[ID-1117] Add fence_account_key and distributed_lock tables to db

service/src/main/java/bio/terra/externalcreds/dataAccess/DistributedLockDAO.java

@@ -0,0 +1,80 @@
+package bio.terra.externalcreds.dataAccess;
+
+import bio.terra.externalcreds.models.DistributedLock;
+import io.opentelemetry.instrumentation.annotations.WithSpan;
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.dao.support.DataAccessUtils;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
+import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
+import org.springframework.stereotype.Repository;
+
+@Repository
+@Slf4j
+public class DistributedLockDAO {
+
+  private static final RowMapper<DistributedLock> DISTRIBUTED_LOCK_ROW_MAPPER =
+      ((rs, rowNum) ->
+          new DistributedLock.Builder()
+              .lockName(rs.getString("lock_name"))
+              .userId(rs.getString("user_id"))
+              .expiresAt(rs.getTimestamp("expires_at"))
+              .build());
+
+  final NamedParameterJdbcTemplate jdbcTemplate;
+
+  public DistributedLockDAO(NamedParameterJdbcTemplate jdbcTemplate) {
+    this.jdbcTemplate = jdbcTemplate;
+  }
+
+  /**
+   * @param lockName The name of the lock, e.g {provider}-createKey
+   * @param userId The Sam user id
+   * @return Optional<DistributedLock> An optional containing the distributed lock with this
+   *     lockName and userId (or empty)
+   */
+  @WithSpan
+  public Optional<DistributedLock> getDistributedLock(String lockName, String userId) {
+    var namedParameters =
+        new MapSqlParameterSource().addValue("lockName", lockName).addValue("userId", userId);
+    var query = "SELECT * FROM distributed_lock WHERE lock_name = :lockName AND user_id = :userId";
+    return Optional.ofNullable(
+        DataAccessUtils.singleResult(
+            jdbcTemplate.query(query, namedParameters, DISTRIBUTED_LOCK_ROW_MAPPER)));
+  }
+
+  /**
+   * @param distributedLock The DistributedLock to insert
+   * @return distributedLock The DistributedLock that was inserted
+   */
+  @WithSpan
+  public DistributedLock upsertDistributedLock(DistributedLock distributedLock) {
+    var query =
+        "INSERT INTO distributed_lock (lock_name, user_id, expires_at)"
+            + " VALUES (:lockName, :userId, :expiresAt)";
+
+    var namedParameters =
+        new MapSqlParameterSource()
+            .addValue("lockName", distributedLock.getLockName())
+            .addValue("userId", distributedLock.getUserId())
+            .addValue("expiresAt", distributedLock.getExpiresAt());
+
+    jdbcTemplate.update(query, namedParameters);
+    return distributedLock;
+  }
+
+  /**
+   * @param lockName The name of the lock, e.g {provider}-createKey
+   * @param userId The Sam user id
+   * @return boolean whether a distributed lock was found and deleted
+   */
+  @WithSpan
+  public boolean deleteDistributedLock(String lockName, String userId) {
+    var query = "DELETE FROM distributed_lock WHERE lock_name = :lockName AND user_id = :userId";
+    var namedParameters =
+        new MapSqlParameterSource().addValue("lockName", lockName).addValue("userId", userId);
+
+    return jdbcTemplate.update(query, namedParameters) > 0;
+  }
+}

