Skip to content

Commit 446ab50

Browse files
ysavchenjzheaux
ysavchen
authored and
jzheaux
committed
Add authorizeHttpRequests to Kotlin DSL
Closes gh-10481
1 parent 3016ed0 commit 446ab50

File tree

5 files changed

+1063
-31
lines changed

5 files changed

+1063
-31
lines changed

‎config/src/main/kotlin/org/springframework/security/config/web/servlet/AbstractRequestMatcherDsl.kt

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,6 +17,8 @@
1717
package org.springframework.security.config.web.servlet
1818

1919
import org.springframework.http.HttpMethod
20+
import org.springframework.security.authorization.AuthorizationManager
21+
import org.springframework.security.web.access.intercept.RequestAuthorizationContext
2022
import org.springframework.security.web.util.matcher.AnyRequestMatcher
2123
import org.springframework.security.web.util.matcher.RequestMatcher
2224

@@ -36,14 +38,25 @@ abstract class AbstractRequestMatcherDsl {
3638
protected data class MatcherAuthorizationRule(val matcher: RequestMatcher,
3739
override val rule: String) : AuthorizationRule(rule)
3840

41+
protected data class MatcherAuthorizationManagerRule(val matcher: RequestMatcher,
42+
override val rule: AuthorizationManager<RequestAuthorizationContext>) : AuthorizationManagerRule(rule)
43+
3944
protected data class PatternAuthorizationRule(val pattern: String,
4045
val patternType: PatternType,
4146
val servletPath: String? = null,
4247
val httpMethod: HttpMethod? = null,
4348
override val rule: String) : AuthorizationRule(rule)
4449

50+
protected data class PatternAuthorizationManagerRule(val pattern: String,
51+
val patternType: PatternType,
52+
val servletPath: String? = null,
53+
val httpMethod: HttpMethod? = null,
54+
override val rule: AuthorizationManager<RequestAuthorizationContext>) : AuthorizationManagerRule(rule)
55+
4556
protected abstract class AuthorizationRule(open val rule: String)
4657

58+
protected abstract class AuthorizationManagerRule(open val rule: AuthorizationManager<RequestAuthorizationContext>)
59+
4760
protected enum class PatternType {
4861
ANT, MVC
4962
}

‎config/src/main/kotlin/org/springframework/security/config/web/servlet/AuthorizeHttpRequestsDsl.kt

