SDK-2771: Add new maven module for supporting the creation of Yoti au… #505

MrBurtyyy · 2025-12-11T12:29:20Z

…thentication tokens via API

pn-santos

I'm not that familiar with the current practices in the SDK nor any stylistic conventions in place so apologies in advance if any of the comments are out-of-sync with how stuff is done in the SDKs.

Also, given I'm not really involved with the SDKs don't take the comments as blockers. I'm not going to explicitly approve, I'll leave that to someone more attuned to the SDK code base to take that responsibility, but I don't see anything functional that would be a reason to hold it up.

pn-santos · 2025-12-15T13:05:09Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+    public CreateAuthenticationTokenResponse generate(List<String> scopes) throws ResourceException, IOException {
+        String jwts = signedJwtGenerator.create(sdkId, keyPair, jwtIdSupplier, authApiUrl);
+
+        Map<String, String> formParams = new HashMap<>(DEFAULT_FORM_VALUES);


Is it really worth having a constant for DEFAULT_FORM_VALUES? It's only used here, why not inline the put here?

formParams.put("scope", String.join(" ", scopes)); formParams.put("client_assertion", jwts); formParams.put("grant_type", "client_credentials"); formParams.put("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");

it's one less map instance to keep/copy and initialise on startup.

pn-santos · 2025-12-15T13:07:44Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+    private final SignedJwtGenerator signedJwtGenerator;
+
+    private final String authApiUrl;
+    private final ObjectMapper objectMapper;


Why is the ObjectMapper being injected/exposed?

The CreateAuthenticationTokenResponse is defined by this module, shouldn't the ObjectMapper (and it's config) also be owned/defined by this module? What would be the point of the client providing their own instance config if they do not control the annotations/layout of CreateAuthenticationTokenResponse?

We don't expose the ObjectMapper to the Relying Business, but it's done this way (and in other places in the SDK) to make testing with mocks easier in the AuthenticationTokenGenerator

pn-santos · 2025-12-15T13:08:39Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+    private final FormRequestClient formRequestClient;
+    private final SignedJwtGenerator signedJwtGenerator;
+
+    private final String authApiUrl;


Wouldn't this be better as a URI or URL type?

pn-santos · 2025-12-15T13:11:48Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+            ObjectMapper objectMapper = new ObjectMapper()
+                    .setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE)
+                    .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);


If we do not expose the ObjectMapper then there's no point in making it an instance var. It should be declared as a static final var of AuthenticationTokenGenerator

pn-santos · 2025-12-15T13:44:28Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+                    .setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE)
+                    .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+            return new AuthenticationTokenGenerator(sdkId, loadKeyPair(keyPairSource), jwtIdSupplier, new FormRequestClient(), new SignedJwtGenerator(), objectMapper);


I'm not all that familiar with the current conventions in this project, but I feel like with this many arguments this would be a bit more readable with one arg per line:

Suggested change

return new AuthenticationTokenGenerator(sdkId, loadKeyPair(keyPairSource), jwtIdSupplier, new FormRequestClient(), new SignedJwtGenerator(), objectMapper);

return new AuthenticationTokenGenerator(

sdkId,

loadKeyPair(keyPairSource),

jwtIdSupplier,

new FormRequestClient(),

new SignedJwtGenerator(),

objectMapper

);

pn-santos · 2025-12-15T14:12:20Z

yoti-sdk-auth/src/main/java/com/yoti/auth/FormRequestClient.java

+        String urlParams = getDataString(formParams);
+
+        byte[] postData = urlParams.getBytes(StandardCharsets.UTF_8);


Why return String and then do getBytes(...) rather than simply return byte[] from the get go? urlParams doesn't seem to be used anywhere else and what this (method) seems to need is the byte[] not String

pn-santos · 2025-12-15T14:24:32Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+        String responseBody = formRequestClient.performRequest(authApiUrl, "POST", formParams);
+
+        return objectMapper.readValue(responseBody, CreateAuthenticationTokenResponse.class);


If all we are doing is de-serializing the response, why return String instead of the raw byte[]?

This ends up creating String instances from byte[] just to immediately convert them to a POJO instance. We could go directly from byte[] to POJO.

pn-santos · 2025-12-15T14:28:06Z

yoti-sdk-auth/src/main/java/com/yoti/auth/FormRequestClient.java

+            return scanner.get().hasNext() ? scanner.get().next() : "";
+        }
+    }
+
+    private static Scanner createScanner(InputStream inputStream) {
+        return new Scanner(inputStream, DEFAULT_CHARSET).useDelimiter("\\A");
+    }
+
+    private byte[] readBody(HttpURLConnection httpURLConnection) throws IOException {
+        try (QuietCloseable<InputStream> inputStream = new QuietCloseable<>(httpURLConnection.getInputStream())) {
+            return readChunked(inputStream.get());
+        }
+    }
+
+    private byte[] readChunked(InputStream inputStream) throws IOException {
+        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+        byte[] byteChunk = new byte[4096];
+        int n;
+        while ((n = inputStream.read(byteChunk)) > 0) {
+            byteArrayOutputStream.write(byteChunk, 0, n);
+        }
+        return byteArrayOutputStream.toByteArray();


Why the difference in strategy for reading error payloads and non-error payloads?

