feat(user-sessions): add JWT-based session management and main menu route

knockoutwhistweb/app/services/JwtKeyProvider.scala

@@ -0,0 +1,56 @@
+package services
+
+import java.nio.file.{Files, Paths}
+import java.security.{KeyFactory, PrivateKey, PublicKey}
+import java.security.spec.X509EncodedKeySpec
+import java.util.Base64
+import javax.inject.*
+import play.api.Configuration
+
+import java.security.interfaces.{RSAPrivateKey, RSAPublicKey}
+
+@Singleton
+class JwtKeyProvider @Inject()(config: Configuration) {
+
+  private def cleanPem(pem: String): String =
+    pem.replaceAll("-----BEGIN (.*)-----", "")
+      .replaceAll("-----END (.*)-----", "")
+      .replaceAll("\\s", "")
+
+  private def loadPublicKeyFromPem(pem: String): RSAPublicKey = {
+    val decoded = Base64.getDecoder.decode(cleanPem(pem))
+    val spec = new X509EncodedKeySpec(decoded)
+    KeyFactory.getInstance("RSA").generatePublic(spec).asInstanceOf[RSAPublicKey]
+  }
+
+  private def loadPrivateKeyFromPem(pem: String): RSAPrivateKey = {
+    val decoded = Base64.getDecoder.decode(cleanPem(pem))
+    val spec = new X509EncodedKeySpec(decoded)
+    KeyFactory.getInstance("RSA").generatePrivate(spec).asInstanceOf[RSAPrivateKey]
+  }
+
+  val publicKey: RSAPublicKey = {
+    val pemOpt = config.getOptional[String]("auth.publicKeyPem")
+    val fileOpt = config.getOptional[String]("auth.publicKeyFile")
+
+    pemOpt.orElse(fileOpt.map { path =>
+      new String(Files.readAllBytes(Paths.get(path)))
+    }) match {
+      case Some(pem) => loadPublicKeyFromPem(pem)
+      case None => throw new RuntimeException("No RSA public key configured.")
+    }
+  }
+
+  val privateKey: RSAPrivateKey = {
+    val pemOpt = config.getOptional[String]("auth.privateKeyPem")
+    val fileOpt = config.getOptional[String]("auth.privateKeyFile")
+
+    pemOpt.orElse(fileOpt.map { path =>
+      new String(Files.readAllBytes(Paths.get(path)))
+    }) match {
+      case Some(pem) => loadPrivateKeyFromPem(pem)
+      case None => throw new RuntimeException("No RSA private key configured.")
+    }
+  }
+  
+}