Add /v1/accounts and /v2/keys to the WebSocket

service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java

@@ -7,12 +7,10 @@ package org.whispersystems.textsecuregcm;
 import static com.codahale.metrics.MetricRegistry.name;
 import static java.util.Objects.requireNonNull;
 
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Lists;
+import io.dropwizard.auth.AuthDynamicFeature;
 import io.dropwizard.auth.AuthFilter;
-import io.dropwizard.auth.PolymorphicAuthDynamicFeature;
-import io.dropwizard.auth.PolymorphicAuthValueFactoryProvider;
+import io.dropwizard.auth.AuthValueFactoryProvider;
 import io.dropwizard.auth.basic.BasicCredentialAuthFilter;
 import io.dropwizard.auth.basic.BasicCredentials;
 import io.dropwizard.core.Application;
@@ -61,10 +59,7 @@ import org.whispersystems.textsecuregcm.attachments.GcsAttachmentGenerator;
 import org.whispersystems.textsecuregcm.attachments.TusAttachmentGenerator;
 import org.whispersystems.textsecuregcm.auth.AccountAuthenticator;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
-import org.whispersystems.textsecuregcm.auth.BaseAccountAuthenticator;
 import org.whispersystems.textsecuregcm.auth.CertificateGenerator;
-import org.whispersystems.textsecuregcm.auth.DisabledPermittedAccountAuthenticator;
-import org.whispersystems.textsecuregcm.auth.DisabledPermittedAuthenticatedAccount;
 import org.whispersystems.textsecuregcm.auth.ExternalServiceCredentialsGenerator;
 import org.whispersystems.textsecuregcm.auth.PhoneVerificationTokenManager;
 import org.whispersystems.textsecuregcm.auth.RegistrationLockVerificationManager;
@@ -580,8 +575,6 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
     reportMessageManager.addListener(reportedMessageMetricsListener);
 
     final AccountAuthenticator accountAuthenticator = new AccountAuthenticator(accountsManager);
-    final DisabledPermittedAccountAuthenticator disabledPermittedAccountAuthenticator = new DisabledPermittedAccountAuthenticator(
-        accountsManager);
 
     final MessageSender messageSender = new MessageSender(clientPresenceManager, messagesManager,
         pushNotificationManager,
@@ -686,13 +679,8 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
         config.getClientCdn().getAttachmentUrls(),
         clock);
 
-    AuthFilter<BasicCredentials, AuthenticatedAccount> accountAuthFilter = new BasicCredentialAuthFilter.Builder<AuthenticatedAccount>().setAuthenticator(
-        accountAuthenticator).buildAuthFilter();
-    AuthFilter<BasicCredentials, DisabledPermittedAuthenticatedAccount> disabledPermittedAccountAuthFilter = new BasicCredentialAuthFilter.Builder<DisabledPermittedAuthenticatedAccount>().setAuthenticator(
-        disabledPermittedAccountAuthenticator).buildAuthFilter();
-
     final BasicCredentialAuthenticationInterceptor basicCredentialAuthenticationInterceptor =
-        new BasicCredentialAuthenticationInterceptor(new BaseAccountAuthenticator(accountsManager));
+        new BasicCredentialAuthenticationInterceptor(new AccountAuthenticator(accountsManager));
 
     final ServerBuilder<?> grpcServer = ServerBuilder.forPort(config.getGrpcPort())
         .addService(ServerInterceptors.intercept(new AccountsGrpcService(accountsManager, rateLimiters, usernameHashZkProofVerifier, registrationRecoveryPasswordsManager), basicCredentialAuthenticationInterceptor))
@@ -724,14 +712,16 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
 
     environment.lifecycle().manage(new GrpcServerManagedWrapper(grpcServer.build()));
 
+    final AuthFilter<BasicCredentials, AuthenticatedAccount> accountAuthFilter =
+        new BasicCredentialAuthFilter.Builder<AuthenticatedAccount>()
+            .setAuthenticator(accountAuthenticator)
+            .buildAuthFilter();
+
     environment.jersey().register(new RequestStatisticsFilter(TrafficSource.HTTP));
     environment.jersey().register(MultiRecipientMessageProvider.class);
     environment.jersey().register(new MetricsApplicationEventListener(TrafficSource.HTTP, clientReleaseManager));
-    environment.jersey()
-        .register(new PolymorphicAuthDynamicFeature<>(ImmutableMap.of(AuthenticatedAccount.class, accountAuthFilter,
-            DisabledPermittedAuthenticatedAccount.class, disabledPermittedAccountAuthFilter)));
-    environment.jersey().register(new PolymorphicAuthValueFactoryProvider.Binder<>(
-        ImmutableSet.of(AuthenticatedAccount.class, DisabledPermittedAuthenticatedAccount.class)));
+    environment.jersey().register(new AuthDynamicFeature(accountAuthFilter));
+    environment.jersey().register(new AuthValueFactoryProvider.Binder<>(AuthenticatedAccount.class));
     environment.jersey().register(new WebsocketRefreshApplicationEventListener(accountsManager, clientPresenceManager));
     environment.jersey().register(new TimestampResponseFilter());
 