Lines changed: 253 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,253 @@
1+
/*
2+
* Copyright 2002-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.config.web.servlet
18+
19+
import org.springframework.http.HttpMethod
20+
import org.springframework.security.authorization.AuthenticatedAuthorizationManager
21+
import org.springframework.security.authorization.AuthorityAuthorizationManager
22+
import org.springframework.security.authorization.AuthorizationDecision
23+
import org.springframework.security.authorization.AuthorizationManager
24+
import org.springframework.security.config.annotation.web.builders.HttpSecurity
25+
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer
26+
import org.springframework.security.core.Authentication
27+
import org.springframework.security.web.access.intercept.RequestAuthorizationContext
28+
import org.springframework.security.web.util.matcher.AnyRequestMatcher
29+
import org.springframework.security.web.util.matcher.RequestMatcher
30+
import org.springframework.util.ClassUtils
31+
import java.util.function.Supplier
32+
33+
/**
34+
* A Kotlin DSL to configure [HttpSecurity] request authorization using idiomatic Kotlin code.
35+
*
36+
* @author Yuriy Savchenko
37+
* @since 5.7
38+
*/
39+
class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl() {
40+
private val authorizationRules = mutableListOf<AuthorizationManagerRule>()
41+
42+
private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector"
43+
private val MVC_PRESENT = ClassUtils.isPresent(
44+
HANDLER_MAPPING_INTROSPECTOR,
45+
AuthorizeHttpRequestsDsl::class.java.classLoader)
46+
private val PATTERN_TYPE = if (MVC_PRESENT) PatternType.MVC else PatternType.ANT
47+
48+
/**
49+
* Adds a request authorization rule.
50+
*
51+
* @param matches the [RequestMatcher] to match incoming requests against
52+
* @param access the [AuthorizationManager] to secure the matching request
53+
* (i.e. created via hasAuthority("ROLE_USER"))
54+
*/
55+
fun authorize(matches: RequestMatcher = AnyRequestMatcher.INSTANCE,
56+
access: AuthorizationManager<RequestAuthorizationContext>) {
57+
authorizationRules.add(MatcherAuthorizationManagerRule(matches, access))
58+
}
59+
60+
/**
61+
* Adds a request authorization rule for an endpoint matching the provided
62+
* pattern.
63+
* If Spring MVC is on the classpath, it will use an MVC matcher.
64+
* If Spring MVC is not on the classpath, it will use an ant matcher.
65+
* The MVC will use the same rules that Spring MVC uses for matching.
66+
* For example, often times a mapping of the path "/path" will match on
67+
* "/path", "/path/", "/path.html", etc.
68+
* If the current request will not be processed by Spring MVC, a reasonable default
69+
* using the pattern as an ant pattern will be used.
70+
*
71+
* @param pattern the pattern to match incoming requests against.
72+
* @param access the [AuthorizationManager] to secure the matching request
73+
* (i.e. created via hasAuthority("ROLE_USER"))
74+
*/
75+
fun authorize(pattern: String,
76+
access: AuthorizationManager<RequestAuthorizationContext>) {
77+
authorizationRules.add(
78+
PatternAuthorizationManagerRule(
79+
pattern = pattern,
80+
patternType = PATTERN_TYPE,
81+
rule = access
82+
)
83+
)
84+
}
85+
86+
/**
87+
* Adds a request authorization rule for an endpoint matching the provided
88+
* pattern.
89+
* If Spring MVC is on the classpath, it will use an MVC matcher.
90+
* If Spring MVC is not on the classpath, it will use an ant matcher.
91+
* The MVC will use the same rules that Spring MVC uses for matching.
92+
* For example, often times a mapping of the path "/path" will match on
93+
* "/path", "/path/", "/path.html", etc.
94+
* If the current request will not be processed by Spring MVC, a reasonable default
95+
* using the pattern as an ant pattern will be used.
96+
*
97+
* @param method the HTTP method to match the income requests against.
98+
* @param pattern the pattern to match incoming requests against.
99+
* @param access the [AuthorizationManager] to secure the matching request
100+
* (i.e. created via hasAuthority("ROLE_USER"))
101+
*/
102+
fun authorize(method: HttpMethod,
103+
pattern: String,
104+
access: AuthorizationManager<RequestAuthorizationContext>) {
105+
authorizationRules.add(
106+
PatternAuthorizationManagerRule(
107+
pattern = pattern,
108+
patternType = PATTERN_TYPE,
109+
httpMethod = method,
110+
rule = access
111+
)
112+
)
113+
}
114+
115+
/**
116+
* Adds a request authorization rule for an endpoint matching the provided
117+
* pattern.
118+
* If Spring MVC is on the classpath, it will use an MVC matcher.
119+
* If Spring MVC is not on the classpath, it will use an ant matcher.
120+
* The MVC will use the same rules that Spring MVC uses for matching.
121+
* For example, often times a mapping of the path "/path" will match on
122+
* "/path", "/path/", "/path.html", etc.
123+
* If the current request will not be processed by Spring MVC, a reasonable default
124+
* using the pattern as an ant pattern will be used.
125+
*
126+
* @param pattern the pattern to match incoming requests against.
127+
* @param servletPath the servlet path to match incoming requests against. This
128+
* only applies when using an MVC pattern matcher.
129+
* @param access the [AuthorizationManager] to secure the matching request
130+
* (i.e. created via hasAuthority("ROLE_USER"))
131+
*/
132+
fun authorize(pattern: String,
133+
servletPath: String,
134+
access: AuthorizationManager<RequestAuthorizationContext>) {
135+
authorizationRules.add(
136+
PatternAuthorizationManagerRule(
137+
pattern = pattern,
138+
patternType = PATTERN_TYPE,
139+
servletPath = servletPath,
140+
rule = access
141+
)
142+
)
143+
}
144+
145+
/**
146+
* Adds a request authorization rule for an endpoint matching the provided
147+
* pattern.
148+
* If Spring MVC is on the classpath, it will use an MVC matcher.
149+
* If Spring MVC is not on the classpath, it will use an ant matcher.
150+
* The MVC will use the same rules that Spring MVC uses for matching.
151+
* For example, often times a mapping of the path "/path" will match on
152+
* "/path", "/path/", "/path.html", etc.
153+
* If the current request will not be processed by Spring MVC, a reasonable default
154+
* using the pattern as an ant pattern will be used.
155+
*
156+
* @param method the HTTP method to match the income requests against.
157+
* @param pattern the pattern to match incoming requests against.
158+
* @param servletPath the servlet path to match incoming requests against. This
159+
* only applies when using an MVC pattern matcher.
160+
* @param access the [AuthorizationManager] to secure the matching request
161+
* (i.e. created via hasAuthority("ROLE_USER"))
162+
*/
163+
fun authorize(method: HttpMethod,
164+
pattern: String,
165+
servletPath: String,
166+
access: AuthorizationManager<RequestAuthorizationContext>) {
167+
authorizationRules.add(
168+
PatternAuthorizationManagerRule(
169+
pattern = pattern,
170+
patternType = PATTERN_TYPE,
171+
servletPath = servletPath,
172+
httpMethod = method,
173+
rule = access
174+
)
175+
)
176+
}
177+
178+
/**
179+
* Specify that URLs require a particular authority.
180+
*
181+
* @param authority the authority to require (i.e. ROLE_USER, ROLE_ADMIN, etc).
182+
* @return the [AuthorizationManager] with the provided authority
183+
*/
184+
fun hasAuthority(authority: String): AuthorizationManager<RequestAuthorizationContext> {
185+
return AuthorityAuthorizationManager.hasAuthority(authority)
186+
}
187+
188+
/**
189+
* Specify that URLs require any of the provided authorities.
190+
*
191+
* @param authorities the authorities to require (i.e. ROLE_USER, ROLE_ADMIN, etc).
192+
* @return the [AuthorizationManager] with the provided authorities
193+
*/
194+
fun hasAnyAuthority(vararg authorities: String): AuthorizationManager<RequestAuthorizationContext> {
195+
return AuthorityAuthorizationManager.hasAnyAuthority(*authorities)
196+
}
197+
198+
/**
199+
* Specify that URLs require a particular role.
200+
*
201+
* @param role the role to require (i.e. USER, ADMIN, etc).
202+
* @return the [AuthorizationManager] with the provided role
203+
*/
204+
fun hasRole(role: String): AuthorizationManager<RequestAuthorizationContext> {
205+
return AuthorityAuthorizationManager.hasRole(role)
206+
}
207+
208+
/**
209+
* Specify that URLs require any of the provided roles.
210+
*
211+
* @param roles the roles to require (i.e. USER, ADMIN, etc).
212+
* @return the [AuthorizationManager] with the provided roles
213+
*/
214+
fun hasAnyRole(vararg roles: String): AuthorizationManager<RequestAuthorizationContext> {
215+
return AuthorityAuthorizationManager.hasAnyRole(*roles)
216+
}
217+
218+
/**
219+
* Specify that URLs are allowed by anyone.
220+
*/
221+
val permitAll: AuthorizationManager<RequestAuthorizationContext> =
222+
AuthorizationManager { _: Supplier<Authentication>, _: RequestAuthorizationContext -> AuthorizationDecision(true) }
223+
224+
/**
225+
* Specify that URLs are not allowed by anyone.
226+
*/
227+
val denyAll: AuthorizationManager<RequestAuthorizationContext> =
228+
AuthorizationManager { _: Supplier<Authentication>, _: RequestAuthorizationContext -> AuthorizationDecision(false) }
229+
230+
/**
231+
* Specify that URLs are allowed by any authenticated user.
232+
*/
233+
val authenticated: AuthorizationManager<RequestAuthorizationContext> =
234+
AuthenticatedAuthorizationManager.authenticated()
235+
236+
internal fun get(): (AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry) -> Unit {
237+
return { requests ->
238+
authorizationRules.forEach { rule ->
239+
when (rule) {
240+
is MatcherAuthorizationManagerRule -> requests.requestMatchers(rule.matcher).access(rule.rule)
241+
is PatternAuthorizationManagerRule -> {
242+
when (rule.patternType) {
243+
PatternType.ANT -> requests.antMatchers(rule.httpMethod, rule.pattern).access(rule.rule)
244+
PatternType.MVC -> requests.mvcMatchers(rule.httpMethod, rule.pattern)
245+
.apply { if (rule.servletPath != null) servletPath(rule.servletPath) }
246+
.access(rule.rule)
247+
}
248+
}
249+
}
250+
}
251+
}
252+
}
253+
}

