Invariant Properties

/**
 * Configure Spring-aware entity listeners. This implementation is
 * hibernate-specific.
 * 
 * See: http://deepintojee.wordpress.com/2012/02
 * /05/spring-managed-event-listeners-with-jpa/
 * 
 * Another approach follows, but it doesn't support Spring injection.
 * http://stackoverflow.com/questions/8616146/eventlisteners-using-hibernate
 * -4-0-with-spring-3-1-0-release
 * 
 * @author louis.gueye@gmail.com (see above)
 * @author Bear Giles <bgiles@coyotesong.com>
 */
@Component
public class HibernateListenersConfigurer {
    private static final Logger log = LoggerFactory.getLogger(HibernateListenersConfigurer.class);

    @Resource
    private EntityManagerFactory emf;

    @Resource
    private HibernateListenersAdapter listener;

    @PostConstruct
    public void registerListeners() {
        HibernateEntityManagerFactory hemf = (HibernateEntityManagerFactory) emf;
        SessionFactory sf = hemf.getSessionFactory();
        EventListenerRegistry registry = ((SessionFactoryImpl) sf).getServiceRegistry().getService(
                EventListenerRegistry.class);

        registry.getEventListenerGroup(EventType.PRE_INSERT).appendListener(listener);
        registry.getEventListenerGroup(EventType.POST_COMMIT_INSERT).appendListener(listener);
        registry.getEventListenerGroup(EventType.PRE_UPDATE).appendListener(listener);
        registry.getEventListenerGroup(EventType.POST_COMMIT_UPDATE).appendListener(listener);
        registry.getEventListenerGroup(EventType.PRE_DELETE).appendListener(listener);
        registry.getEventListenerGroup(EventType.POST_COMMIT_DELETE).appendListener(listener);
        registry.getEventListenerGroup(EventType.POST_LOAD).appendListener(listener);
    }
}

import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;

import javax.annotation.PostConstruct;
import javax.annotation.Resource;
import javax.persistence.Entity;
import javax.persistence.EntityManagerFactory;
import javax.persistence.PostLoad;
import javax.persistence.PostPersist;
import javax.persistence.PostRemove;
import javax.persistence.PostUpdate;
import javax.persistence.PrePersist;
import javax.persistence.PreRemove;
import javax.persistence.PreUpdate;

import org.apache.log4j.Logger;
import org.hibernate.SessionFactory;
import org.hibernate.ejb.HibernateEntityManagerFactory;
import org.hibernate.event.service.spi.EventListenerRegistry;
import org.hibernate.event.spi.PostDeleteEvent;
import org.hibernate.event.spi.PostDeleteEventListener;
import org.hibernate.event.spi.PostInsertEvent;
import org.hibernate.event.spi.PostInsertEventListener;
import org.hibernate.event.spi.PostLoadEvent;
import org.hibernate.event.spi.PostLoadEventListener;
import org.hibernate.event.spi.PostUpdateEvent;
import org.hibernate.event.spi.PostUpdateEventListener;
import org.hibernate.event.spi.PreDeleteEvent;
import org.hibernate.event.spi.PreDeleteEventListener;
import org.hibernate.event.spi.PreInsertEvent;
import org.hibernate.event.spi.PreInsertEventListener;
import org.hibernate.event.spi.PreUpdateEvent;
import org.hibernate.event.spi.PreUpdateEventListener;
import org.hibernate.internal.SessionFactoryImpl;

/**
 * Adapter that allows a Hibernate event listener to call a standard JPA
 * EntityListener.
 * 
 * For simplicity only a single bean of each class is supported. It is not
 * difficult to support multiple beans, just messy.
 * 
 * Each listener can have multiple methods with the same annotation.
 * 
 * @author Bear Giles <bgiles@coyotesong.com>
 */
public class HibernateListenersAdapter implements PostInsertEventListener, PreInsertEventListener,
        PreUpdateEventListener, PostUpdateEventListener, PreDeleteEventListener, PostDeleteEventListener,
        PostLoadEventListener {
    private static final long serialVersionUID = 1L;
    private static final Logger log = Logger.getLogger(HibernateListenersAdapter.class);

    @Resource
    private List<Object> listeners;

