diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/DataFetchers.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/DataFetchers.java index 6a2e2c6a..530cc9da 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/DataFetchers.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/DataFetchers.java @@ -1,36 +1,37 @@ package io.spring.sample.graphql; -import graphql.schema.DataFetcher; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.stereotype.Component; - import java.math.BigDecimal; import java.util.Map; +import graphql.schema.DataFetcher; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Component; + @Component public class DataFetchers { - @Autowired - EmployeeService employeeService; + @Autowired + EmployeeService employeeService; - @Autowired - SalaryService salaryService; + public DataFetcher employeeDataFetcher = env -> { + return employeeService.getAllEmployees(); + }; - public DataFetcher employeeDataFetcher = env -> { - return employeeService.getAllEmployees(); - }; + @Autowired + SalaryService salaryService; - public DataFetcher salaryDataFetcher = env -> { - Employee employee = env.getSource(); - return salaryService.getSalaryForEmployee(employee); - }; + public DataFetcher salaryDataFetcher = env -> { + Employee employee = env.getSource(); + return salaryService.getSalaryForEmployee(employee); + }; - public DataFetcher updateSalaryFetcher = env -> { - Map input = env.getArgument("input"); - String employeeId = input.get("employeeId"); - BigDecimal newSalary = new BigDecimal(input.get("salary")); - salaryService.updateSalary(employeeId, newSalary); - return null; - }; + public DataFetcher updateSalaryFetcher = env -> { + Map input = env.getArgument("input"); + String employeeId = input.get("employeeId"); + BigDecimal newSalary = new BigDecimal(input.get("salary")); + salaryService.updateSalary(employeeId, newSalary); + return null; + }; } diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/Employee.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/Employee.java index e2bc9b69..0737dada 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/Employee.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/Employee.java @@ -2,28 +2,29 @@ package io.spring.sample.graphql; public class Employee { - private String id; - private String name; + private String id; - public Employee(String id, String name) { - this.id = id; - this.name = name; - } + private String name; - public String getId() { - return id; - } + public Employee(String id, String name) { + this.id = id; + this.name = name; + } - public void setId(String id) { - this.id = id; - } + public String getId() { + return id; + } - public String getName() { - return name; - } + public void setId(String id) { + this.id = id; + } - public void setName(String name) { - this.name = name; - } + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } } diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeService.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeService.java index 8d64597c..b131f583 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeService.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeService.java @@ -1,15 +1,15 @@ package io.spring.sample.graphql; -import org.springframework.stereotype.Component; - import java.util.Arrays; import java.util.List; +import org.springframework.stereotype.Component; + @Component public class EmployeeService { - public List getAllEmployees() { - return Arrays.asList(new Employee("1", "Andi")); - } + public List getAllEmployees() { + return Arrays.asList(new Employee("1", "Andi")); + } } diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeServiceApplication.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeServiceApplication.java index 2538c875..a8678a85 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeServiceApplication.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeServiceApplication.java @@ -22,7 +22,7 @@ import org.springframework.boot.autoconfigure.SpringBootApplication; @SpringBootApplication public class EmployeeServiceApplication { - public static void main(String[] args) { - SpringApplication.run(EmployeeServiceApplication.class, args); - } + public static void main(String[] args) { + SpringApplication.run(EmployeeServiceApplication.class, args); + } } diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/GraphQLWiring.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/GraphQLWiring.java index 22f6f5e1..c162c86f 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/GraphQLWiring.