Spring/spring-graphql
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Move classes from security to execution package

Browse Source 
Security classes should be integrated in their respective areas by
functionality rather than exist as a separate, external layer.
This commit is contained in:
rstoyanchev
2022-02-10 12:37:13 +00:00
parent 6df6ab78c8
commit 30f86d74f2
7 changed files with 49 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
spring-graphql/src/main/java/org/springframework/graphql/security/ReactiveSecurityDataFetcherExceptionResolver.java → spring-graphql/src/main/java/org/springframework/graphql/execution/ReactiveSecurityDataFetcherExceptionResolver.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2021 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.graphql.security;
package org.springframework.graphql.execution;
import java.util.Collections;
import java.util.List;
@@ -22,9 +22,9 @@ import graphql.GraphQLError;
import graphql.schema.DataFetchingEnvironment;
import reactor.core.publisher.Mono;
import org.springframework.graphql.execution.DataFetcherExceptionResolver;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
@@ -40,36 +40,32 @@ import org.springframework.security.core.context.ReactiveSecurityContextHolder;
*/
public class ReactiveSecurityDataFetcherExceptionResolver implements DataFetcherExceptionResolver {
private final ExceptionResolverDelegate resolverDelegate = new ExceptionResolverDelegate();
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
/**
* Set the resolver to use to check if an authentication is anonymous that
* in turn determines whether {@code AccessDeniedException} is classified
* as "unauthorized" or "forbidden".
* @param resolver the resolver to use
* @param trustResolver the resolver to use
*/
public void setAuthenticationTrustResolver(AuthenticationTrustResolver resolver) {
this.resolverDelegate.setAuthenticationTrustResolver(resolver);
public void setAuthenticationTrustResolver(AuthenticationTrustResolver trustResolver) {
this.trustResolver = trustResolver;
}
@Override
public Mono<List<GraphQLError>> resolveException(Throwable ex, DataFetchingEnvironment env) {
public Mono<List<GraphQLError>> resolveException(Throwable ex, DataFetchingEnvironment environment) {
if (ex instanceof AuthenticationException) {
GraphQLError error = this.resolverDelegate.resolveUnauthorized(env);
GraphQLError error = SecurityExceptionResolverUtils.resolveUnauthorized(environment);
return Mono.just(Collections.singletonList(error));
}
if (ex instanceof AccessDeniedException) {
return ReactiveSecurityContextHolder.getContext()
.map(context -> {
GraphQLError error = this.resolverDelegate.resolveAccessDenied(env, context);
return Collections.singletonList(error);
})
.switchIfEmpty(Mono.fromCallable(() -> {
GraphQLError error = this.resolverDelegate.resolveUnauthorized(env);
return Collections.singletonList(error);
}));
.map(context -> Collections.singletonList(
SecurityExceptionResolverUtils.resolveAccessDenied(environment, this.trustResolver, context)))
.switchIfEmpty(Mono.fromCallable(() -> Collections.singletonList(
SecurityExceptionResolverUtils.resolveUnauthorized(environment))));
}
return Mono.empty();
}

18
spring-graphql/src/main/java/org/springframework/graphql/security/SecurityContextThreadLocalAccessor.java → spring-graphql/src/main/java/org/springframework/graphql/execution/SecurityContextThreadLocalAccessor.java
View File

@@ -1,8 +1,22 @@
package org.springframework.graphql.security;
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.graphql.execution;
import java.util.Map;
import org.springframework.graphql.execution.ThreadLocalAccessor;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;

20
spring-graphql/src/main/java/org/springframework/graphql/security/SecurityDataFetcherExceptionResolver.java → spring-graphql/src/main/java/org/springframework/graphql/execution/SecurityDataFetcherExceptionResolver.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2021 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,14 +13,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.graphql.security;
package org.springframework.graphql.execution;
import graphql.GraphQLError;
import graphql.schema.DataFetchingEnvironment;
import org.springframework.graphql.execution.DataFetcherExceptionResolverAdapter;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
@@ -36,7 +36,7 @@ import org.springframework.security.core.context.SecurityContextHolder;
*/
public class SecurityDataFetcherExceptionResolver extends DataFetcherExceptionResolverAdapter {
private final ExceptionResolverDelegate resolverDelegate = new ExceptionResolverDelegate();
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
public SecurityDataFetcherExceptionResolver() {
@@ -48,21 +48,21 @@ public class SecurityDataFetcherExceptionResolver extends DataFetcherExceptionRe
* Set the resolver to use to check if an authentication is anonymous that
* in turn determines whether {@code AccessDeniedException} is classified
* as "unauthorized" or "forbidden".
* @param resolver the resolver to use
* @param trustResolver the resolver to use
*/
public void setAuthenticationTrustResolver(AuthenticationTrustResolver resolver) {
this.resolverDelegate.setAuthenticationTrustResolver(resolver);
public void setAuthenticationTrustResolver(AuthenticationTrustResolver trustResolver) {
this.trustResolver = trustResolver;
}
@Override
protected GraphQLError resolveToSingleError(Throwable ex, DataFetchingEnvironment env) {
protected GraphQLError resolveToSingleError(Throwable ex, DataFetchingEnvironment environment) {
if (ex instanceof AuthenticationException) {
return this.resolverDelegate.resolveUnauthorized(env);
return SecurityExceptionResolverUtils.resolveUnauthorized(environment);
}
if (ex instanceof AccessDeniedException) {
SecurityContext securityContext = SecurityContextHolder.getContext();
return this.resolverDelegate.resolveAccessDenied(env, securityContext);
return SecurityExceptionResolverUtils.resolveAccessDenied(environment, this.trustResolver, securityContext);
}
return null;
}