@@ -749,14 +739,6 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
     webSocketEnvironment.jersey().register(new MetricsApplicationEventListener(TrafficSource.WEBSOCKET, clientReleaseManager));
     webSocketEnvironment.jersey().register(new KeepAliveController(clientPresenceManager));
 
-    // these should be common, but use @Auth DisabledPermittedAccount, which isn’t supported yet on websocket
-    environment.jersey().register(
-        new AccountController(accountsManager, rateLimiters,
-            turnTokenGenerator,
-            registrationRecoveryPasswordsManager, usernameHashZkProofVerifier));
-
-    environment.jersey().register(new KeysController(rateLimiters, keysManager, accountsManager));
-
     boolean registeredSpamFilter = false;
     ReportSpamTokenProvider reportSpamTokenProvider = null;
 
@@ -804,6 +786,8 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
     }
 
     final List<Object> commonControllers = Lists.newArrayList(
+        new AccountController(accountsManager, rateLimiters, turnTokenGenerator, registrationRecoveryPasswordsManager,
+            usernameHashZkProofVerifier),
         new AccountControllerV2(accountsManager, changeNumberManager, phoneVerificationTokenManager,
             registrationLockVerificationManager, rateLimiters),
         new ArtController(rateLimiters, artCredentialsGenerator),
@@ -824,6 +808,7 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
         new DirectoryV2Controller(directoryV2CredentialsGenerator),
         new DonationController(clock, zkReceiptOperations, redeemedReceiptsManager, accountsManager, config.getBadges(),
             ReceiptCredentialPresentation::new),
+        new KeysController(rateLimiters, keysManager, accountsManager),
         new MessageController(rateLimiters, messageByteLimitCardinalityEstimator, messageSender, receiptSender,
             accountsManager, messagesManager, pushNotificationManager, reportMessageManager,
             multiRecipientMessageExecutor, messageDeliveryScheduler, reportSpamTokenProvider, clientReleaseManager,

service/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java

@@ -1,25 +1,155 @@
 /*
- * Copyright 2013-2021 Signal Messenger, LLC
+ * Copyright 2013 Signal Messenger, LLC
  * SPDX-License-Identifier: AGPL-3.0-only
  */
+
 package org.whispersystems.textsecuregcm.auth;
 
+import static com.codahale.metrics.MetricRegistry.name;
+
+import com.google.common.annotations.VisibleForTesting;
 import io.dropwizard.auth.Authenticator;
 import io.dropwizard.auth.basic.BasicCredentials;
+import io.micrometer.core.instrument.Metrics;
+import io.micrometer.core.instrument.Tags;
+import java.time.Clock;
+import java.time.Duration;
+import java.time.temporal.ChronoUnit;
 import java.util.Optional;
-import org.whispersystems.textsecuregcm.experiment.ExperimentEnrollmentManager;
+import java.util.UUID;
+import org.apache.commons.lang3.StringUtils;
+import org.whispersystems.textsecuregcm.storage.Account;
 import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.storage.RefreshingAccountAndDeviceSupplier;
+import org.whispersystems.textsecuregcm.util.Pair;
+import org.whispersystems.textsecuregcm.util.Util;
 
-public class AccountAuthenticator extends BaseAccountAuthenticator implements
-    Authenticator<BasicCredentials, AuthenticatedAccount> {
+public class AccountAuthenticator implements Authenticator<BasicCredentials, AuthenticatedAccount> {
+
+  private static final String LEGACY_NAME_PREFIX = "org.whispersystems.textsecuregcm.auth.BaseAccountAuthenticator";
+
+  private static final String AUTHENTICATION_COUNTER_NAME = name(LEGACY_NAME_PREFIX, "authentication");
+  private static final String AUTHENTICATION_SUCCEEDED_TAG_NAME = "succeeded";
+  private static final String AUTHENTICATION_FAILURE_REASON_TAG_NAME = "reason";
+
+  private static final String DAYS_SINCE_LAST_SEEN_DISTRIBUTION_NAME = name(LEGACY_NAME_PREFIX, "daysSinceLastSeen");
+  private static final String IS_PRIMARY_DEVICE_TAG = "isPrimary";
+
+  @VisibleForTesting
+  static final char DEVICE_ID_SEPARATOR = '.';
+
+  private final AccountsManager accountsManager;
+  private final Clock clock;
 