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/GraphQLWiring.java @@ -1,6 +1,7 @@ package io.spring.sample.graphql; import graphql.schema.idl.RuntimeWiring; + import org.springframework.beans.factory.annotation.Autowired; import org.springframework.graphql.boot.RuntimeWiringCustomizer; import org.springframework.stereotype.Component; @@ -8,26 +9,26 @@ import org.springframework.stereotype.Component; @Component public class GraphQLWiring implements RuntimeWiringCustomizer { - @Autowired - DataFetchers dataFetchers; + @Autowired + DataFetchers dataFetchers; - @Override - public void customize(RuntimeWiring.Builder builder) { - builder.type("Query", - wiringBuilder -> { - return wiringBuilder. - dataFetcher("employees", dataFetchers.employeeDataFetcher); - }); - builder.type("Employee", - wiringBuilder -> { - return wiringBuilder. - dataFetcher("salary", dataFetchers.salaryDataFetcher); - }); - builder.type("Mutation", - wiringBuilder -> { - return wiringBuilder. - dataFetcher("updateSalary", dataFetchers.updateSalaryFetcher); - }); + @Override + public void customize(RuntimeWiring.Builder builder) { + builder.type("Query", + wiringBuilder -> { + return wiringBuilder. + dataFetcher("employees", dataFetchers.employeeDataFetcher); + }); + builder.type("Employee", + wiringBuilder -> { + return wiringBuilder. + dataFetcher("salary", dataFetchers.salaryDataFetcher); + }); + builder.type("Mutation", + wiringBuilder -> { + return wiringBuilder. + dataFetcher("updateSalary", dataFetchers.updateSalaryFetcher); + }); - } + } } diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/SalaryService.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/SalaryService.java index 6d52b2e4..7cd9fb36 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/SalaryService.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/SalaryService.java @@ -1,23 +1,24 @@ package io.spring.sample.graphql; +import java.math.BigDecimal; + +import reactor.core.publisher.Mono; + import org.springframework.security.access.annotation.Secured; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.stereotype.Component; -import reactor.core.publisher.Mono; - -import java.math.BigDecimal; @Component public class SalaryService { - @PreAuthorize("hasRole('ADMIN')") - public Mono getSalaryForEmployee(Employee employee) { - return Mono.just(new BigDecimal("42")); - } + @PreAuthorize("hasRole('ADMIN')") + public Mono getSalaryForEmployee(Employee employee) { + return Mono.just(new BigDecimal("42")); + } - @Secured({"ROLE_HR"}) - public void updateSalary(String employeeId, BigDecimal newSalary) { + @Secured({ "ROLE_HR" }) + public void updateSalary(String employeeId, BigDecimal newSalary) { - } + } } diff --git a/samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java b/samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java index 1794b022..d0a139f5 100644 --- a/samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java +++ b/samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java @@ -15,25 +15,25 @@ import org.springframework.security.web.server.SecurityWebFilterChain; @EnableReactiveMethodSecurity public class SecurityConfig { - @Bean - SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception { - http.csrf().disable(); - return http - // Demonstrate that method security works - // Best practice to use both for defense in depth - .authorizeExchange() - .anyExchange().permitAll() - .and() - .httpBasic().and() - .build(); - } + @Bean + SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception { + http.csrf().disable(); + return http + // Demonstrate that method security works + // Best practice to use both for defense in depth + .authorizeExchange() + .anyExchange().permitAll() + .and() + .httpBasic().and() + .build(); + } - @Bean - public MapReactiveUserDetailsService userDetailsService() { - User.UserBuilder userBuilder = User.withDefaultPasswordEncoder(); - UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build(); - UserDetails admin = userBuilder.username("admin").password("admin").roles("USER", "ADMIN").build(); - return new MapReactiveUserDetailsService(rob, admin); - } + @Bean + public MapReactiveUserDetailsService userDetailsService() { + User.UserBuilder userBuilder = User.withDefaultPasswordEncoder(); + UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build(); + UserDetails admin = userBuilder.username("admin").password("admin").roles("USER", "ADMIN").build(); + return new MapReactiveUserDetailsService(rob, admin); + } } diff --git