Package com.axelor.auth

Class UserTokenService

java.lang.Object

com.axelor.auth.UserTokenService

public class UserTokenService
extends Object

Service for managing API tokens for user authentication.

This service provides functionality to generate, rotate, and revoke API keys that are used for authenticating users via the API key authentication mechanism.

Key features of this service:

• Generates cryptographically secure random strings for keys and tokens
• Ensures uniqueness of generated keys and tokens
• Manages the lifecycle of user tokens (creation, rotation, revocation)

The service uses SecureRandom for generating random strings and AuthService for encrypting tokens before storage.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	TOKEN_KEY_LENGTH

Constructor Summary

Constructors

Constructor	Description
UserTokenService(UserTokenRepository userTokenRepository, UserRepository userRepository)

Method Summary

Modifier and Type	Method	Description
UserToken	createUserToken(String name, LocalDateTime expiresAt, String allowedIps, User owner)	Creates an API key.
protected String	generateRandomString(int length)
List<Map<String,Object>>	getTokenData(User user)
void	revokeUserToken(UserToken userToken)
UserToken	rotateUserToken(UserToken userToken)
protected UserToken	saveUserToken(UserToken ut)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

TOKEN_KEY_LENGTH

public static final int TOKEN_KEY_LENGTH

See Also:

• Constant Field Values

Constructor Details

UserTokenService

@Inject
public UserTokenService(UserTokenRepository userTokenRepository,
 UserRepository userRepository)

Method Details

createUserToken

public UserToken createUserToken(String name,
 LocalDateTime expiresAt,
 String allowedIps,
 User owner)

Creates an API key.

Parameters:

name - the name of the API key

expiresAt - the expiration date

allowedIps - comma-separated IP addresses or CIDR ranges allowed to use the API key, or null to allow any address

owner - the user authenticated by the API key

Returns:

the API key, with UserToken.getApiKey() set

Throws:

IllegalArgumentException - if any allowed IP is not a valid IP address or CIDR range

saveUserToken

protected UserToken saveUserToken(UserToken ut)

rotateUserToken

public UserToken rotateUserToken(UserToken userToken)

revokeUserToken

public void revokeUserToken(UserToken userToken)

generateRandomString

protected String generateRandomString(int length)

getTokenData

public List<Map<String,Object>> getTokenData(User user)