Spring/spring-graphql
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Format webflux-security

Browse Source
This commit is contained in:
Rob Winch
2021-06-02 13:55:02 -05:00
parent 96d25b2a91
commit 16f2baa263
8 changed files with 181 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
samples/webflux-security/src/main/java/io/spring/sample/graphql/DataFetchers.java
View File

@@ -1,36 +1,37 @@
package io.spring.sample.graphql;
import graphql.schema.DataFetcher;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import java.math.BigDecimal;
import java.util.Map;
import graphql.schema.DataFetcher;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
@Component
public class DataFetchers {
@Autowired
EmployeeService employeeService;
@Autowired
EmployeeService employeeService;
@Autowired
SalaryService salaryService;
public DataFetcher employeeDataFetcher = env -> {
return employeeService.getAllEmployees();
};
public DataFetcher employeeDataFetcher = env -> {
return employeeService.getAllEmployees();
};
@Autowired
SalaryService salaryService;
public DataFetcher salaryDataFetcher = env -> {
Employee employee = env.getSource();
return salaryService.getSalaryForEmployee(employee);
};
public DataFetcher salaryDataFetcher = env -> {
Employee employee = env.getSource();
return salaryService.getSalaryForEmployee(employee);
};
public DataFetcher updateSalaryFetcher = env -> {
Map<String, String> input = env.getArgument("input");
String employeeId = input.get("employeeId");
BigDecimal newSalary = new BigDecimal(input.get("salary"));
salaryService.updateSalary(employeeId, newSalary);
return null;
};
public DataFetcher updateSalaryFetcher = env -> {
Map<String, String> input = env.getArgument("input");
String employeeId = input.get("employeeId");
BigDecimal newSalary = new BigDecimal(input.get("salary"));
salaryService.updateSalary(employeeId, newSalary);
return null;
};
}

37
samples/webflux-security/src/main/java/io/spring/sample/graphql/Employee.java
View File

@@ -2,28 +2,29 @@ package io.spring.sample.graphql;
public class Employee {
private String id;
private String name;
private String id;
public Employee(String id, String name) {
this.id = id;
this.name = name;
}
private String name;
public String getId() {
return id;
}
public Employee(String id, String name) {
this.id = id;
this.name = name;
}
public void setId(String id) {
this.id = id;
}
public String getId() {
return id;
}
public String getName() {
return name;
}
public void setId(String id) {
this.id = id;
}
public void setName(String name) {
this.name = name;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}

10
samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeService.java
View File

@@ -1,15 +1,15 @@
package io.spring.sample.graphql;
import org.springframework.stereotype.Component;
import java.util.Arrays;
import java.util.List;
import org.springframework.stereotype.Component;
@Component
public class EmployeeService {
public List<Employee> getAllEmployees() {
return Arrays.asList(new Employee("1", "Andi"));
}
public List<Employee> getAllEmployees() {
return Arrays.asList(new Employee("1", "Andi"));
}
}

6
samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeServiceApplication.java
View File

@@ -22,7 +22,7 @@ import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class EmployeeServiceApplication {
public static void main(String[] args) {
SpringApplication.run(EmployeeServiceApplication.class, args);
}
public static void main(String[] args) {
SpringApplication.run(EmployeeServiceApplication.class, args);
}
}

41
samples/webflux-security/src/main/java/io/spring/sample/graphql/GraphQLWiring.java
View File

@@ -1,6 +1,7 @@
package io.spring.sample.graphql;
import graphql.schema.idl.RuntimeWiring;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.graphql.boot.RuntimeWiringCustomizer;
import org.springframework.stereotype.Component;
@@ -8,26 +9,26 @@ import org.springframework.stereotype.Component;
@Component
public class GraphQLWiring implements RuntimeWiringCustomizer {
@Autowired
DataFetchers dataFetchers;
@Autowired
DataFetchers dataFetchers;
@Override
public void customize(RuntimeWiring.Builder builder) {
builder.type("Query",
wiringBuilder -> {
return wiringBuilder.
dataFetcher("employees", dataFetchers.employeeDataFetcher);
});
builder.type("Employee",
wiringBuilder -> {
return wiringBuilder.
dataFetcher("salary", dataFetchers.salaryDataFetcher);
});
builder.type("Mutation",
wiringBuilder -> {
return wiringBuilder.
dataFetcher("updateSalary", dataFetchers.updateSalaryFetcher);
});
@Override
public void customize(RuntimeWiring.Builder builder) {
builder.type("Query",
wiringBuilder -> {
return wiringBuilder.
dataFetcher("employees", dataFetchers.employeeDataFetcher);
});
builder.type("Employee",
wiringBuilder -> {
return wiringBuilder.
dataFetcher("salary", dataFetchers.salaryDataFetcher);
});
builder.type("Mutation",
wiringBuilder -> {
return wiringBuilder.
dataFetcher("updateSalary", dataFetchers.updateSalaryFetcher);
});
}
}
}

21
samples/webflux-security/src/main/java/io/spring/sample/graphql/SalaryService.java
View File

@@ -1,23 +1,24 @@
package io.spring.sample.graphql;
import java.math.BigDecimal;
import reactor.core.publisher.Mono;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Component;
import reactor.core.publisher.Mono;
import java.math.BigDecimal;
@Component
public class SalaryService {
@PreAuthorize("hasRole('ADMIN')")
public Mono<BigDecimal> getSalaryForEmployee(Employee employee) {
return Mono.just(new BigDecimal("42"));
}
@PreAuthorize("hasRole('ADMIN')")
public Mono<BigDecimal> getSalaryForEmployee(Employee employee) {
return Mono.just(new BigDecimal("42"));
}
@Secured({"ROLE_HR"})
public void updateSalary(String employeeId, BigDecimal newSalary) {
@Secured({ "ROLE_HR" })
public void updateSalary(String employeeId, BigDecimal newSalary) {
}
}
}