    @Resource
    private EntityManagerFactory emf;

    private Map<Class, Map<Method, Object>> preInsert = new LinkedHashMap<Class, Map<Method, Object>>();
    private Map<Class, Map<Method, Object>> postInsert = new LinkedHashMap<Class, Map<Method, Object>>();
    private Map<Class, Map<Method, Object>> preUpdate = new LinkedHashMap<Class, Map<Method, Object>>();
    private Map<Class, Map<Method, Object>> postUpdate = new LinkedHashMap<Class, Map<Method, Object>>();
    private Map<Class, Map<Method, Object>> preRemove = new LinkedHashMap<Class, Map<Method, Object>>();
    private Map<Class, Map<Method, Object>> postRemove = new LinkedHashMap<Class, Map<Method, Object>>();
    private Map<Class, Map<Method, Object>> postLoad = new LinkedHashMap<Class, Map<Method, Object>>();

    private EventListenerRegistry registry;

    @PostConstruct
    public void findMethods() {
        for (Object listener : listeners) {
            findMethodsForListener(listener);
        }

        HibernateEntityManagerFactory hemf = (HibernateEntityManagerFactory) emf;
        SessionFactory sf = hemf.getSessionFactory();
        registry = ((SessionFactoryImpl) sf).getServiceRegistry().getService(EventListenerRegistry.class);
    }

    public void findMethodsForListener(Object listener) {
        Class<?> c = listener.getClass();
        for (Method m : c.getMethods()) {
            if (Void.TYPE.equals(m.getReturnType())) {
                Class<?>[] types = m.getParameterTypes();
                if (types.length == 1) {
                    // check for all annotations now...
                    if (m.getAnnotation(PrePersist.class) != null) {
                        if (!preInsert.containsKey(types[0])) {
                            preInsert.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        preInsert.get(types[0]).put(m, listener);
                    }

                    if (m.getAnnotation(PostPersist.class) != null) {
                        if (!postInsert.containsKey(types[0])) {
                            postInsert.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        postInsert.get(types[0]).put(m, listener);
                    }

                    if (m.getAnnotation(PreUpdate.class) != null) {
                        if (!preUpdate.containsKey(types[0])) {
                            preUpdate.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        preUpdate.get(types[0]).put(m, listener);
                    }

                    if (m.getAnnotation(PostUpdate.class) != null) {
                        if (!postUpdate.containsKey(types[0])) {
                            postUpdate.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        postUpdate.get(types[0]).put(m, listener);
                    }

                    if (m.getAnnotation(PreRemove.class) != null) {
                        if (!preRemove.containsKey(types[0])) {
                            preRemove.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        preRemove.get(types[0]).put(m, listener);
                    }

                    if (m.getAnnotation(PostRemove.class) != null) {
                        if (!postRemove.containsKey(types[0])) {
                            postRemove.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        postRemove.get(types[0]).put(m, listener);
                    }

                    if (m.getAnnotation(PostLoad.class) != null) {
                        if (!postLoad.containsKey(types[0])) {
                            postLoad.put(types[0], new LinkedHashMap<Method, Object>());
                        }
                        postLoad.get(types[0]).put(m, listener);
                    }
                }
            }
        }
    }

    /**
     * Execute the listeners. We need to check the entity's class, parent
     * classes, and interfaces.
     * 
     * @param map
     * @param entity
     */
    private void execute(Map<Class, Map<Method, Object>> map, Object entity) {
        if (entity.getClass().isAnnotationPresent(Entity.class)) {

            // check for hits on this class or its superclasses.
            for (Class c = entity.getClass(); c != null && c != Object.class; c = c.getSuperclass()) {
                if (map.containsKey(c)) {
                    for (Map.Entry<Method, Object> entry : map.get(c).entrySet()) {
                        try {
                            entry.getKey().invoke(entry.getValue(), entity);
                        } catch (InvocationTargetException e) {
                            // log it
                        } catch (IllegalAccessException e) {
                            // log it
                        }
                    }
                }
            }