   public AccountAuthenticator(AccountsManager accountsManager) {
-    super(accountsManager);
+    this(accountsManager, Clock.systemUTC());
+  }
+
+  @VisibleForTesting
+  public AccountAuthenticator(AccountsManager accountsManager, Clock clock) {
+    this.accountsManager = accountsManager;
+    this.clock = clock;
+  }
+
+  static Pair<String, Byte> getIdentifierAndDeviceId(final String basicUsername) {
+    final String identifier;
+    final byte deviceId;
+
+    final int deviceIdSeparatorIndex = basicUsername.indexOf(DEVICE_ID_SEPARATOR);
+
+    if (deviceIdSeparatorIndex == -1) {
+      identifier = basicUsername;
+      deviceId = Device.PRIMARY_ID;
+    } else {
+      identifier = basicUsername.substring(0, deviceIdSeparatorIndex);
+      deviceId = Byte.parseByte(basicUsername.substring(deviceIdSeparatorIndex + 1));
+    }
+
+    return new Pair<>(identifier, deviceId);
   }
 
   @Override
   public Optional<AuthenticatedAccount> authenticate(BasicCredentials basicCredentials) {
-    return super.authenticate(basicCredentials, true);
+    boolean succeeded = false;
+    String failureReason = null;
+
+    try {
+      final UUID accountUuid;
+      final byte deviceId;
+      {
+        final Pair<String, Byte> identifierAndDeviceId = getIdentifierAndDeviceId(basicCredentials.getUsername());
+
+        accountUuid = UUID.fromString(identifierAndDeviceId.first());
+        deviceId = identifierAndDeviceId.second();
+      }
+
+      Optional<Account> account = accountsManager.getByAccountIdentifier(accountUuid);
+
+      if (account.isEmpty()) {
+        failureReason = "noSuchAccount";
+        return Optional.empty();
+      }
+
+      Optional<Device> device = account.get().getDevice(deviceId);
+
+      if (device.isEmpty()) {
+        failureReason = "noSuchDevice";
+        return Optional.empty();
+      }
+
+      SaltedTokenHash deviceSaltedTokenHash = device.get().getAuthTokenHash();
+      if (deviceSaltedTokenHash.verify(basicCredentials.getPassword())) {
+        succeeded = true;
+        Account authenticatedAccount = updateLastSeen(account.get(), device.get());
+        if (deviceSaltedTokenHash.getVersion() != SaltedTokenHash.CURRENT_VERSION) {
+          authenticatedAccount = accountsManager.updateDeviceAuthentication(
+              authenticatedAccount,
+              device.get(),
+              SaltedTokenHash.generateFor(basicCredentials.getPassword()));  // new credentials have current version
+        }
+        return Optional.of(new AuthenticatedAccount(
+            new RefreshingAccountAndDeviceSupplier(authenticatedAccount, device.get().getId(), accountsManager)));
+      }
+
+      return Optional.empty();
+    } catch (IllegalArgumentException | InvalidAuthorizationHeaderException iae) {
+      failureReason = "invalidHeader";
+      return Optional.empty();
+    } finally {
+      Tags tags = Tags.of(
+          AUTHENTICATION_SUCCEEDED_TAG_NAME, String.valueOf(succeeded));
+
+      if (StringUtils.isNotBlank(failureReason)) {
+        tags = tags.and(AUTHENTICATION_FAILURE_REASON_TAG_NAME, failureReason);
+      }
+
+      Metrics.counter(AUTHENTICATION_COUNTER_NAME, tags).increment();
+    }
   }
 
+  @VisibleForTesting
+  public Account updateLastSeen(Account account, Device device) {
+    // compute a non-negative integer between 0 and 86400.
+    long n = Util.ensureNonNegativeLong(account.getUuid().getLeastSignificantBits());
+    final long lastSeenOffsetSeconds = n % ChronoUnit.DAYS.getDuration().toSeconds();
+
+    // produce a truncated timestamp which is either today at UTC midnight
+    // or yesterday at UTC midnight, based on per-user randomized offset used.
+    final long todayInMillisWithOffset = Util.todayInMillisGivenOffsetFromNow(clock,
+        Duration.ofSeconds(lastSeenOffsetSeconds).negated());
+
+    // only update the device's last seen time when it falls behind the truncated timestamp.
+    // this ensures a few things:
+    //   (1) each account will only update last-seen at most once per day
+    //   (2) these updates will occur throughout the day rather than all occurring at UTC midnight.
+    if (device.getLastSeen() < todayInMillisWithOffset) {
+      Metrics.summary(DAYS_SINCE_LAST_SEEN_DISTRIBUTION_NAME, IS_PRIMARY_DEVICE_TAG, String.valueOf(device.isPrimary()))
+          .record(Duration.ofMillis(todayInMillisWithOffset - device.getLastSeen()).toDays());
+
+      return accountsManager.updateDeviceLastSeen(account, device, Util.todayInMillis(clock));
+    }
+
+    return account;
+  }
 }

service/src/main/java/org/whispersystems/textsecuregcm/auth/AuthEnablementRefreshRequirementProvider.java

