From aa122113ade36f02dc8fdbebdf1232b5c4b8742c Mon Sep 17 00:00:00 2001
From: Kamal Wickramanayake <kamal@inbox.lk>
Date: Fri, 3 Jul 2026 19:02:36 +0530
Subject: Microservice sample projects

---
 .../src/main/resources/application.yaml            | 89 ++++++++++++++++++++++
 1 file changed, 89 insertions(+)
 create mode 100644 microservices/02-api-gateway/src/main/resources/application.yaml

(limited to 'microservices/02-api-gateway/src/main/resources/application.yaml')

diff --git a/microservices/02-api-gateway/src/main/resources/application.yaml b/microservices/02-api-gateway/src/main/resources/application.yaml
new file mode 100644
index 0000000..b444233
--- /dev/null
+++ b/microservices/02-api-gateway/src/main/resources/application.yaml
@@ -0,0 +1,89 @@
+server:
+  port: 8050
+  address: 127.0.0.1
+
+app:
+  userRolesUrl: "http://localhost:8052/myservices/api/security/users/{username}/roles"
+
+# logging:
+#   level:
+#     org.springframework.security: trace
+
+spring:
+  application:
+    name: api-gateway
+
+  cloud:
+    gateway:
+      server:
+        webflux:
+          globalcors:
+            cors-configurations:
+              '[/**]':
+                allowedOrigins:
+                  - "http://localhost:5173"
+                allowedMethods: "*"
+                allowedHeaders: "*"
+                allowCredentials: true
+          routes:
+            # Frontend tries to access this URL when the login link is clicked.
+            # If user is not logged in, user will be redirected to OAuth2 server.
+            # If logged in, frontend will be reloaded.
+            - id: frontend
+              uri: no://op # CRITICAL: Prevents forwarding to a backend server
+              predicates:
+                - Path=/ui
+              filters:
+                - RedirectTo=302, http://localhost:5173/
+            # Forward requests to backend service (OAuth2 resource server)
+            - id: backend-service
+              uri: http://localhost:8052
+              predicates:
+                - Path=/api/**
+              filters:
+                # 1. ALWAYS strip incoming spoof headers from the public web first
+                - RemoveRequestHeader=X-User-Id
+                - RemoveRequestHeader=X-User-Name
+                - RemoveRequestHeader=X-User-Roles
+                - RemoveRequestHeader=Authorization
+                - PrefixPath=/myservices
+                - TokenRelay # Add oauth (or jwt) token to request header before forwarding
+
+  security:
+    oauth2:
+      client:
+        provider:
+          platform-auth-server:
+            issuer-uri: http://127.0.0.1:8051
+        registration:
+          api-gateway:
+            provider: platform-auth-server
+            client-id: api-gateway
+            client-secret: "apiGatewayPassword1234"
+            client-authentication-method: client_secret_basic
+            authorization-grant-type: authorization_code
+            redirect-uri: http://localhost:5173/bff/login/oauth2/code/api-gateway
+            scope:
+              - openid
+              - profile
+com:
+  c4-soft:
+    springaddons:
+      oidc:
+        ops:
+          - iss: http://127.0.0.1:8051
+        client:
+          client-uri: http://localhost:5173
+          login-uri: /bff/oauth2/authorization/api-gateway
+          security-matchers:
+            - /**
+          permit-all:
+            - /login/**
+            - /oauth2/**
+            - /
+            - /api/**
+          csrf: cookie-accessible-from-js
+          oauth2-redirections:
+            rp-initiated-logout: ACCEPTED
+          post-logout-redirect-host: http://localhost:5173
+          post-logout-redirect-path: /
-- 
cgit v1.2.3