-          loginFunctions.get(orgName).apply(loginInfo.get(orgName));
-      if (maybeNewTokens.isEmpty()) {
+      Optional<LoginResult> maybeResult = loginFunctions.get(orgName).apply(loginInfo.get(orgName));
+      if (maybeResult.isEmpty()) {
         log.warn("Couldn't login to {}", orgName);
         return Optional.empty();
       }
       log.info("New tokens for {}", orgName);
-      newTokens.putAll(maybeNewTokens.get());
+      LoginResult result = maybeResult.get();
+      newTokens.putAll(result.tokens());
+      final String finalOrgName = orgName;
+      result.expirationDateTime().ifPresent(expiry -> expirationTimes.put(finalOrgName, expiry));
     }
     if (newTokens.isEmpty()) {
       log.warn("No successful logins occurred: returning empty tokens object");
     }
-    return Optional.of(new NewTokens(newTokens));
+    return Optional.of(new NewTokens(newTokens, expirationTimes));
   }
 }

proxyserver/src/main/java/edu/suffolk/litlab/efsp/server/auth/TylerLogin.java

@@ -35,7 +35,7 @@ public static String getHeaderKeyFromJurisdiction(Jurisdiction jurisdiction) {
   }
 
   @Override
-  public Optional<Map<String, String>> login(JsonNode loginInfo) {
+  public Optional<LoginResult> login(JsonNode loginInfo) {
     if (!loginInfo.isObject()
         || !loginInfo.has("username")
         || !loginInfo.get("username").isTextual()) {
@@ -65,12 +65,17 @@ public Optional<Map<String, String>> login(JsonNode loginInfo) {
               + authRes.getError().getErrorText());
       return Optional.empty();
     } else {
-      return Optional.of(
+      Map<String, String> tokens =
           Map.of(
               getHeaderKey(),
               authRes.getEmail() + ":" + authRes.getPasswordHash(),
               getHeaderId(jurisdiction),
-              authRes.getUserID()));
+              authRes.getUserID());
+      Optional<String> expirationDateTime =
+          authRes.getExpirationDateTime() != null
+              ? Optional.of(authRes.getExpirationDateTime().toString())
+              : Optional.empty();
+      return Optional.of(new LoginResult(tokens, expirationDateTime));
     }
   }
 

proxyserver/src/test/java/edu/suffolk/litlab/efsp/server/auth/SecurityHubTest.java

@@ -15,9 +15,11 @@
 import edu.suffolk.litlab.efsp.tyler.TylerClients;
 import edu.suffolk.litlab.efsp.tyler.TylerUserClient;
 import edu.suffolk.litlab.efsp.tyler.TylerUserFactory;
+import java.util.GregorianCalendar;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import javax.xml.datatype.DatatypeFactory;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
@@ -94,7 +96,7 @@ class TylerLoginTests {
     private ObjectNode loginNode;
 
     @BeforeEach
-    public void setup() {
+    public void setup() throws Exception {
       AtRest atRest = new AtRest();
       atRest.enabled = Map.of("tyler", true, "jeffnet", false);
       when(ld.getAtRestInfo(API_KEY)).thenReturn(Optional.of(atRest));
@@ -106,11 +108,16 @@ public void setup() {
       var error = new ErrorType();
       error.setErrorCode("0");
 
+      var expiry =
+          DatatypeFactory.newInstance()
+              .newXMLGregorianCalendar(new GregorianCalendar(2026, 11, 31, 23, 59, 59));
+
       var authResp = new AuthenticateResponseType();
       authResp.setEmail(EMAIL);
       authResp.setError(error);
       authResp.setUserID("abc123");
       authResp.setPasswordHash(PASSWORD_HASH);
+      authResp.setExpirationDateTime(expiry);
       when(tylerUserClient.authenticateUser(refEq(authReq))).thenReturn(authResp);
 
       tylerNode = mapper.createObjectNode();
@@ -140,6 +147,7 @@ public void testTylerLogin() throws Exception {
       assertThat(activeTyler).isPresent();
       assertThat(activeTyler.get().getTokens().get("TYLER-TOKEN-ILLINOIS"))
           .isEqualTo("bob@example.com:the_password_hash");
+      assertThat(activeTyler.get().getExpirationTimes()).containsKey("tyler-illinois");
       Optional<NewTokens> repeatLogin = hub.login(API_KEY, loginNode);
       assertThat(repeatLogin).isPresent();
       assertThat(activeTyler.get()).isEqualTo(repeatLogin.get());