@@ -31,7 +31,6 @@ import org.whispersystems.textsecuregcm.util.Pair;
  * {@link io.dropwizard.auth.Auth} object with a current device list.
  *
  * @see AuthenticatedAccount
- * @see DisabledPermittedAuthenticatedAccount
  */
 public class AuthEnablementRefreshRequirementProvider implements WebsocketRefreshRequirementProvider {
 

service/src/main/java/org/whispersystems/textsecuregcm/auth/BaseAccountAuthenticator.java

@@ -1,173 +0,0 @@
-/*
- * Copyright 2013 Signal Messenger, LLC
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-package org.whispersystems.textsecuregcm.auth;
-
-import static com.codahale.metrics.MetricRegistry.name;
-
-import com.google.common.annotations.VisibleForTesting;
-import io.dropwizard.auth.basic.BasicCredentials;
-import io.micrometer.core.instrument.Metrics;
-import io.micrometer.core.instrument.Tags;
-import java.time.Clock;
-import java.time.Duration;
-import java.time.temporal.ChronoUnit;
-import java.util.Optional;
-import java.util.UUID;
-import org.apache.commons.lang3.StringUtils;
-import org.whispersystems.textsecuregcm.storage.Account;
-import org.whispersystems.textsecuregcm.storage.AccountsManager;
-import org.whispersystems.textsecuregcm.storage.Device;
-import org.whispersystems.textsecuregcm.storage.RefreshingAccountAndDeviceSupplier;
-import org.whispersystems.textsecuregcm.util.Pair;
-import org.whispersystems.textsecuregcm.util.Util;
-
-public class BaseAccountAuthenticator {
-
-  private static final String AUTHENTICATION_COUNTER_NAME = name(BaseAccountAuthenticator.class, "authentication");
-  private static final String ENABLED_NOT_REQUIRED_AUTHENTICATION_COUNTER_NAME = name(BaseAccountAuthenticator.class,
-      "enabledNotRequiredAuthentication");
-  private static final String AUTHENTICATION_SUCCEEDED_TAG_NAME = "succeeded";
-  private static final String AUTHENTICATION_FAILURE_REASON_TAG_NAME = "reason";
-  private static final String ENABLED_TAG_NAME = "enabled";
-
-  private static final String DAYS_SINCE_LAST_SEEN_DISTRIBUTION_NAME = name(BaseAccountAuthenticator.class, "daysSinceLastSeen");
-  private static final String IS_PRIMARY_DEVICE_TAG = "isPrimary";
-
-  @VisibleForTesting
-  static final char DEVICE_ID_SEPARATOR = '.';
-
-  private final AccountsManager accountsManager;
-  private final Clock           clock;
-
-  public BaseAccountAuthenticator(AccountsManager accountsManager) {
-    this(accountsManager, Clock.systemUTC());
-  }
-
-  @VisibleForTesting
-  public BaseAccountAuthenticator(AccountsManager accountsManager, Clock clock) {
-    this.accountsManager   = accountsManager;
-    this.clock             = clock;
-  }
-
-  static Pair<String, Byte> getIdentifierAndDeviceId(final String basicUsername) {
-    final String identifier;
-    final byte deviceId;
-
-    final int deviceIdSeparatorIndex = basicUsername.indexOf(DEVICE_ID_SEPARATOR);
-
-    if (deviceIdSeparatorIndex == -1) {
-      identifier = basicUsername;
-      deviceId = Device.PRIMARY_ID;
-    } else {
-      identifier = basicUsername.substring(0, deviceIdSeparatorIndex);
-      deviceId = Byte.parseByte(basicUsername.substring(deviceIdSeparatorIndex + 1));
-    }
-
-    return new Pair<>(identifier, deviceId);
-  }
-
-  public Optional<AuthenticatedAccount> authenticate(BasicCredentials basicCredentials, boolean enabledRequired) {
-    boolean succeeded = false;
-    String failureReason = null;
-
-    try {
-      final UUID accountUuid;
-      final byte deviceId;
-      {
-        final Pair<String, Byte> identifierAndDeviceId = getIdentifierAndDeviceId(basicCredentials.getUsername());
-
-        accountUuid = UUID.fromString(identifierAndDeviceId.first());
-        deviceId = identifierAndDeviceId.second();
-      }
-
-      Optional<Account> account = accountsManager.getByAccountIdentifier(accountUuid);