38
samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java
View File

@@ -15,25 +15,25 @@ import org.springframework.security.web.server.SecurityWebFilterChain;
@EnableReactiveMethodSecurity
public class SecurityConfig {
@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
http.csrf().disable();
return http
// Demonstrate that method security works
// Best practice to use both for defense in depth
.authorizeExchange()
.anyExchange().permitAll()
.and()
.httpBasic().and()
.build();
}
@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
http.csrf().disable();
return http
// Demonstrate that method security works
// Best practice to use both for defense in depth
.authorizeExchange()
.anyExchange().permitAll()
.and()
.httpBasic().and()
.build();
}
@Bean
public MapReactiveUserDetailsService userDetailsService() {
User.UserBuilder userBuilder = User.withDefaultPasswordEncoder();
UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build();
UserDetails admin = userBuilder.username("admin").password("admin").roles("USER", "ADMIN").build();
return new MapReactiveUserDetailsService(rob, admin);
}
@Bean
public MapReactiveUserDetailsService userDetailsService() {
User.UserBuilder userBuilder = User.withDefaultPasswordEncoder();
UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build();
UserDetails admin = userBuilder.username("admin").password("admin").roles("USER", "ADMIN").build();
return new MapReactiveUserDetailsService(rob, admin);
}
}

160
samples/webflux-security/src/test/java/io/spring/sample/graphql/EmployeeServiceApplicationTest.java
View File

@@ -15,103 +15,103 @@ import java.util.Collections;
@SpringBootTest()
class EmployeeServiceApplicationTest {
@Autowired
private ReactiveWebApplicationContext context;
private static final String BASE_URL = "https://spring.example.org/graphql";
@Autowired
private ReactiveWebApplicationContext context;
private static final String BASE_URL = "https://spring.example.org/graphql";
WebTestClient client;
WebTestClient client;
@BeforeEach
public void setup() {
this.client = WebTestClient
.bindToApplicationContext(this.context)
.apply(SecurityMockServerConfigurers.springSecurity())
.configureClient()
.filter(ExchangeFilterFunctions.basicAuthentication())
.defaultHeaders(headers -> {
headers.setContentType(MediaType.APPLICATION_JSON);
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
})
.baseUrl(BASE_URL)
.build();
}
@BeforeEach
public void setup() {
this.client = WebTestClient
.bindToApplicationContext(this.context)
.apply(SecurityMockServerConfigurers.springSecurity())
.configureClient()
.filter(ExchangeFilterFunctions.basicAuthentication())
.defaultHeaders(headers -> {
headers.setContentType(MediaType.APPLICATION_JSON);
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
})
.baseUrl(BASE_URL)
.build();
}
@Test
void canQueryName() {
String query = "{" +
" employees{ " +
" name" +
" }" +
"}";
@Test
void canQueryName() {
String query = "{" +
" employees{ " +
" name" +
" }" +
"}";
client.post().uri("")
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isOk()
.expectBody().jsonPath("data.employees[0].name").isEqualTo("Andi");
client.post().uri("")
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isOk()
.expectBody().jsonPath("data.employees[0].name").isEqualTo("Andi");
}
}
@Test
void canNotQuerySalary() {
String query = "{" +
" employees{ " +
" name" +
" salary" +
" }" +
"}";
@Test
void canNotQuerySalary() {
String query = "{" +
" employees{ " +
" name" +
" salary" +
" }" +
"}";
client.post().uri("")
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isOk()
.expectBody()
.jsonPath("data.employees[0].name").isEqualTo("Andi")
.jsonPath("data.employees[0].salary").doesNotExist();
client.post().uri("")
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isOk()
.expectBody()
.jsonPath("data.employees[0].name").isEqualTo("Andi")
.jsonPath("data.employees[0].salary").doesNotExist();
}
}
@Test
void canQuerySalaryAsAdmin() {
String query = "{" +
" employees{ " +
" name" +
" salary" +
" }" +
"}";
@Test
void canQuerySalaryAsAdmin() {
String query = "{" +
" employees{ " +
" name" +
" salary" +
" }" +
"}";
client.post().uri("")
.headers(h -> h.setBasicAuth("admin", "admin"))
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isOk()
.expectBody()
.jsonPath("data.employees[0].name").isEqualTo("Andi")
.jsonPath("data.employees[0].salary").isEqualTo("42");
client.post().uri("")
.headers(h -> h.setBasicAuth("admin", "admin"))
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isOk()
.expectBody()
.jsonPath("data.employees[0].name").isEqualTo("Andi")
.jsonPath("data.employees[0].salary").isEqualTo("42");
}
}
@Test
void invalidCredentials() {
String query = "{" +
" employees{ " +
" name" +
" salary" +
" }" +
"}";
@Test
void invalidCredentials() {
String query = "{" +
" employees{ " +
" name" +
" salary" +
" }" +
"}";
client.post().uri("")
.headers(h -> h.setBasicAuth("admin", "INVALID"))
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isUnauthorized()
.expectBody()
.isEmpty();
client.post().uri("")
.headers(h -> h.setBasicAuth("admin", "INVALID"))
.bodyValue("{ \"query\": \"" + query + "\"}")
.exchange()
.expectStatus().isUnauthorized()
.expectBody()
.isEmpty();
}
}
}