1
|
package cz.zcu.kiv.backendapi.security;
|
2
|
|
3
|
import cz.zcu.kiv.backendapi.security.jwt.JwtTokenVerifier;
|
4
|
import cz.zcu.kiv.backendapi.security.jwt.JwtUsernameAndPasswordAuthenticationFilter;
|
5
|
import cz.zcu.kiv.backendapi.security.jwt.JwtUtils;
|
6
|
import cz.zcu.kiv.backendapi.user.Role;
|
7
|
import cz.zcu.kiv.backendapi.user.permission.Permission;
|
8
|
import lombok.RequiredArgsConstructor;
|
9
|
import org.springframework.context.annotation.Bean;
|
10
|
import org.springframework.context.annotation.Configuration;
|
11
|
import org.springframework.http.HttpMethod;
|
12
|
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
|
13
|
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
14
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
15
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
16
|
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
17
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
18
|
import org.springframework.security.core.userdetails.UserDetailsService;
|
19
|
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
20
|
import org.springframework.web.cors.CorsConfiguration;
|
21
|
import org.springframework.web.cors.CorsConfigurationSource;
|
22
|
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
|
23
|
|
24
|
import java.util.HashMap;
|
25
|
import java.util.Map;
|
26
|
|
27
|
/**
|
28
|
* Security config class
|
29
|
*/
|
30
|
@Configuration
|
31
|
@EnableWebSecurity
|
32
|
@RequiredArgsConstructor
|
33
|
public class SecurityConfig extends WebSecurityConfigurerAdapter {
|
34
|
|
35
|
/**
|
36
|
* Map of permitted endpoints with HTTP method (user does not need to be authenticated perform the request)
|
37
|
*/
|
38
|
private static final Map<String, HttpMethod> PERMITTED_ENDPOINTS;
|
39
|
|
40
|
/**
|
41
|
* User detail service
|
42
|
*/
|
43
|
private final UserDetailsService userDetailsService;
|
44
|
|
45
|
/**
|
46
|
* Password encoder
|
47
|
*/
|
48
|
private final BCryptPasswordEncoder bCryptPasswordEncoder;
|
49
|
|
50
|
/**
|
51
|
* JWT utils
|
52
|
*/
|
53
|
private final JwtUtils jwtUtils;
|
54
|
|
55
|
static {
|
56
|
PERMITTED_ENDPOINTS = new HashMap<>();
|
57
|
PERMITTED_ENDPOINTS.put("/login", HttpMethod.POST);
|
58
|
PERMITTED_ENDPOINTS.put("/users/token", HttpMethod.GET);
|
59
|
PERMITTED_ENDPOINTS.put("/swagger-ui/**", HttpMethod.GET);
|
60
|
PERMITTED_ENDPOINTS.put("/swagger-ui.html", HttpMethod.GET);
|
61
|
PERMITTED_ENDPOINTS.put("/v3/api-docs", HttpMethod.GET);
|
62
|
PERMITTED_ENDPOINTS.put("/v3/api-docs/swagger-config", HttpMethod.GET);
|
63
|
PERMITTED_ENDPOINTS.put("/catalog-items", HttpMethod.GET);
|
64
|
PERMITTED_ENDPOINTS.put("/catalog-items/**", HttpMethod.GET);
|
65
|
PERMITTED_ENDPOINTS.put("/title-page", HttpMethod.GET);
|
66
|
PERMITTED_ENDPOINTS.put("/sources", HttpMethod.GET);
|
67
|
}
|
68
|
|
69
|
/**
|
70
|
* Security configuration
|
71
|
*
|
72
|
* @param http http security
|
73
|
* @throws Exception exception
|
74
|
*/
|
75
|
// TODO configure and check rights
|
76
|
@Override
|
77
|
protected void configure(HttpSecurity http) throws Exception {
|
78
|
http.csrf().disable()
|
79
|
.cors()
|
80
|
.and()
|
81
|
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
82
|
.and()
|
83
|
.addFilter(new JwtUsernameAndPasswordAuthenticationFilter(authenticationManager(), jwtUtils))
|
84
|
.addFilterAfter(new JwtTokenVerifier(jwtUtils, PERMITTED_ENDPOINTS), JwtUsernameAndPasswordAuthenticationFilter.class)
|
85
|
.authorizeRequests()
|
86
|
.antMatchers(HttpMethod.GET, PERMITTED_ENDPOINTS.keySet().stream().filter(k -> PERMITTED_ENDPOINTS.get(k).equals(HttpMethod.GET)).toArray(String[]::new)).permitAll()
|
87
|
.antMatchers(HttpMethod.POST, "/login").permitAll()
|
88
|
.antMatchers("/external-catalog-items").hasRole(Role.ADMIN.name())
|
89
|
.antMatchers(HttpMethod.PATCH, "/users/*/permissions", "/users/*/password").hasRole(Role.ADMIN.name())
|
90
|
.antMatchers(HttpMethod.DELETE, "/users/**").hasRole(Role.ADMIN.name())
|
91
|
.antMatchers(HttpMethod.GET, "/users").hasRole(Role.ADMIN.name())
|
92
|
.antMatchers(HttpMethod.GET, "/path").hasAuthority(Permission.READ.name())
|
93
|
.antMatchers(HttpMethod.POST, "/catalog-items").hasAuthority(Permission.WRITE.name())
|
94
|
.antMatchers(HttpMethod.PUT, "/catalog-items/*").hasAuthority(Permission.WRITE.name())
|
95
|
.antMatchers(HttpMethod.DELETE, "/catalog-items/*").hasAuthority(Permission.DELETE.name())
|
96
|
.antMatchers(HttpMethod.POST, "/title-page", "/sources").hasRole(Role.ADMIN.name())
|
97
|
.anyRequest()
|
98
|
.authenticated();
|
99
|
}
|
100
|
|
101
|
/**
|
102
|
* Sets authentication provider to authentication manager
|
103
|
*
|
104
|
* @param auth authentication manager builder
|
105
|
*/
|
106
|
@Override
|
107
|
protected void configure(final AuthenticationManagerBuilder auth) {
|
108
|
auth.authenticationProvider(authenticationProvider());
|
109
|
}
|
110
|
|
111
|
|
112
|
/**
|
113
|
* Returns authentication provider
|
114
|
*
|
115
|
* @return authentication provider
|
116
|
*/
|
117
|
@Bean
|
118
|
public DaoAuthenticationProvider authenticationProvider() {
|
119
|
final DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
|
120
|
provider.setUserDetailsService(userDetailsService);
|
121
|
provider.setPasswordEncoder(bCryptPasswordEncoder);
|
122
|
return provider;
|
123
|
}
|
124
|
|
125
|
@Bean
|
126
|
CorsConfigurationSource corsConfigurationSource() {
|
127
|
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
128
|
source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
|
129
|
return source;
|
130
|
}
|
131
|
}
|