-
-      if (account.isEmpty()) {
-        failureReason = "noSuchAccount";
-        return Optional.empty();
-      }
-
-      Optional<Device> device = account.get().getDevice(deviceId);
-
-      if (device.isEmpty()) {
-        failureReason = "noSuchDevice";
-        return Optional.empty();
-      }
-
-      if (enabledRequired) {
-        final boolean deviceDisabled = !device.get().isEnabled();
-        if (deviceDisabled) {
-          failureReason = "deviceDisabled";
-        }
-
-        final boolean accountDisabled = !account.get().isEnabled();
-        if (accountDisabled) {
-          failureReason = "accountDisabled";
-        }
-        if (accountDisabled || deviceDisabled) {
-          return Optional.empty();
-        }
-      } else {
-        Metrics.counter(ENABLED_NOT_REQUIRED_AUTHENTICATION_COUNTER_NAME,
-                ENABLED_TAG_NAME, String.valueOf(device.get().isEnabled() && account.get().isEnabled()),
-                IS_PRIMARY_DEVICE_TAG, String.valueOf(device.get().isPrimary()))
-            .increment();
-      }
-
-      SaltedTokenHash deviceSaltedTokenHash = device.get().getAuthTokenHash();
-      if (deviceSaltedTokenHash.verify(basicCredentials.getPassword())) {
-        succeeded = true;
-        Account authenticatedAccount = updateLastSeen(account.get(), device.get());
-        if (deviceSaltedTokenHash.getVersion() != SaltedTokenHash.CURRENT_VERSION) {
-          authenticatedAccount = accountsManager.updateDeviceAuthentication(
-              authenticatedAccount,
-              device.get(),
-              SaltedTokenHash.generateFor(basicCredentials.getPassword()));  // new credentials have current version
-        }
-        return Optional.of(new AuthenticatedAccount(
-            new RefreshingAccountAndDeviceSupplier(authenticatedAccount, device.get().getId(), accountsManager)));
-      }
-
-      return Optional.empty();
-    } catch (IllegalArgumentException | InvalidAuthorizationHeaderException iae) {
-      failureReason = "invalidHeader";
-      return Optional.empty();
-    } finally {
-      Tags tags = Tags.of(
-          AUTHENTICATION_SUCCEEDED_TAG_NAME, String.valueOf(succeeded));
-
-      if (StringUtils.isNotBlank(failureReason)) {
-        tags = tags.and(AUTHENTICATION_FAILURE_REASON_TAG_NAME, failureReason);
-      }
-
-      Metrics.counter(AUTHENTICATION_COUNTER_NAME, tags).increment();
-    }
-  }
-
-  @VisibleForTesting
-  public Account updateLastSeen(Account account, Device device) {
-    // compute a non-negative integer between 0 and 86400.
-    long n = Util.ensureNonNegativeLong(account.getUuid().getLeastSignificantBits());
-    final long lastSeenOffsetSeconds = n % ChronoUnit.DAYS.getDuration().toSeconds();
-
-    // produce a truncated timestamp which is either today at UTC midnight
-    // or yesterday at UTC midnight, based on per-user randomized offset used.
-    final long todayInMillisWithOffset = Util.todayInMillisGivenOffsetFromNow(clock, Duration.ofSeconds(lastSeenOffsetSeconds).negated());
-
-    // only update the device's last seen time when it falls behind the truncated timestamp.
-    // this ensure a few things:
-    //   (1) each account will only update last-seen at most once per day
-    //   (2) these updates will occur throughout the day rather than all occurring at UTC midnight.
-    if (device.getLastSeen() < todayInMillisWithOffset) {
-      Metrics.summary(DAYS_SINCE_LAST_SEEN_DISTRIBUTION_NAME, IS_PRIMARY_DEVICE_TAG, String.valueOf(device.isPrimary()))
-          .record(Duration.ofMillis(todayInMillisWithOffset - device.getLastSeen()).toDays());
-
-      return accountsManager.updateDeviceLastSeen(account, device, Util.todayInMillis(clock));
-    }
-
-    return account;
-  }
-}

