Spring/spring-graphql
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing webflux-security

Browse Source
This commit is contained in:
Rossen Stoyanchev
2021-06-25 14:06:35 +01:00
parent de234c94c4
commit ed767d1a70
8 changed files with 121 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
samples/webflux-security/src/main/java/io/spring/sample/graphql/Employee.java
View File

@@ -1,3 +1,18 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
public class Employee {

15
samples/webflux-security/src/main/java/io/spring/sample/graphql/EmployeeService.java
View File

@@ -1,3 +1,18 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import java.util.Arrays;

18
samples/webflux-security/src/main/java/io/spring/sample/graphql/SalaryService.java
View File

@@ -1,3 +1,18 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import java.math.BigDecimal;
@@ -19,6 +34,7 @@ public class SalaryService {
@Secured({ "ROLE_HR" })
public void updateSalary(String employeeId, BigDecimal newSalary) {
// empty
}
}

2
samples/webflux-security/src/main/java/io/spring/sample/graphql/SampleApplication.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.

34
samples/webflux-security/src/main/java/io/spring/sample/graphql/SampleWiring.java
View File

@@ -1,3 +1,18 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import java.math.BigDecimal;
@@ -23,23 +38,18 @@ public class SampleWiring implements RuntimeWiringCustomizer {
@Override
public void customize(RuntimeWiring.Builder builder) {
builder.type("Query", wiringBuilder ->
wiringBuilder.dataFetcher("employees", env ->
employeeService.getAllEmployees()
)
builder.type("Query", wiring ->
wiring.dataFetcher("employees", env -> this.employeeService.getAllEmployees())
);
builder.type("Employee", wiringBuilder ->
wiringBuilder.dataFetcher("salary", env -> {
Employee employee = env.getSource();
return salaryService.getSalaryForEmployee(employee);
})
builder.type("Employee", wiring ->
wiring.dataFetcher("salary", env -> this.salaryService.getSalaryForEmployee(env.getSource()))
);
builder.type("Mutation", wiringBuilder ->
wiringBuilder.dataFetcher("updateSalary", env -> {
builder.type("Mutation", wiring ->
wiring.dataFetcher("updateSalary", env -> {
Map<String, String> input = env.getArgument("input");
String employeeId = input.get("employeeId");
BigDecimal newSalary = new BigDecimal(input.get("salary"));
salaryService.updateSalary(employeeId, newSalary);
this.salaryService.updateSalary(employeeId, newSalary);
return null;
})
);

22
samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityConfig.java
View File

@@ -1,3 +1,18 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import org.springframework.context.annotation.Bean;
@@ -20,17 +35,16 @@ public class SecurityConfig {
@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
return http
.csrf(c -> c.disable())
.csrf(spec -> spec.disable())
// Demonstrate that method security works
// Best practice to use both for defense in depth
.authorizeExchange(requests -> requests
.anyExchange().permitAll()
)
.authorizeExchange(requests -> requests.anyExchange().permitAll())
.httpBasic(withDefaults())
.build();
}
@Bean
@SuppressWarnings("deprecation")
public MapReactiveUserDetailsService userDetailsService() {
User.UserBuilder userBuilder = User.withDefaultPasswordEncoder();
UserDetails rob = userBuilder.username("rob").password("rob").roles("USER").build();

20
samples/webflux-security/src/main/java/io/spring/sample/graphql/SecurityDataFetcherExceptionResolver.java
View File

@@ -1,6 +1,22 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import graphql.GraphQLError;
@@ -47,7 +63,7 @@ public class SecurityDataFetcherExceptionResolver implements DataFetcherExceptio
}
private Mono<List<GraphQLError>> unauthorized(DataFetchingEnvironment environment) {
return Mono.fromCallable(() -> Arrays.asList(
return Mono.fromCallable(() -> Collections.singletonList(
GraphqlErrorBuilder.newError(environment)
.errorType(ErrorType.UNAUTHORIZED)
.message("Unauthorized")
@@ -55,7 +71,7 @@ public class SecurityDataFetcherExceptionResolver implements DataFetcherExceptio
}
private Mono<List<GraphQLError>> forbidden(DataFetchingEnvironment environment) {
return Mono.fromCallable(() -> Arrays.asList(
return Mono.fromCallable(() -> Collections.singletonList(
GraphqlErrorBuilder.newError(environment)
.errorType(ErrorType.FORBIDDEN)
.message("Forbidden")

15
samples/webflux-security/src/test/java/io/spring/sample/graphql/SampleApplicationTests.java
View File

@@ -1,3 +1,18 @@
/*
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package io.spring.sample.graphql;
import java.util.Collections;