zhouxy108/wisemapping-open-source
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix rest auth. Review filters.

Browse Source
This commit is contained in:
Paulo Gustavo Veiga
2024-01-15 07:59:04 -08:00
parent 2f32ef66e9
commit 03a6c0ef8b
8 changed files with 74 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
wise-webapp/src/main/java/com/wisemapping/config/rest/RestAppConfig.java
View File

@@ -4,7 +4,10 @@ import org.jetbrains.annotations.NotNull;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.ImportResource;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -13,32 +16,43 @@ import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.springframework.security.config.Customizer.withDefaults;
@SpringBootApplication
@EnableWebSecurity
@ComponentScan("com.wisemapping.rest")
@ImportResource(value = {"classpath:spring/wisemapping-service.xml"})
@ComponentScan({"com.wisemapping.rest"})
public class RestAppConfig {
@Bean
@Order(2)
SecurityFilterChain apiSecurityFilterChain(@NotNull final HttpSecurity http, @NotNull final HandlerMappingIntrospector introspector) throws Exception {
final MvcRequestMatcher.Builder matcher = new MvcRequestMatcher.Builder(introspector).servletPath("/service");
return http
.securityMatchers((matchers) ->
matchers.requestMatchers(matcher.pattern(("/**"))))
.authorizeHttpRequests(auth ->
auth
.requestMatchers(matcher.pattern("/users/")).permitAll()
.requestMatchers(matcher.pattern("/users/resetPassword")).permitAll()
.requestMatchers(matcher.pattern("/oauth2/googlecallback")).permitAll()
.requestMatchers(matcher.pattern("/oauth2/confirmaccountsync")).permitAll()
.requestMatchers(matcher.pattern("/admin/**")).hasAnyRole("ADMIN")
.requestMatchers(matcher.pattern("/**")).hasAnyRole("USER", "ADMIN")
)
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.httpBasic(httpBasic -> {
})
.csrf(AbstractHttpConfigurer::disable)
.build();
// final MvcRequestMatcher.Builder matcher = new MvcRequestMatcher.Builder(introspector).servletPath("**");
// return http
// .securityMatchers((matchers) ->
// matchers.requestMatchers(matcher.pattern(("/**"))))
// .authorizeHttpRequests(auth -> auth
// .requestMatchers(matcher.pattern("api/restfull/users/")).permitAll()
// .requestMatchers(matcher.pattern("api/restfull/users/resetPassword")).permitAll()
// .requestMatchers(matcher.pattern("api/restfull/oauth2/googlecallback")).permitAll()
// .requestMatchers(matcher.pattern("api/restfull/oauth2/confirmaccountsync")).permitAll()
// .requestMatchers(matcher.pattern("api/restfull/admin/**")).hasAnyRole("ADMIN")
// .requestMatchers(matcher.pattern("/**"))
// .authenticated()
//// .hasAnyRole("USER", "ADMIN")
// )
// .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
// .httpBasic(withDefaults())
// .csrf(AbstractHttpConfigurer::disable)
// .build();
http.csrf().disable()
.authorizeHttpRequests()
.anyRequest()
.authenticated()
.and()
.httpBasic(withDefaults());
return http.build();
}
}