service/src/main/java/org/whispersystems/textsecuregcm/auth/BasicAuthorizationHeader.java

@@ -62,7 +62,7 @@ public class BasicAuthorizationHeader {
       final byte deviceId;
       {
         final Pair<String, Byte> identifierAndDeviceId =
-            BaseAccountAuthenticator.getIdentifierAndDeviceId(usernameComponent);
+            AccountAuthenticator.getIdentifierAndDeviceId(usernameComponent);
 
         username = identifierAndDeviceId.first();
         deviceId = identifierAndDeviceId.second();

service/src/main/java/org/whispersystems/textsecuregcm/auth/DisabledPermittedAccountAuthenticator.java

@@ -1,26 +0,0 @@
-/*
- * Copyright 2013-2021 Signal Messenger, LLC
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-package org.whispersystems.textsecuregcm.auth;
-
-import io.dropwizard.auth.Authenticator;
-import io.dropwizard.auth.basic.BasicCredentials;
-import java.util.Optional;
-import org.whispersystems.textsecuregcm.experiment.ExperimentEnrollmentManager;
-import org.whispersystems.textsecuregcm.storage.AccountsManager;
-
-public class DisabledPermittedAccountAuthenticator extends BaseAccountAuthenticator implements
-    Authenticator<BasicCredentials, DisabledPermittedAuthenticatedAccount> {
-
-  public DisabledPermittedAccountAuthenticator(AccountsManager accountsManager) {
-    super(accountsManager);
-  }
-
-  @Override
-  public Optional<DisabledPermittedAuthenticatedAccount> authenticate(BasicCredentials credentials) {
-    Optional<AuthenticatedAccount> account = super.authenticate(credentials, false);
-    return account.map(DisabledPermittedAuthenticatedAccount::new);
-  }
-}

service/src/main/java/org/whispersystems/textsecuregcm/auth/DisabledPermittedAuthenticatedAccount.java

@@ -1,42 +0,0 @@
-/*
- * Copyright 2013-2021 Signal Messenger, LLC
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-package org.whispersystems.textsecuregcm.auth;
-
-import java.security.Principal;
-import javax.security.auth.Subject;
-import org.whispersystems.textsecuregcm.storage.Account;
-import org.whispersystems.textsecuregcm.storage.Device;
-
-public class DisabledPermittedAuthenticatedAccount implements Principal, AccountAndAuthenticatedDeviceHolder {
-
-  private final AuthenticatedAccount authenticatedAccount;
-
-  public DisabledPermittedAuthenticatedAccount(final AuthenticatedAccount authenticatedAccount) {
-    this.authenticatedAccount = authenticatedAccount;
-  }
-
-  @Override
-  public Account getAccount() {
-    return authenticatedAccount.getAccount();
-  }
-
-  @Override
-  public Device getAuthenticatedDevice() {
-    return authenticatedAccount.getAuthenticatedDevice();
-  }
-
-  // Principal implementation
-
-  @Override
-  public String getName() {
-    return null;
-  }
-
-  @Override
-  public boolean implies(Subject subject) {
-    return false;
-  }
-}

service/src/main/java/org/whispersystems/textsecuregcm/auth/grpc/BasicCredentialAuthenticationInterceptor.java

@@ -17,7 +17,7 @@ import io.grpc.Status;
 import java.util.Optional;
 import org.apache.commons.lang3.StringUtils;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
-import org.whispersystems.textsecuregcm.auth.BaseAccountAuthenticator;
+import org.whispersystems.textsecuregcm.auth.AccountAuthenticator;
 import org.whispersystems.textsecuregcm.util.HeaderUtils;
 
 /**
@@ -32,11 +32,11 @@ import org.whispersystems.textsecuregcm.util.HeaderUtils;
  * intended to be replaced with a more robust and efficient strategy before widespread client adoption.
  *
  * @see AuthenticationUtil
- * @see BaseAccountAuthenticator
+ * @see AccountAuthenticator
  */
 public class BasicCredentialAuthenticationInterceptor implements ServerInterceptor {
 
-  private final BaseAccountAuthenticator baseAccountAuthenticator;
+  private final AccountAuthenticator accountAuthenticator;
 
   @VisibleForTesting
   static final Metadata.Key<String> BASIC_CREDENTIALS =
@@ -44,8 +44,8 @@ public class BasicCredentialAuthenticationInterceptor implements ServerIntercept
 
   private static final Metadata EMPTY_TRAILERS = new Metadata();
 
-  public BasicCredentialAuthenticationInterceptor(final BaseAccountAuthenticator baseAccountAuthenticator) {
-    this.baseAccountAuthenticator = baseAccountAuthenticator;
+  public BasicCredentialAuthenticationInterceptor(final AccountAuthenticator accountAuthenticator) {
+    this.accountAuthenticator = accountAuthenticator;
   }
 
   @Override
@@ -62,7 +62,7 @@ public class BasicCredentialAuthenticationInterceptor implements ServerIntercept
         call.close(Status.UNAUTHENTICATED.withDescription("Could not parse credentials"), EMPTY_TRAILERS);
       } else {
         final Optional<AuthenticatedAccount> maybeAuthenticatedAccount =
-            baseAccountAuthenticator.authenticate(maybeCredentials.get(), false);
+            accountAuthenticator.authenticate(maybeCredentials.get());
 
         if (maybeAuthenticatedAccount.isPresent()) {
           final AuthenticatedAccount authenticatedAccount = maybeAuthenticatedAccount.get();

service/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java

@@ -4,10 +4,7 @@
  */
 package org.whispersystems.textsecuregcm.controllers;
 
