blob: 2c9b48a4cd9ee447c8bbcbdb3ad09aeb2c8c99d2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
package com.example.resourceserver.security;
import java.util.Optional;
import java.util.Set;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
/**
* This controller is a special one. The getRoles() method is accessed by calls from API gateway
* when someone logs in to the API gateway.
*
* The path is publicly accessible. To prevent access via API gateway by API gateway clients, a different
* path is used (not start with /api).
*
* SecurityConfig.java has been configured to allow access without authentication.
*
* AuthRestController
*/
@RestController
@RequestMapping("/security/open/users")
public class AuthRestController {
private UserService userService;
public AuthRestController(UserService userService) {
this.userService = userService;
}
@GetMapping("/{username}/roles")
public ResponseEntity<RolesResponse> getRoles(@PathVariable String username) {
Optional<User> user = userService.findByUsername(username);
if (user.isEmpty()) {
return ResponseEntity.ok(new RolesResponse(Set.of()));
}
return ResponseEntity.ok(new RolesResponse(user.get().getRoles()));
}
}
|