service/src/main/java/bio/terra/externalcreds/dataAccess/FenceAccountKeyDAO.java

@@ -0,0 +1,87 @@
+package bio.terra.externalcreds.dataAccess;
+
+import bio.terra.externalcreds.models.FenceAccountKey;
+import io.opentelemetry.instrumentation.annotations.WithSpan;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.dao.support.DataAccessUtils;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
+import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
+import org.springframework.jdbc.support.GeneratedKeyHolder;
+import org.springframework.stereotype.Repository;
+
+@Repository
+@Slf4j
+public class FenceAccountKeyDAO {
+
+  private static final RowMapper<FenceAccountKey> FENCE_ACCOUNT_KEY_ROW_MAPPER =
+      ((rs, rowNum) ->
+          new FenceAccountKey.Builder()
+              .id(rs.getInt("id"))
+              .linkedAccountId(rs.getInt("linked_account_id"))
+              .keyJson(base64Decode(rs.getString("key_json")))
+              .expiresAt(rs.getTimestamp("expires_at"))
+              .build());
+
+  final NamedParameterJdbcTemplate jdbcTemplate;
+
+  public FenceAccountKeyDAO(NamedParameterJdbcTemplate jdbcTemplate) {
+    this.jdbcTemplate = jdbcTemplate;
+  }
+
+  @WithSpan
+  public Optional<FenceAccountKey> getFenceAccountKey(String userId, String providerName) {
+    var namedParameters =
+        new MapSqlParameterSource("userId", userId).addValue("providerName", providerName);
+    var query =
+        "SELECT p.* FROM fence_account_key p"
+            + " INNER JOIN linked_account la ON la.id = p.linked_account_id"
+            + " WHERE la.user_id = :userId"
+            + " AND la.provider_name = :providerName";
+    return Optional.ofNullable(
+        DataAccessUtils.singleResult(
+            jdbcTemplate.query(query, namedParameters, FENCE_ACCOUNT_KEY_ROW_MAPPER)));
+  }
+
+  @WithSpan
+  public FenceAccountKey insertFenceAccountKey(FenceAccountKey fenceAccountKey) {
+    var query =
+        "INSERT INTO fence_account_key (linked_account_id, key_json, expires_at)"
+            + " VALUES (:linkedAccountId, :keyJson, :expiresAt)"
+            + " RETURNING id";
+
+    var namedParameters =
+        new MapSqlParameterSource()
+            .addValue("linkedAccountId", fenceAccountKey.getLinkedAccountId())
+            .addValue("keyJson", base64Encode(fenceAccountKey.getKeyJson()))
+            .addValue("expiresAt", fenceAccountKey.getExpiresAt());
+
+    // generatedKeyHolder will hold the id returned by the query as specified by the RETURNING
+    // clause
+    var generatedKeyHolder = new GeneratedKeyHolder();
+    jdbcTemplate.update(query, namedParameters, generatedKeyHolder);
+
+    return fenceAccountKey.withId(Objects.requireNonNull(generatedKeyHolder.getKey()).intValue());
+  }
+
+  /**
+   * @param linkedAccountId id of the linked account
+   * @return boolean whether a fence account key was deleted
+   */
+  @WithSpan
+  public boolean deleteFenceAccountKey(int linkedAccountId) {
+    var namedParameters = new MapSqlParameterSource("linkedAccountId", linkedAccountId);
+    var query = "DELETE FROM fence_account_key WHERE linked_account_id = :linkedAccountId";
+    return jdbcTemplate.update(query, namedParameters) > 0;
+  }
+
+  private static String base64Encode(String keyJson) {
+    return Base64.getEncoder().encodeToString(keyJson.getBytes(StandardCharsets.UTF_8));
+  }
+
+  private static String base64Decode(String encodedKeyJson) {
+    return new String(Base64.getDecoder().decode(encodedKeyJson), StandardCharsets.UTF_8);
+  }
+}

service/src/main/java/bio/terra/externalcreds/models/DistributedLock.java

@@ -0,0 +1,15 @@
+package bio.terra.externalcreds.models;
+
+import java.sql.Timestamp;
+import org.immutables.value.Value;
+
+@Value.Immutable
+public interface DistributedLock extends WithDistributedLock {
+  String getLockName();
+
+  String getUserId();
+
+  Timestamp getExpiresAt();
+
+  class Builder extends ImmutableDistributedLock.Builder {}
+}

service/src/main/java/bio/terra/externalcreds/models/FenceAccountKey.java

@@ -0,0 +1,18 @@
+package bio.terra.externalcreds.models;
+
+import java.sql.Timestamp;
+import java.util.Optional;
+import org.immutables.value.Value;
+
+@Value.Immutable
+public interface FenceAccountKey extends WithFenceAccountKey {
+  Optional<Integer> getId();
+
+  Integer getLinkedAccountId();
+
+  String getKeyJson();
+
+  Timestamp getExpiresAt();
+
+  class Builder extends ImmutableFenceAccountKey.Builder {}
+}

service/src/main/resources/db/changelog/changesets/20240228_add_fence_account_key_and_dist_lock_table.yaml