            // check for hits on interfaces.
            for (Class c : entity.getClass().getInterfaces()) {
                if (map.containsKey(c)) {
                    for (Map.Entry<Method, Object> entry : map.get(c).entrySet()) {
                        try {
                            entry.getKey().invoke(entry.getValue(), entity);
                        } catch (InvocationTargetException e) {
                            // log it
                        } catch (IllegalAccessException e) {
                            // log it
                        }
                    }
                }
            }
        }
    }

    /**
     * @see org.hibernate.event.spi.PostDeleteEventListener#onPostDelete(org.hibernate
     *      .event.spi.PostDeleteEvent)
     */
    @Override
    public void onPostDelete(PostDeleteEvent event) {
        execute(postRemove, event.getEntity());
    }

    /**
     * @see org.hibernate.event.spi.PreDeleteEventListener#onPreDelete(org.hibernate
     *      .event.spi.PreDeleteEvent)
     */
    @Override
    public boolean onPreDelete(PreDeleteEvent event) {
        execute(preRemove, event.getEntity());
        return false;
    }

    /**
     * @see org.hibernate.event.spi.PreInsertEventListener#onPreInsert(org.hibernate
     *      .event.spi.PreInsertEvent)
     */
    @Override
    public boolean onPreInsert(PreInsertEvent event) {
        execute(preInsert, event.getEntity());
        return false;
    }

    /**
     * @see org.hibernate.event.spi.PostInsertEventListener#onPostInsert(org.hibernate
     *      .event.spi.PostInsertEvent)
     */
    @Override
    public void onPostInsert(PostInsertEvent event) {
        execute(postInsert, event.getEntity());
    }

    /**
     * @see org.hibernate.event.spi.PreUpdateEventListener#onPreUpdate(org.hibernate
     *      .event.spi.PreUpdateEvent)
     */
    @Override
    public boolean onPreUpdate(PreUpdateEvent event) {
        execute(preUpdate, event.getEntity());
        return false;
    }

    /**
     * @see org.hibernate.event.spi.PostUpdateEventListener#onPostUpdate(org.hibernate
     *      .event.spi.PostUpdateEvent)
     */
    @Override
    public void onPostUpdate(PostUpdateEvent event) {
        execute(postUpdate, event.getEntity());
    }

    /**
     * @see org.hibernate.event.spi.PostLoadEventListener#onPostLoad(org.hibernate
     *      .event.spi.PostLoadEvent)
     */
    @Override
    public void onPostLoad(PostLoadEvent event) {
        execute(postLoad, event.getEntity());
    }
}

@Component
public class SpringEntityListenersConfigurer implements ApplicationContextAware {
    private static final Logger log = LoggerFactory.getLogger(SpringEntityListenersConfigurer.class);

    private ApplicationContext context;

    @Resource
    private EntityManagerFactory entityManagerFactory;

    @Override
    public void setApplicationContext(ApplicationContext context) {
        this.context = context;
    }

    @PostConstruct
    public void registerListeners() {
        // get registry so we can add listeners.
        HibernateEntityManagerFactory hemf = (HibernateEntityManagerFactory) entityManagerFactory;
        SessionFactory sf = hemf.getSessionFactory();
        EventListenerRegistry registry = ((SessionFactoryImpl) sf).getServiceRegistry().getService(
                EventListenerRegistry.class);

        final Set<Object> listeners = new HashSet<Object>();

        EntityManager entityManager = null;
        try {
            entityManager = hemf.createEntityManager();
            // for every entity known to the system...
            for (EntityType<?> entity : entityManager.getMetamodel().getEntities()) {

                // ... register event listeners for it.
                if (entity.getJavaType().isAnnotationPresent(SpringEntityListeners.class)) {
                    SpringEntityListeners annotation = (SpringEntityListeners) entity.getJavaType().getAnnotation(
                            SpringEntityListeners.class);
                    for (Class<?> beanClass : annotation.value()) {
                        Map<String, ?> map = context.getBeansOfType(beanClass);
                        listeners.addAll(map.values());
                    }
                }
            }
        } finally {
            if (entityManager != null) {
                entityManager.close();
            }
        }