This was taken from one of our other (old) components from the regular SDK module. I have fixed it 👍

pn-santos · 2025-12-15T14:34:05Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+        this.signedJwtGenerator = signedJwtGenerator;
+        this.objectMapper = objectMapper;
+
+        authApiUrl = System.getProperty(Properties.PROPERTY_YOTI_AUTH_URL, Properties.DEFAULT_YOTI_AUTH_URL);


This class is the sole user of this Properties class... why not simply declare those values as constants here? i.e.

private static final String YOTI_AUTH_URL_KEY = "yoti.auth.url"; (...) authApiUrl = System.getProperty(YOTI_AUTH_URL_KEY, "https://auth.api.yoti.com/v1/oauth/token");

and get rid of Properties altogether?

We have public properties in here, so the YOTI_AUTH_URL_KEY property can be accessed if we want to override the URL without knowing the actual key needed (like we do in the other modules).

Not sure if we want to change this, @bucky-boy what do you think?

pn-santos · 2025-12-15T14:36:20Z

yoti-sdk-auth/src/main/java/com/yoti/auth/SignedJwtGenerator.java

+final class SignedJwtGenerator {
+
+    String create(String sdkId, KeyPair keyPair, Supplier<String> jwtIdSupplier, String authApiUrl) {


Seems kinda pointless to have a class that doesn't implement an interface, doesn't have instance member variables, and has a single method that is used in one place. Why not simply inline the method where it's used as a private method?

Fixed 👍 (this was originally done to make mocking easier, but I have since found we have utility libraries to help us create actual KeyPairs)

irotech · 2025-12-15T15:55:12Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+        String jwts = signedJwtGenerator.create(sdkId, keyPair, jwtIdSupplier, authApiUrl);
+
+        Map<String, String> formParams = new HashMap<>(DEFAULT_FORM_VALUES);
+        formParams.put("scope", String.join(" ", scopes));


Should this list be checked for null or empty string?

irotech · 2025-12-15T16:22:08Z

yoti-sdk-auth/src/main/java/com/yoti/auth/AuthenticationTokenGenerator.java

+     * @throws IOException
+     */
+    public CreateAuthenticationTokenResponse generate(List<String> scopes) throws ResourceException, IOException {
+        String jwts = signedJwtGenerator.create(sdkId, keyPair, jwtIdSupplier, authApiUrl);


can't this be inlined?

sonarqubecloud · 2025-12-16T12:14:00Z

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
47.0% Coverage on New Code
2.1% Duplication on New Code

See analysis details on SonarQube Cloud

MrBurtyyy requested review from bucky-boy, irotech and pn-santos December 11, 2025 12:32

MrBurtyyy force-pushed the SDK-2771 branch from a5ca3bf to 9d1586b Compare December 11, 2025 12:48

SDK-2771: Add new maven module for supporting the creation of Yoti au…

d994ecd

…thentication tokens via API

MrBurtyyy force-pushed the SDK-2771 branch from 9d1586b to d994ecd Compare December 11, 2025 13:58

bucky-boy approved these changes Dec 11, 2025

View reviewed changes

pn-santos reviewed Dec 15, 2025

View reviewed changes

irotech reviewed Dec 15, 2025

View reviewed changes

SDK-2771: Review comments

9a2856f

MrBurtyyy requested review from irotech and pn-santos December 16, 2025 12:16

		String urlParams = getDataString(formParams);

		byte[] postData = urlParams.getBytes(StandardCharsets.UTF_8);

		String responseBody = formRequestClient.performRequest(authApiUrl, "POST", formParams);

		return objectMapper.readValue(responseBody, CreateAuthenticationTokenResponse.class);

		final class SignedJwtGenerator {

		String create(String sdkId, KeyPair keyPair, Supplier<String> jwtIdSupplier, String authApiUrl) {

SDK-2771: Add new maven module for supporting the creation of Yoti au… #505

Are you sure you want to change the base?

SDK-2771: Add new maven module for supporting the creation of Yoti au… #505

Conversation

MrBurtyyy commented Dec 11, 2025

Uh oh!

pn-santos left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pn-santos Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MrBurtyyy Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Dec 16, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

pn-santos Dec 15, 2025 •

edited

Loading

MrBurtyyy Dec 16, 2025 •

edited

Loading