Improving flow when user denies Bitbucket access to Che

wsmaster/che-core-api-auth/src/main/java/org/eclipse/che/security/oauth1/OAuthAuthenticationException.java

@@ -19,7 +19,7 @@
  * @author Kevin Pollet
  * @author Igor Vinokur
  */
-public final class OAuthAuthenticationException extends ServerException {
+public class OAuthAuthenticationException extends ServerException {
 
   /**
    * Constructs an instance of {@link OAuthAuthenticationException}.

wsmaster/che-core-api-auth/src/main/java/org/eclipse/che/security/oauth1/OAuthAuthenticationService.java

@@ -79,12 +79,10 @@ public Response callback() throws OAuthAuthenticationException, BadRequestExcept
 
     try {
       getAuthenticator(providerName).callback(requestUrl);
+    } catch (UserDeniedOAuthAuthenticationException e) {
+      redirectUriBuilder.queryParam(ERROR_QUERY_NAME, "access_denied");
     } catch (OAuthAuthenticationException e) {
-      if (e.getMessage().equalsIgnoreCase("Authorization denied")) {
-        redirectUriBuilder.queryParam(ERROR_QUERY_NAME, "access_denied");
-      } else {
-        redirectUriBuilder.queryParam(ERROR_QUERY_NAME, "invalid_request");
-      }
+      redirectUriBuilder.queryParam(ERROR_QUERY_NAME, "invalid_request");
     }
     return Response.temporaryRedirect(redirectUriBuilder.build()).build();
   }

wsmaster/che-core-api-auth/src/main/java/org/eclipse/che/security/oauth1/OAuthAuthenticator.java

@@ -26,7 +26,6 @@
 import com.google.api.client.http.HttpTransport;
 import com.google.api.client.http.javanet.NetHttpTransport;
 import com.google.api.client.util.Base64;
-import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.URL;
 import java.security.GeneralSecurityException;
@@ -189,6 +188,11 @@ String callback(final URL requestUrl) throws OAuthAuthenticationException {
       getAccessToken.consumerKey = clientId;
       getAccessToken.temporaryToken = oauthTemporaryToken;
       getAccessToken.verifier = (String) callbackUrl.getFirst(OAUTH_VERIFIER_PARAM_KEY);
+
+      if ("denied".equals(getAccessToken.verifier)) {
+        throw new UserDeniedOAuthAuthenticationException("Authorization denied");
+      }
+
       getAccessToken.transport = httpTransport;
       if (signatureMethod != null && "rsa".equalsIgnoreCase(signatureMethod)) {
         getAccessToken.signer = getOAuthRsaSigner();
@@ -197,13 +201,7 @@ String callback(final URL requestUrl) throws OAuthAuthenticationException {
             getOAuthHmacSigner(clientSecret, sharedTokenSecrets.remove(oauthTemporaryToken));
       }
 
-      final OAuthCredentialsResponse credentials;
-      try {
-        credentials = getAccessToken.execute();
-      } catch (IOException e) {
-        throw new OAuthAuthenticationException("Authorization denied");
-      }
-
+      final OAuthCredentialsResponse credentials = getAccessToken.execute();
       String userId = getParameterFromState(state, USER_ID_PARAM_KEY);
 
       credentialsStoreLock.lock();
@@ -223,6 +221,8 @@ String callback(final URL requestUrl) throws OAuthAuthenticationException {
 
       return userId;
 
+    } catch (OAuthAuthenticationException e) {
+      throw e;
     } catch (Exception e) {
       throw new OAuthAuthenticationException(e.getMessage());
     }

wsmaster/che-core-api-auth/src/main/java/org/eclipse/che/security/oauth1/UserDeniedOAuthAuthenticationException.java

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2012-2018 Red Hat, Inc.
+ * This program and the accompanying materials are made
+ * available under the terms of the Eclipse Public License 2.0
+ * which is available at https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *
+ * Contributors:
+ *   Red Hat, Inc. - initial API and implementation
+ */
+package org.eclipse.che.security.oauth1;
+
+/** Exception used when a user denies access on the OAuth authorization page. */
+public final class UserDeniedOAuthAuthenticationException extends OAuthAuthenticationException {
+  public UserDeniedOAuthAuthenticationException(String message) {
+    super(message);
+  }
+
+  public UserDeniedOAuthAuthenticationException(Throwable cause) {
+    super(cause);
+  }
+}