        // register adapter and listeners.
        HibernateEntityListenersAdapter adapter = new HibernateEntityListenersAdapter(new ArrayList<Object>(listeners),
                entityManagerFactory);
        registry.getEventListenerGroup(EventType.PRE_INSERT).appendListener(adapter);
        registry.getEventListenerGroup(EventType.POST_COMMIT_INSERT).appendListener(adapter);
        registry.getEventListenerGroup(EventType.PRE_UPDATE).appendListener(adapter);
        registry.getEventListenerGroup(EventType.POST_COMMIT_UPDATE).appendListener(adapter);
        registry.getEventListenerGroup(EventType.PRE_DELETE).appendListener(adapter);
        registry.getEventListenerGroup(EventType.POST_COMMIT_DELETE).appendListener(adapter);
        registry.getEventListenerGroup(EventType.POST_LOAD).appendListener(adapter);
    }
}

public class PbkTest {
    private static final Provider bc = new BouncyCastleProvider();
    private static final ResourceBundle BUNDLE = ResourceBundle
            .getBundle(PbkTest.class.getName());
    private SecretKey cipherKey;
    private AlgorithmParameterSpec ivSpec;

    /**
     * Create secret key and IV from password.
     * 
     * Implementation note: I've believe I've seen other code that can extract
     * the random bits for the IV directly from the PBEKeySpec but I haven't
     * been able to duplicate it. It might have been a BouncyCastle extension.
     * 
     * @throws Exception
     */
    public void createKeyAndIv(char[] password) throws SecurityException,
            NoSuchAlgorithmException, InvalidKeySpecException {
        final String algorithm = "PBKDF2WithHmacSHA1";
        final SecretKeyFactory factory = SecretKeyFactory
                .getInstance(algorithm);
        final int derivedKeyLength = 128;
        final int iterations = 10000;

        // create salt
        final byte[][] salt = feistelSha1Hash(createSalt(), 1000);

        // create cipher key
        final PBEKeySpec cipherSpec = new PBEKeySpec(password, salt[0],
                iterations, derivedKeyLength);
        cipherKey = factory.generateSecret(cipherSpec);
        cipherSpec.clearPassword();

        // create IV. This is just one of many approaches. You do
        // not want to use the same salt used in creating the PBEKey.
        try {
            final Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding", bc);
            cipher.init(Cipher.ENCRYPT_MODE, cipherKey, new IvParameterSpec(
                    salt[1], 0, 16));
            ivSpec = new IvParameterSpec(cipher.doFinal(salt[1], 4, 16));
        } catch (NoSuchPaddingException e) {
            throw new SecurityException("unable to create IV", e);
        } catch (InvalidAlgorithmParameterException e) {
            throw new SecurityException("unable to create IV", e);
        } catch (InvalidKeyException e) {
            throw new SecurityException("unable to create IV", e);
        } catch (BadPaddingException e) {
            throw new SecurityException("unable to create IV", e);
        } catch (IllegalBlockSizeException e) {
            throw new SecurityException("unable to create IV", e);
        }
    }
}

    /**
     * Create salt. Two values are provided to support creation of both a cipher
     * key and IV from a single password.
     * 
     * The 'left' salt is pulled from a file outside of the app context. this
     * makes it much harder for a compromised app to obtain or modify this
     * value. You could read it as classloader resource but that's not really
     * different from the properties file used below. Another possibility is to
     * load it from a read-only value in a database, ideally one with a
     * different schema than the rest of the application. (It could even be an
     * in-memory database such as H2 that contains nothing but keying material,
     * again initialized from a file outside of the app context.)
     * 
     * The 'right' salt is pulled from a properties file. It is possible to use
     * a base64-encoded value but administration is a lot easier if we just take
     * an arbitrary string and hash it ourselves. At a minimum it should be a
     * random mix-cased string of at least (120/5 = 24) characters.
     * 
     * The generated salts are equally strong.
     * 
     * Implementation note: since this is for demonstration purposes a static
     * string in used in place of reading an external file.
     */
    public byte[][] createSalt() throws NoSuchAlgorithmException {
        final MessageDigest digest = MessageDigest.getInstance("SHA1");
        final byte[] left = new byte[20]; // fall back to all zeroes
        final byte[] right = new byte[20]; // fall back to all zeroes