@@ -0,0 +1,52 @@
+databaseChangeLog:
+  - changeSet:
+      id: "add_fence_account_key_and_dist_lock_table"
+      author: sehsan
+      changes:
+        - createTable:
+            tableName: fence_account_key
+            columns:
+              - column:
+                  name: id
+                  type: int
+                  autoIncrement: true
+                  constraints:
+                    primaryKey: true
+                    nullable: false
+              - column:
+                  name: linked_account_id
+                  type: int
+                  constraints:
+                    nullable: false
+                    references: linked_account(id)
+                    foreignKeyName: fk_linked_account_id
+              - column:
+                  name: key_json
+                  type: text
+                  constraints:
+                    nullable: false
+              - column:
+                  name: expires_at
+                  type: timestamp
+                  constraints:
+                    nullable: false
+        - createTable:
+            tableName: distributed_lock
+            columns:
+              - column:
+                  name: lock_name
+                  type: text
+                  constraints:
+                    primaryKey: true
+                    primaryKeyName: pk_dist_lock
+              - column:
+                  name: user_id
+                  type: text
+                  constraints:
+                    primaryKey: true
+                    primaryKeyName: pk_dist_lock
+              - column:
+                  name: expires_at
+                  type: timestamp
+                  constraints:
+                    nullable: false

service/src/main/resources/db/changelog/db.changelog-master.yaml

@@ -29,3 +29,6 @@ databaseChangeLog:
   - include:
       file: changesets/20220412_add_last_encrypt_timestamp_to_ssh_key_pair_table.yaml
       relativeToChangelogFile: true
+  - include:
+      file: changesets/20240228_add_fence_account_key_and_dist_lock_table.yaml
+      relativeToChangelogFile: true

service/src/test/java/bio/terra/externalcreds/TestUtils.java

@@ -2,6 +2,7 @@
 
 import bio.terra.externalcreds.config.ProviderProperties;
 import bio.terra.externalcreds.generated.model.Provider;
+import bio.terra.externalcreds.models.FenceAccountKey;
 import bio.terra.externalcreds.models.GA4GHPassport;
 import bio.terra.externalcreds.models.GA4GHVisa;
 import bio.terra.externalcreds.models.LinkedAccount;
@@ -56,6 +57,14 @@ public static GA4GHVisa createRandomVisa() {
         .build();
   }
 
+  public static FenceAccountKey createRandomFenceAccountKey() {
+    return new FenceAccountKey.Builder()
+        .linkedAccountId(1)
+        .keyJson(UUID.randomUUID().toString())
+        .expiresAt(getRandomTimestamp())
+        .build();
+  }
+
   public static ProviderProperties createRandomProvider() {
     try {
       return ProviderProperties.create()

service/src/test/java/bio/terra/externalcreds/dataAccess/DistributedLockDAOTest.java

@@ -0,0 +1,64 @@
+package bio.terra.externalcreds.dataAccess;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import bio.terra.externalcreds.BaseTest;
+import bio.terra.externalcreds.TestUtils;
+import bio.terra.externalcreds.models.DistributedLock;
+import java.util.Optional;
+import java.util.UUID;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+class DistributedLockDAOTest extends BaseTest {
+
+  @Autowired private DistributedLockDAO distributedLockDAO;
+  private final String testLockName = "provider-createKey";
+  private final DistributedLock testDistributedLock =
+      new DistributedLock.Builder()
+          .lockName(testLockName)
+          .userId(UUID.randomUUID().toString())
+          .expiresAt(TestUtils.getRandomTimestamp())
+          .build();
+
+  @Test
+  void testGetMissingDistributedLock() {
+    var shouldBeEmpty = distributedLockDAO.getDistributedLock(testLockName, "nonexistent_user_id");
+    assertEmpty(shouldBeEmpty);
+  }
+
+  @Nested
+  class CreateDistributedLock {
+
+    @Test
+    void testCreateAndGetDistributedLock() {
+      DistributedLock savedLock = distributedLockDAO.upsertDistributedLock(testDistributedLock);
+      assertEquals(testDistributedLock, savedLock);
+      var loadedDistributedLock =
+          distributedLockDAO.getDistributedLock(savedLock.getLockName(), savedLock.getUserId());
+      assertEquals(Optional.of(savedLock), loadedDistributedLock);
+    }
+  }
+
+  @Nested
+  class DeleteDistributedLock {
+
+    @Test
+    void testDeleteDistributedLock() {
+      DistributedLock savedLock = distributedLockDAO.upsertDistributedLock(testDistributedLock);
+      assertPresent(
+          distributedLockDAO.getDistributedLock(savedLock.getLockName(), savedLock.getUserId()));
+      assertTrue(
+          distributedLockDAO.deleteDistributedLock(savedLock.getLockName(), savedLock.getUserId()));
+      assertEmpty(
+          distributedLockDAO.getDistributedLock(savedLock.getLockName(), savedLock.getUserId()));
+    }
+
+    @Test
+    void testDeleteNonexistentDistributedLock() {
+
+      assertFalse(distributedLockDAO.deleteDistributedLock(testLockName, "nonexistent_user_id"));
+    }
+  }
+}