‎config/src/main/kotlin/org/springframework/security/config/web/servlet/HttpSecurityDsl.kt

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,10 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
101101
fun securityMatcher(vararg pattern: String) {
102102
val mvcPresent = ClassUtils.isPresent(
103103
HANDLER_MAPPING_INTROSPECTOR,
104-
AuthorizeRequestsDsl::class.java.classLoader)
104+
AuthorizeRequestsDsl::class.java.classLoader) ||
105+
ClassUtils.isPresent(
106+
HANDLER_MAPPING_INTROSPECTOR,
107+
AuthorizeHttpRequestsDsl::class.java.classLoader)
105108
this.http.requestMatchers {
106109
if (mvcPresent) {
107110
it.mvcMatchers(*pattern)
@@ -198,6 +201,38 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
198201
this.http.authorizeRequests(authorizeRequestsCustomizer)
199202
}
200203

204+
/**
205+
* Allows restricting access based upon the [HttpServletRequest]
206+
*
207+
* Example:
208+
*
209+
* ```
210+
* @EnableWebSecurity
211+
* class SecurityConfig {
212+
*
213+
* @Bean
214+
* fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
215+
* http {
216+
* authorizeHttpRequests {
217+
* authorize("/public", permitAll)
218+
* authorize(anyRequest, authenticated)
219+
* }
220+
* }
221+
* return http.build()
222+
* }
223+
* }
224+
* ```
225+
*
226+
* @param authorizeHttpRequestsConfiguration custom configuration that specifies
227+
* access for requests
228+
* @see [AuthorizeHttpRequestsDsl]
229+
* @since 5.7
230+
*/
231+
fun authorizeHttpRequests(authorizeHttpRequestsConfiguration: AuthorizeHttpRequestsDsl.() -> Unit) {
232+
val authorizeHttpRequestsCustomizer = AuthorizeHttpRequestsDsl().apply(authorizeHttpRequestsConfiguration).get()
233+
this.http.authorizeHttpRequests(authorizeHttpRequestsCustomizer)
234+
}
235+
201236
/**
202237
* Enables HTTP basic authentication.
203238
*

0 commit comments

Comments
 (0)