25
spring-graphql/src/main/java/org/springframework/graphql/security/ExceptionResolverDelegate.java → spring-graphql/src/main/java/org/springframework/graphql/execution/SecurityExceptionResolverUtils.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2021 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,17 +13,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.graphql.security;
package org.springframework.graphql.execution;
import graphql.GraphQLError;
import graphql.GraphqlErrorBuilder;
import graphql.schema.DataFetchingEnvironment;
import org.springframework.graphql.execution.ErrorType;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.util.Assert;
/**
* Package private delegate class shared by the reactive and non-reactive resolver types.
@@ -31,25 +28,19 @@ import org.springframework.util.Assert;
* @author Rossen Stoyanchev
* @since 1.0.0
*/
class ExceptionResolverDelegate {
class SecurityExceptionResolverUtils {
private AuthenticationTrustResolver resolver = new AuthenticationTrustResolverImpl();
public void setAuthenticationTrustResolver(AuthenticationTrustResolver resolver) {
Assert.notNull(resolver, "AuthenticationTrustResolver is required");
this.resolver = resolver;
}
public GraphQLError resolveUnauthorized(DataFetchingEnvironment environment) {
static GraphQLError resolveUnauthorized(DataFetchingEnvironment environment) {
return GraphqlErrorBuilder.newError(environment)
.errorType(ErrorType.UNAUTHORIZED)
.message("Unauthorized")
.build();
}
public GraphQLError resolveAccessDenied(DataFetchingEnvironment env, SecurityContext securityContext) {
return this.resolver.isAnonymous(securityContext.getAuthentication()) ?
static GraphQLError resolveAccessDenied(
DataFetchingEnvironment env, AuthenticationTrustResolver resolver, SecurityContext securityContext) {
return resolver.isAnonymous(securityContext.getAuthentication()) ?
resolveUnauthorized(env) :
GraphqlErrorBuilder.newError(env)
.errorType(ErrorType.FORBIDDEN)

25
spring-graphql/src/main/java/org/springframework/graphql/security/package-info.java
View File

@@ -1,25 +0,0 @@
/*
* Copyright 2020-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/**
* Spring Security support for GraphQL.
*/
@NonNullApi
@NonNullFields
package org.springframework.graphql.security;
import org.springframework.lang.NonNullApi;
import org.springframework.lang.NonNullFields;

2
spring-graphql/src/test/java/org/springframework/graphql/data/method/annotation/support/BatchMappingPrincipalMethodArgumentResolverTests.java
View File

@@ -35,7 +35,7 @@ import org.springframework.graphql.RequestInput;
import org.springframework.graphql.RequestOutput;
import org.springframework.graphql.data.method.annotation.BatchMapping;
import org.springframework.graphql.execution.ReactorContextManager;
import org.springframework.graphql.security.SecurityContextThreadLocalAccessor;
import org.springframework.graphql.execution.SecurityContextThreadLocalAccessor;
import org.springframework.lang.Nullable;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.Authentication;

2
spring-graphql/src/test/java/org/springframework/graphql/data/method/annotation/support/SchemaMappingPrincipalMethodArgumentResolverTests.java
View File

@@ -39,7 +39,7 @@ import org.springframework.graphql.data.method.annotation.QueryMapping;
import org.springframework.graphql.data.method.annotation.SubscriptionMapping;
import org.springframework.graphql.execution.ExecutionGraphQlService;
import org.springframework.graphql.execution.ReactorContextManager;
import org.springframework.graphql.security.SecurityContextThreadLocalAccessor;
import org.springframework.graphql.execution.SecurityContextThreadLocalAccessor;
import org.springframework.lang.Nullable;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.Authentication;