Spring/spring-graphql
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add webmvc-http-security

Browse Source 
Closes gh-58
This commit is contained in:
Rob Winch
2021-06-22 17:12:42 -05:00
parent 5822f7d357
commit 7d854dbf47
14 changed files with 488 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/Employee.java Normal file
View File

@@ -0,0 +1,30 @@
package io.spring.sample.graphql;
public class Employee {
private String id;
private String name;
public Employee(String id, String name) {
this.id = id;
this.name = name;
}
public String getId() {
return id;
}
public void setId(String id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}

15
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/EmployeeService.java Normal file
View File

@@ -0,0 +1,15 @@
package io.spring.sample.graphql;
import java.util.Arrays;
import java.util.List;
import org.springframework.stereotype.Component;
@Component
public class EmployeeService {
public List<Employee> getAllEmployees() {
return Arrays.asList(new Employee("1", "Andi"));
}
}

24
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/SalaryService.java Normal file
View File

@@ -0,0 +1,24 @@
package io.spring.sample.graphql;
import java.math.BigDecimal;
import reactor.core.publisher.Mono;
import org.springframework.security.access.annotation.Secured;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Component;
@Component
public class SalaryService {
@PreAuthorize("hasRole('ADMIN')")
public BigDecimal getSalaryForEmployee(Employee employee) {
return new BigDecimal("42");
}
@Secured({ "ROLE_HR" })
public void updateSalary(String employeeId, BigDecimal newSalary) {
}
}

28
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/SampleApplication.java Normal file
View File

@@ -0,0 +1,28 @@
/*
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class SampleApplication {
public static void main(String[] args) {
SpringApplication.run(SampleApplication.class, args);
}
}

48
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/SampleWiring.java Normal file
View File

@@ -0,0 +1,48 @@
package io.spring.sample.graphql;
import java.math.BigDecimal;
import java.util.Map;
import graphql.schema.idl.RuntimeWiring;
import org.springframework.graphql.boot.RuntimeWiringCustomizer;
import org.springframework.stereotype.Component;
@Component
public class SampleWiring implements RuntimeWiringCustomizer {
final EmployeeService employeeService;
final SalaryService salaryService;
public SampleWiring(EmployeeService employeeService, SalaryService salaryService) {
this.employeeService = employeeService;
this.salaryService = salaryService;
}
@Override
public void customize(RuntimeWiring.Builder builder) {
builder.type("Query", wiringBuilder ->
wiringBuilder.dataFetcher("employees", env ->
employeeService.getAllEmployees()
)
);
builder.type("Employee", wiringBuilder ->
wiringBuilder.dataFetcher("salary", env -> {
Employee employee = env.getSource();
return salaryService.getSalaryForEmployee(employee);
})
);
builder.type("Mutation", wiringBuilder ->
wiringBuilder.dataFetcher("updateSalary", env -> {
Map<String, String> input = env.getArgument("input");
String employeeId = input.get("employeeId");
BigDecimal newSalary = new BigDecimal(input.get("salary"));
salaryService.updateSalary(employeeId, newSalary);
return null;
})
);
}
}

41
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java Normal file
View File

@@ -0,0 +1,41 @@
package io.spring.sample.graphql;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.DefaultSecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
@Bean
DefaultSecurityFilterChain springWebFilterChain(HttpSecurity http) throws Exception {
return http
.csrf(c -> c.disable())
// Demonstrate that method security works
// Best practice to use both for defense in depth
.authorizeRequests(requests -> requests
.anyRequest().permitAll()
)
.httpBasic(withDefaults())
.build();
}
@Bean
public static InMemoryUserDetailsManager userDetailsService() {
User.UserBuilder userBuilder = User.withDefaultPasswordEncoder();
UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build();
UserDetails admin = userBuilder.username("admin").password("admin").roles("USER", "ADMIN").build();
return new InMemoryUserDetailsManager(rob, admin);
}
}

31
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/SecurityContextThreadLocalAccessor.java Normal file
View File

@@ -0,0 +1,31 @@
package io.spring.sample.graphql;
import org.springframework.graphql.execution.ThreadLocalAccessor;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import java.util.Map;
@Component
public class SecurityContextThreadLocalAccessor implements ThreadLocalAccessor {
private static final String KEY = SecurityContext.class.getName();
@Override
public void extractValues(Map<String, Object> container) {
container.put(KEY, SecurityContextHolder.getContext());
}
@Override
public void restoreValues(Map<String, Object> values) {
if (values.containsKey(KEY)) {
SecurityContextHolder.setContext((SecurityContext) values.get(KEY));
}
}
@Override
public void resetValues(Map<String, Object> values) {
SecurityContextHolder.clearContext();
}
}

63
samples/webmvc-http-security/src/main/java/io/spring/sample/graphql/SecurityDataFetcherExceptionResolver.java Normal file
View File

@@ -0,0 +1,63 @@
package io.spring.sample.graphql;
import graphql.GraphQLError;
import graphql.GraphqlErrorBuilder;
import graphql.schema.DataFetchingEnvironment;
import org.springframework.graphql.execution.ErrorType;
import org.springframework.graphql.execution.SyncDataFetcherExceptionResolver;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.util.Assert;
import java.util.Arrays;
import java.util.List;
@Component
public class SecurityDataFetcherExceptionResolver implements SyncDataFetcherExceptionResolver {
private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
@Override
public List<GraphQLError> doResolveException(Throwable exception, DataFetchingEnvironment environment) {
if (exception instanceof AuthenticationException) {
return unauthorized(environment);
}
if (exception instanceof AccessDeniedException) {
SecurityContext context = SecurityContextHolder.getContext();
Authentication authentication = context.getAuthentication();
if (this.authenticationTrustResolver.isAnonymous(authentication)) {
return unauthorized(environment);
}
return forbidden(environment);
}
return null;
}
public void setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver) {
Assert.notNull(authenticationTrustResolver, "authenticationTrustResolver cannot be null");
this.authenticationTrustResolver = authenticationTrustResolver;
}
private List<GraphQLError> unauthorized(DataFetchingEnvironment environment) {
return Arrays.asList(
GraphqlErrorBuilder.newError(environment)
.errorType(ErrorType.UNAUTHORIZED)
.message("Unauthorized")
.build());
}
private List<GraphQLError> forbidden(DataFetchingEnvironment environment) {
return Arrays.asList(
GraphqlErrorBuilder.newError(environment)
.errorType(ErrorType.FORBIDDEN)
.message("Forbidden")
.build());
}
}