Subversion Repositories SmartDukaan

package com.spice.profitmandi.web.interceptor;

import com.spice.profitmandi.web.filter.RequestCachingFilter;

import org.apache.logging.log4j.LogManager;

import org.apache.logging.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.data.redis.core.RedisTemplate;

import org.springframework.stereotype.Component;

import org.springframework.web.servlet.HandlerInterceptor;

import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.security.MessageDigest;

import java.util.concurrent.TimeUnit;

@Component

public class PostInterceptor implements HandlerInterceptor {

    private static final Logger LOGGER = LogManager.getLogger(PostInterceptor.class);

    private static final String IDEM_PREFIX = "idem:";

    private static final long IDEM_TTL_SECONDS = 300;

    private static final String REQUEST_ATTR_IDEM_KEY = "postInterceptor.idemKey";

    @Autowired

    private RedisTemplate<String, Object> redisTemplate;

    @Override

    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        if (!"POST".equalsIgnoreCase(request.getMethod())) {

            return true;

        }

        String idempotencyHeader = request.getHeader("IdempotencyKey");

        String idemKey = buildIdempotencyKey(request, idempotencyHeader);

        if (idemKey == null) {

            return true;

        }

        String redisKey = IDEM_PREFIX + idemKey;

        Boolean claimed = redisTemplate.opsForValue()

                .setIfAbsent(redisKey, "pending", IDEM_TTL_SECONDS, TimeUnit.SECONDS);

        if (Boolean.TRUE.equals(claimed)) {

            request.setAttribute(REQUEST_ATTR_IDEM_KEY, idemKey);

            return true;

        }

        LOGGER.info("Duplicate request detected: idemKey={}, uri={}", idemKey, request.getRequestURI());

        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);

        response.getWriter().write("Duplicate request.");

        return false;

    }

    @Override

    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)

            throws Exception {

    }

    @Override

    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)

            throws Exception {

        String idemKey = (String) request.getAttribute(REQUEST_ATTR_IDEM_KEY);

        if (idemKey == null) {

            return;

        }

        String redisKey = IDEM_PREFIX + idemKey;

        // On error, release the claim immediately so the caller can retry without waiting.

        // On success, leave the key untouched: keep its original claim-time TTL (set in

        // preHandle) and do NOT re-set it. Re-setting refreshed the TTL on every completion,

        // sliding the dedupe window forward and falsely rejecting later legitimate submissions.

        if (ex != null || response.getStatus() < 200 || response.getStatus() >= 300) {

            redisTemplate.delete(redisKey);

        }

    }

    private String buildIdempotencyKey(HttpServletRequest request, String header) {

        if (header != null && !header.isEmpty()) {

            String uri = request.getRequestURI();

            String query = request.getQueryString();

            String scope = header + "|" + uri + (query != null ? "?" + query : "");

            return sha256(scope.getBytes(java.nio.charset.StandardCharsets.UTF_8));

        }

        if ("POST".equalsIgnoreCase(request.getMethod())

                && request instanceof RequestCachingFilter.CachedBodyRequest) {

            byte[] body = ((RequestCachingFilter.CachedBodyRequest) request).getCachedBody();

            if (body.length > 0) {

                return sha256(body);

            }

        }

        return null;

    }

    private static String sha256(byte[] data) {

        try {

            MessageDigest digest = MessageDigest.getInstance("SHA-256");

            byte[] hash = digest.digest(data);

            StringBuilder hex = new StringBuilder(64);

            for (byte b : hash) {

                hex.append(String.format("%02x", b));

            }

            return hex.toString();

        } catch (Exception e) {

            throw new RuntimeException("SHA-256 not available", e);

        }

    }

}