From ffe7db80b440a659da3bf6f9c09987ace861bba9 Mon Sep 17 00:00:00 2001 From: Kamal Wickramanayake Date: Fri, 3 Jul 2026 22:05:24 +0530 Subject: Prevent roles of all users being accessed via API gateway /bff/api/ path --- .../security/AuthRestController.java | 43 ++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java (limited to 'microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java') diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java new file mode 100644 index 0000000..2c9b48a --- /dev/null +++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java @@ -0,0 +1,43 @@ +package com.example.resourceserver.security; + +import java.util.Optional; +import java.util.Set; + +import org.springframework.http.ResponseEntity; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PathVariable; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +/** + * This controller is a special one. The getRoles() method is accessed by calls from API gateway + * when someone logs in to the API gateway. + * + * The path is publicly accessible. To prevent access via API gateway by API gateway clients, a different + * path is used (not start with /api). + * + * SecurityConfig.java has been configured to allow access without authentication. + * + * AuthRestController + */ +@RestController +@RequestMapping("/security/open/users") +public class AuthRestController { + private UserService userService; + + public AuthRestController(UserService userService) { + this.userService = userService; + } + + @GetMapping("/{username}/roles") + public ResponseEntity getRoles(@PathVariable String username) { + Optional user = userService.findByUsername(username); + + if (user.isEmpty()) { + return ResponseEntity.ok(new RolesResponse(Set.of())); + } + + return ResponseEntity.ok(new RolesResponse(user.get().getRoles())); + } + +} -- cgit v1.2.3