Polish onetimetoken references

docs/spring-security-docs.gradle

@@ -49,6 +49,7 @@ dependencies {
 	testImplementation 'org.springframework:spring-websocket'
 
 	testImplementation 'org.springframework:spring-webmvc'
+	testImplementation 'org.springframework:spring-context-support'
 	testImplementation 'jakarta.servlet:jakarta.servlet-api'
 	testImplementation 'io.mockk:mockk'
 	testImplementation "org.junit.jupiter:junit-jupiter-api"

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changinggenerateurl/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.changinggenerateurl;
+
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+// tag::snippet[]
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+
+	@Override
+	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
+		/**/ return Mono.empty();
+	}
+
+}
+// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changinggenerateurl/SecurityConfig.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.changinggenerateurl;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+// tag::config[]
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+	@Bean
+	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+		http
+			// ...
+			.formLogin(Customizer.withDefaults())
+			.oneTimeTokenLogin((ott) -> ott
+				.tokenGeneratingUrl("/ott/my-generate-url")
+			);
+		return http.build();
+	}
+
+}
+// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changingsubmitpageurl/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.changingsubmitpageurl;
+
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+// tag::snippet[]
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+
+	@Override
+	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
+		/**/ return Mono.empty();
+	}
+
+}
+// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changingsubmitpageurl/SecurityConfig.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.changingsubmitpageurl;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+// tag::config[]
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+	@Bean
+	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+		http
+			// ...
+			.formLogin(Customizer.withDefaults())
+			.oneTimeTokenLogin((ott) -> ott
+				.defaultSubmitPageUrl("/ott/submit")
+			);
+		return http.build();
+	}
+
+}
+// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
+
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+// tag::snippet[]
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+
+	@Override
+	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
+		/**/ return Mono.empty();
+	}
+
+}
+// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/MyCustomReactiveOneTimeTokenService.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
+
+import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
+import org.springframework.security.authentication.ott.OneTimeToken;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
+import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService;
+import reactor.core.publisher.Mono;
+
+class MyCustomReactiveOneTimeTokenService implements ReactiveOneTimeTokenService {
+
+
+	@Override
+	public Mono<OneTimeToken> generate(GenerateOneTimeTokenRequest request) {
+		return null;
+	}
+
+	@Override
+	public Mono<OneTimeToken> consume(OneTimeTokenAuthenticationToken authenticationToken) {
+		return null;
+	}
+
+}

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/OneTimeTokenServiceBeanSecurityConfig.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken.MyCustomReactiveOneTimeTokenService;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+// tag::config[]
+@Configuration
+@EnableWebSecurity
+public class OneTimeTokenServiceBeanSecurityConfig {
+
+	@Bean
+	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+		http
+			// ...
+			.formLogin(Customizer.withDefaults())
+			.oneTimeTokenLogin(Customizer.withDefaults());
+		return http.build();
+	}
+
+	@Bean
+	public ReactiveOneTimeTokenService oneTimeTokenService() {
+		return new MyCustomReactiveOneTimeTokenService();
+	}
+
+}
+// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/OneTimeTokenServiceDSLSecurityConfig.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+// tag::config[]
+@Configuration
+@EnableWebFluxSecurity
+public class OneTimeTokenServiceDSLSecurityConfig {
+
+	@Bean
+	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+		http
+			// ...
+			.formLogin(Customizer.withDefaults())
+			.oneTimeTokenLogin((ott) -> ott
+				.tokenService(new MyCustomReactiveOneTimeTokenService())
+			);
+		return http.build();
+	}
+
+}
+// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegeneratetokenrequest/SecurityConfig.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.docs.reactive.authentication.customizegeneratetokenrequest;
+
+import java.time.Duration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.web.server.authentication.ott.DefaultServerGenerateOneTimeTokenRequestResolver;
+import org.springframework.security.web.server.authentication.ott.ServerGenerateOneTimeTokenRequestResolver;
+
+public class SecurityConfig {
+
+	// tag::config[]
+	@Bean
+  ServerGenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
+		DefaultServerGenerateOneTimeTokenRequestResolver resolver = new DefaultServerGenerateOneTimeTokenRequestResolver();
+		resolver.setExpiresIn(Duration.ofMinutes(10));
+		return resolver;
+	}
+	// end::config[]
+
+}