a/samples/webflux-security/src/test/java/io/spring/sample/graphql/EmployeeServiceApplicationTest.java b/samples/webflux-security/src/test/java/io/spring/sample/graphql/EmployeeServiceApplicationTest.java index e37caa49..bb1a4bc9 100644 --- a/samples/webflux-security/src/test/java/io/spring/sample/graphql/EmployeeServiceApplicationTest.java +++ b/samples/webflux-security/src/test/java/io/spring/sample/graphql/EmployeeServiceApplicationTest.java @@ -15,103 +15,103 @@ import java.util.Collections; @SpringBootTest() class EmployeeServiceApplicationTest { - @Autowired - private ReactiveWebApplicationContext context; - private static final String BASE_URL = "https://spring.example.org/graphql"; + @Autowired + private ReactiveWebApplicationContext context; + private static final String BASE_URL = "https://spring.example.org/graphql"; - WebTestClient client; + WebTestClient client; - @BeforeEach - public void setup() { - this.client = WebTestClient - .bindToApplicationContext(this.context) - .apply(SecurityMockServerConfigurers.springSecurity()) - .configureClient() - .filter(ExchangeFilterFunctions.basicAuthentication()) - .defaultHeaders(headers -> { - headers.setContentType(MediaType.APPLICATION_JSON); - headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON)); - }) - .baseUrl(BASE_URL) - .build(); - } + @BeforeEach + public void setup() { + this.client = WebTestClient + .bindToApplicationContext(this.context) + .apply(SecurityMockServerConfigurers.springSecurity()) + .configureClient() + .filter(ExchangeFilterFunctions.basicAuthentication()) + .defaultHeaders(headers -> { + headers.setContentType(MediaType.APPLICATION_JSON); + headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON)); + }) + .baseUrl(BASE_URL) + .build(); + } - @Test - void canQueryName() { - String query = "{" + - " employees{ " + - " name" + - " }" + - "}"; + @Test + void canQueryName() { + String query = "{" + + " employees{ " + + " name" + + " }" + + "}"; - client.post().uri("") - .bodyValue("{ \"query\": \"" + query + "\"}") - .exchange() - .expectStatus().isOk() - .expectBody().jsonPath("data.employees[0].name").isEqualTo("Andi"); + client.post().uri("") + .bodyValue("{ \"query\": \"" + query + "\"}") + .exchange() + .expectStatus().isOk() + .expectBody().jsonPath("data.employees[0].name").isEqualTo("Andi"); - } + } - @Test - void canNotQuerySalary() { - String query = "{" + - " employees{ " + - " name" + - " salary" + - " }" + - "}"; + @Test + void canNotQuerySalary() { + String query = "{" + + " employees{ " + + " name" + + " salary" + + " }" + + "}"; - client.post().uri("") - .bodyValue("{ \"query\": \"" + query + "\"}") - .exchange() - .expectStatus().isOk() - .expectBody() - .jsonPath("data.employees[0].name").isEqualTo("Andi") - .jsonPath("data.employees[0].salary").doesNotExist(); + client.post().uri("") + .bodyValue("{ \"query\": \"" + query + "\"}") + .exchange() + .expectStatus().isOk() + .expectBody() + .jsonPath("data.employees[0].name").isEqualTo("Andi") + .jsonPath("data.employees[0].salary").doesNotExist(); - } + } - @Test - void canQuerySalaryAsAdmin() { - String query = "{" + - " employees{ " + - " name" + - " salary" + - " }" + - "}"; + @Test + void canQuerySalaryAsAdmin() { + String query = "{" + + " employees{ " + + " name" + + " salary" + + " }" + + "}"; - client.post().uri("") - .headers(h -> h.setBasicAuth("admin", "admin")) - .bodyValue("{ \"query\": \"" + query + "\"}") - .exchange() - .expectStatus().isOk() - .expectBody() - .jsonPath("data.employees[0].name").isEqualTo("Andi") - .jsonPath("data.employees[0].salary").isEqualTo("42"); + client.post().uri("") + .headers(h -> h.setBasicAuth("admin", "admin")) + .bodyValue("{ \"query\": \"" + query + "\"}") + .exchange() + .expectStatus().isOk() + .expectBody() + .jsonPath("data.employees[0].name").isEqualTo("Andi") + .jsonPath("data.employees[0].salary").isEqualTo("42"); - } + } - @Test - void invalidCredentials() { - String query = "{" + - " employees{ " + - " name" + - " salary" + - " }" + - "}"; + @Test + void invalidCredentials() { + String query = "{" + + " employees{ " + + " name" + + " salary" + + " }" + + "}"; - client.post().uri("") - .headers(h -> h.setBasicAuth("admin", "INVALID")) - .bodyValue("{ \"query\": \"" + query + "\"}") - .exchange() - .expectStatus().isUnauthorized() - .expectBody() - .isEmpty(); + client.post().uri("") + .headers(h -> h.setBasicAuth("admin", "INVALID")) + .bodyValue("{ \"query\": \"" + query + "\"}") + .exchange() + .expectStatus().isUnauthorized() + .expectBody() + .isEmpty(); - } + } } \ No newline at end of file