1 files changed, 43 insertions, 0 deletions
diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java
new file mode 100644
index 0000000..2c9b48a
--- /dev/null
+++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java
@@ -0,0 +1,43 @@
+package com.example.resourceserver.security;
+
+import java.util.Optional;
+import java.util.Set;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * This controller is a special one. The getRoles() method is accessed by calls from API gateway
+ * when someone logs in to the API gateway.
+ * 
+ * The path is publicly accessible. To prevent access via API gateway by API gateway clients, a different
+ * path is used (not start with /api).
+ * 
+ * SecurityConfig.java has been configured to allow access without authentication.
+ * 
+ * AuthRestController
+ */
+@RestController
+@RequestMapping("/security/open/users")
+public class AuthRestController {
+    private UserService userService;
+
+    public AuthRestController(UserService userService) {
+        this.userService = userService;
+    }
+
+    @GetMapping("/{username}/roles")
+    public ResponseEntity<RolesResponse> getRoles(@PathVariable String username) {
+        Optional<User> user = userService.findByUsername(username);
+
+        if (user.isEmpty()) {
+            return ResponseEntity.ok(new RolesResponse(Set.of()));
+        }
+
+        return ResponseEntity.ok(new RolesResponse(user.get().getRoles()));
+    }
+
+}