Papati/add websocket auth

CallAutomation_Live_Transcription/pom.xml

@@ -135,6 +135,27 @@
             <artifactId>json</artifactId>
             <version>20231013</version>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt</artifactId>
+            <version>0.9.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-jose</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-resource-server</artifactId>
+        </dependency>
     </dependencies>
     <build>
         <pluginManagement>
@@ -187,7 +208,6 @@
         </pluginManagement>
     </build>
 
-
 <profiles>
         <!-- Profile to run the main Spring Boot application -->
         <profile>

CallAutomation_Live_Transcription/src/main/java/com/communication/callautomation/SecurityConfig.java

@@ -0,0 +1,60 @@
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+public class SecurityConfig {
+
+    @Value("ACS resource ID")
+    private String audience;
+
+    @Value("https://acscallautomation.communication.azure.com")
+    private String issuer;
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        http
+            .csrf().disable()
+            .authorizeHttpRequests()
+            .requestMatchers("/ws/**").permitAll() // WebSocket handshake is handled separately
+            .anyRequest()
+            .and()
+            .oauth2ResourceServer()
+            .jwt()
+            .decoder(jwtDecoder());
+
+        return http.build();
+    }
+
+    class AudienceValidator implements OAuth2TokenValidator<Jwt> {
+        private String audience;
+
+        OAuth2Error error = new OAuth2Error("invalid_token", "The required audience is missing", null);
+
+        public AudienceValidator(String audience) {
+            this.audience = audience;
+        }
+
+        @Override
+        public OAuth2TokenValidatorResult validate(Jwt token) {
+            if (token.getAudience().contains(audience)) {
+                return OAuth2TokenValidatorResult.success();
+            } else {
+                return OAuth2TokenValidatorResult.failure(error);
+            }
+        }
+    }
+
+    JwtDecoder jwtDecoder() 
+    { 
+        OAuth2TokenValidator<Jwt> withAudience = new AudienceValidator(audience);         
+        OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuer);        
+         OAuth2TokenValidator<Jwt> validator = new DelegatingOAuth2TokenValidator<>(withAudience, withIssuer);         
+         NimbusJwtDecoder jwtDecoder = (NimbusJwtDecoder) JwtDecoders.fromOidcIssuerLocation(issuer);         
+         jwtDecoder.setJwtValidator(validator);         
+
+         return jwtDecoder;     
+    }
+
+}