-import static org.whispersystems.textsecuregcm.metrics.MetricsUtil.name;
-
 import io.dropwizard.auth.Auth;
-import io.micrometer.core.instrument.Metrics;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
@@ -38,7 +35,6 @@ import org.signal.libsignal.usernames.BaseUsernameException;
 import org.whispersystems.textsecuregcm.auth.AccountAndAuthenticatedDeviceHolder;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
 import org.whispersystems.textsecuregcm.auth.ChangesDeviceEnabledState;
-import org.whispersystems.textsecuregcm.auth.DisabledPermittedAuthenticatedAccount;
 import org.whispersystems.textsecuregcm.auth.SaltedTokenHash;
 import org.whispersystems.textsecuregcm.auth.TurnToken;
 import org.whispersystems.textsecuregcm.auth.TurnTokenGenerator;
@@ -59,7 +55,6 @@ import org.whispersystems.textsecuregcm.identity.AciServiceIdentifier;
 import org.whispersystems.textsecuregcm.identity.ServiceIdentifier;
 import org.whispersystems.textsecuregcm.limits.RateLimitedByIp;
 import org.whispersystems.textsecuregcm.limits.RateLimiters;
-import org.whispersystems.textsecuregcm.metrics.UserAgentTagUtil;
 import org.whispersystems.textsecuregcm.storage.Account;
 import org.whispersystems.textsecuregcm.storage.AccountsManager;
 import org.whispersystems.textsecuregcm.storage.Device;
@@ -79,7 +74,6 @@ public class AccountController {
   public static final int USERNAME_HASH_LENGTH = 32;
   public static final int MAXIMUM_USERNAME_CIPHERTEXT_LENGTH = 128;
 
-  private static final String INVALID_REGISTRATION_ID = name(AccountController.class, "invalidRegistrationId");
   private final AccountsManager accounts;
   private final RateLimiters rateLimiters;
   private final TurnTokenGenerator turnTokenGenerator;
@@ -112,11 +106,11 @@ public class AccountController {
   @Consumes(MediaType.APPLICATION_JSON)
   @Produces(MediaType.APPLICATION_JSON)
   @ChangesDeviceEnabledState
-  public void setGcmRegistrationId(@Auth DisabledPermittedAuthenticatedAccount disabledPermittedAuth,
+  public void setGcmRegistrationId(@Auth AuthenticatedAccount auth,
       @NotNull @Valid GcmRegistrationId registrationId) {
 
-    final Account account = disabledPermittedAuth.getAccount();
-    final Device device = disabledPermittedAuth.getAuthenticatedDevice();
+    final Account account = auth.getAccount();
+    final Device device = auth.getAuthenticatedDevice();
 
     if (Objects.equals(device.getGcmId(), registrationId.gcmRegistrationId())) {
       return;
@@ -133,9 +127,9 @@ public class AccountController {
   @DELETE
   @Path("/gcm/")
   @ChangesDeviceEnabledState
-  public void deleteGcmRegistrationId(@Auth DisabledPermittedAuthenticatedAccount disabledPermittedAuth) {
-    Account account = disabledPermittedAuth.getAccount();
-    Device device = disabledPermittedAuth.getAuthenticatedDevice();
+  public void deleteGcmRegistrationId(@Auth AuthenticatedAccount auth) {
+    Account account = auth.getAccount();
+    Device device = auth.getAuthenticatedDevice();
 
     accounts.updateDevice(account, device.getId(), d -> {
       d.setGcmId(null);
@@ -149,11 +143,11 @@ public class AccountController {
   @Consumes(MediaType.APPLICATION_JSON)
   @Produces(MediaType.APPLICATION_JSON)
   @ChangesDeviceEnabledState
-  public void setApnRegistrationId(@Auth DisabledPermittedAuthenticatedAccount disabledPermittedAuth,
+  public void setApnRegistrationId(@Auth AuthenticatedAccount auth,
       @NotNull @Valid ApnRegistrationId registrationId) {
 
-    final Account account = disabledPermittedAuth.getAccount();
-    final Device device = disabledPermittedAuth.getAuthenticatedDevice();
+    final Account account = auth.getAccount();
+    final Device device = auth.getAuthenticatedDevice();
 
     if (Objects.equals(device.getApnId(), registrationId.apnRegistrationId()) &&
         Objects.equals(device.getVoipApnId(), registrationId.voipRegistrationId())) {
@@ -172,9 +166,9 @@ public class AccountController {
   @DELETE
   @Path("/apn/")
   @ChangesDeviceEnabledState
-  public void deleteApnRegistrationId(@Auth DisabledPermittedAuthenticatedAccount disabledPermittedAuth) {
-    Account account = disabledPermittedAuth.getAccount();
-    Device device = disabledPermittedAuth.getAuthenticatedDevice();
+  public void deleteApnRegistrationId(@Auth AuthenticatedAccount auth) {
+    Account account = auth.getAccount();
+    Device device = auth.getAuthenticatedDevice();
 
     accounts.updateDevice(account, device.getId(), d -> {
       d.setApnId(null);
@@ -206,9 +200,9 @@ public class AccountController {
 