        // load value from file or database.
        // note: we use fixed value for demonstration purposes.
        final String leftValue = "this string should be read from file or database";
        if (leftValue != null) {
            System.arraycopy(digest.digest(leftValue.getBytes()), 0, left, 0,
                    left.length);
            digest.reset();
        }

        // load value from resource bundle.
        final String rightValue = BUNDLE.getString("salt");
        if (rightValue != null) {
            System.arraycopy(digest.digest(rightValue.getBytes()), 0, right, 0,
                    right.length);
            digest.reset();
        }

        final byte[][] salt = feistelSha1Hash(new byte[][] { left, right },
                1000);

        return salt;
    }

    /**
     * Create salt. Two values are provided to support creation of both a cipher
     * key and IV from a single password.
     * 
     * The 'left' salt is pulled from a file outside of the app context. this
     * makes it much harder for a compromised app to obtain or modify this
     * value. You could read it as classloader resource but that's not really
     * different from the properties file used below. Another possibility is to
     * load it from a read-only value in a database, ideally one with a
     * different schema than the rest of the application. (It could even be an
     * in-memory database such as H2 that contains nothing but keying material,
     * again initialized from a file outside of the app context.)
     * 
     * The 'right' salt is pulled from a properties file. It is possible to use
     * a base64-encoded value but administration is a lot easier if we just take
     * an arbitrary string and hash it ourselves. At a minimum it should be a
     * random mix-cased string of at least (120/5 = 24) characters.
     * 
     * The generated salts are equally strong.
     * 
     * Implementation note: since this is for demonstration purposes a static
     * string in used in place of reading an external file.
     */
    public byte[][] createSalt() throws NoSuchAlgorithmException {
        final MessageDigest digest = MessageDigest.getInstance("SHA1");
        final byte[] left = new byte[20]; // fall back to all zeroes
        final byte[] right = new byte[20]; // fall back to all zeroes

        // load value from file or database.
        // note: we use fixed value for demonstration purposes.
        final String leftValue = "this string should be read from file or database";
        if (leftValue != null) {
            System.arraycopy(digest.digest(leftValue.getBytes()), 0, left, 0,
                    left.length);
            digest.reset();
        }

        // load value from resource bundle.
        final String rightValue = BUNDLE.getString("salt");
        if (rightValue != null) {
            System.arraycopy(digest.digest(rightValue.getBytes()), 0, right, 0,
                    right.length);
            digest.reset();
        }

        final byte[][] salt = feistelSha1Hash(new byte[][] { left, right },
                1000);

        return salt;
    }

    /**
     * Obtain password. Architectually we'll want good "separation of concerns"
     * and we should get the cipher key and IV from a separate place than where
     * we use it.
     * 
     * This is a unit test so the password is stored in a properties file. In
     * practice we'll want to get it from JNDI from an appserver, or at least a
     * file outside of the appserver's directory.
     * 
     * @throws Exception
     */
    @Before
    public void setup() throws Exception {
        createKeyAndIv(BUNDLE.getString("password").toCharArray());
    }

    /**
     * Test encryption.
     * 
     * @throws Exception
     */
    @Test
    public void testEncryption() throws Exception {
        String plaintext = BUNDLE.getString("plaintext");

        Cipher cipher = Cipher.getInstance(BUNDLE.getString("algorithm"), bc);
        cipher.init(Cipher.ENCRYPT_MODE, cipherKey, ivSpec);
        byte[] actual = cipher.doFinal(plaintext.getBytes());
        assertEquals(BUNDLE.getString("ciphertext"),
                new String(Base64.encode(actual), Charset.forName("UTF-8")));
    }

    /**
     * Test decryption.
     * 
     * @throws Exception
     */
    @Test
    public void testEncryptionAndDecryption() throws Exception {
        String ciphertext = BUNDLE.getString("ciphertext");

        Cipher cipher = Cipher.getInstance(BUNDLE.getString("algorithm"), bc);
        cipher.init(Cipher.DECRYPT_MODE, cipherKey, ivSpec);
        byte[] actual = cipher.doFinal(Base64.decode(ciphertext));

        assertEquals(BUNDLE.getString("plaintext"),
                new String(actual, Charset.forName("UTF-8")));
    }