   @PUT
   @Path("/name/")
-  public void setName(@Auth DisabledPermittedAuthenticatedAccount disabledPermittedAuth, @NotNull @Valid DeviceName deviceName) {
-    Account account = disabledPermittedAuth.getAccount();
-    Device device = disabledPermittedAuth.getAuthenticatedDevice();
+  public void setName(@Auth AuthenticatedAccount auth, @NotNull @Valid DeviceName deviceName) {
+    Account account = auth.getAccount();
+    Device device = auth.getAuthenticatedDevice();
     accounts.updateDevice(account, device.getId(), d -> d.setName(deviceName.getDeviceName()));
   }
 
@@ -218,11 +212,11 @@ public class AccountController {
   @Produces(MediaType.APPLICATION_JSON)
   @ChangesDeviceEnabledState
   public void setAccountAttributes(
-      @Auth DisabledPermittedAuthenticatedAccount disabledPermittedAuth,
+      @Auth AuthenticatedAccount auth,
       @HeaderParam(HeaderUtils.X_SIGNAL_AGENT) String userAgent,
       @NotNull @Valid AccountAttributes attributes) {
-    final Account account = disabledPermittedAuth.getAccount();
-    final byte deviceId = disabledPermittedAuth.getAuthenticatedDevice().getId();
+    final Account account = auth.getAccount();
+    final byte deviceId = auth.getAuthenticatedDevice().getId();
 
     final Account updatedAccount = accounts.update(account, a -> {
       a.getDevice(deviceId).ifPresent(d -> {
@@ -246,8 +240,9 @@ public class AccountController {
 
   @GET
   @Path("/me")
+  @Deprecated() // use whoami
   @Produces(MediaType.APPLICATION_JSON)
-  public AccountIdentityResponse getMe(@Auth DisabledPermittedAuthenticatedAccount auth) {
+  public AccountIdentityResponse getMe(@Auth AuthenticatedAccount auth) {
     return buildAccountIdentityResponse(auth);
   }
 
@@ -521,7 +516,7 @@ public class AccountController {
 
   @DELETE
   @Path("/me")
-  public CompletableFuture<Response> deleteAccount(@Auth DisabledPermittedAuthenticatedAccount auth) throws InterruptedException {
+  public CompletableFuture<Response> deleteAccount(@Auth AuthenticatedAccount auth) {
     return accounts.delete(auth.getAccount(), AccountsManager.DeletionReason.USER_REQUEST).thenApply(Util.ASYNC_EMPTY_RESPONSE);
   }
 

service/src/main/java/org/whispersystems/textsecuregcm/controllers/KeysController.java

@@ -42,7 +42,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.textsecuregcm.auth.Anonymous;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
-import org.whispersystems.textsecuregcm.auth.DisabledPermittedAuthenticatedAccount;
 import org.whispersystems.textsecuregcm.auth.OptionalAccess;
 import org.whispersystems.textsecuregcm.entities.ECSignedPreKey;
 import org.whispersystems.textsecuregcm.entities.KEMSignedPreKey;
@@ -114,7 +113,7 @@ public class KeysController {
   @ApiResponse(responseCode = "401", description = "Account authentication check failed.")
   @ApiResponse(responseCode = "403", description = "Attempt to change identity key from a non-primary device.")
   @ApiResponse(responseCode = "422", description = "Invalid request format.")
-  public CompletableFuture<Response> setKeys(@Auth final DisabledPermittedAuthenticatedAccount disabledPermittedAuth,
+  public CompletableFuture<Response> setKeys(@Auth final AuthenticatedAccount auth,
       @RequestBody @NotNull @Valid final SetKeysRequest setKeysRequest,
 
       @Parameter(allowEmptyValue=true)
@@ -124,8 +123,8 @@ public class KeysController {
           description="whether this operation applies to the account (aci) or phone-number (pni) identity")
       @QueryParam("identity") @DefaultValue("aci") final IdentityType identityType) {
 
-    final Account account = disabledPermittedAuth.getAccount();
-    final Device device = disabledPermittedAuth.getAuthenticatedDevice();
+    final Account account = auth.getAccount();
+    final Device device = auth.getAuthenticatedDevice();
     final UUID identifier = account.getIdentifier(identityType);
 
     checkSignedPreKeySignatures(setKeysRequest, account.getIdentityKey(identityType));