SDIT-1336 Add in Spring Security by including the library hmpps-kotlin-spring-boot-starter #196

mikehalmamoj · 2024-02-23T16:43:53Z

I think I'm going to keep this draft open for a while and keep it up to date with the hmpps-kotlin-spring-boot-starter. But not planning on merging until we have more confidence in the starter - until it's a bit more battle tested.

…n-spring-boot-starter

mikehalmamoj · 2024-02-23T16:51:27Z

src/main/kotlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/TimeResource.kt

+  @PreAuthorize("hasRole('TEMPLATE_EXAMPLE')")
+  @GetMapping
+  fun getTime() = "${LocalDateTime.now()}"


This is the secure endpoint we were asked to add by @rj-adams. The plan is to call this from the Typescript template so it has an example of calling a secured endpoint.

I like it because it's simple and there's no harm if somebody forgets to remove it - it doesn't poolute the API model. On the other hand we're going to have to add some kind of model if when we get onto the OpenAPI docs ticket as an example of an OpenAPI specification.

mikehalmamoj · 2024-02-23T16:51:50Z

...justice/digital/hmpps/hmppstemplatepackagename/config/HmppsTemplateKotlinExceptionHandler.kt

@@ -50,20 +58,3 @@ class HmppsTemplateKotlinExceptionHandler {
    private val log = LoggerFactory.getLogger(this::class.java)
  }
 }
-
-data class ErrorResponse(


Now comes from the library hmpps-kotlin-spring-boot-starter

mikehalmamoj · 2024-02-23T16:53:22Z

...otlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/config/WebClientConfiguration.kt

+  /**
+   * TODO
+   * Once you have a client registration defined in properties `spring.security.client.registration` then you'll
+   *  need to uncomment this @Bean and create both a health and authorized web client.


I've got an idea around generating all web clients in the library hmpps-kotlin-spring-boot-starter by reading the client registrations from configuration and automatically creating web clients for each. But this will have to do for now.

mikehalmamoj · 2024-02-23T16:54:05Z

...otlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/config/WebClientConfiguration.kt

+  // @Bean
+  fun authorizedClientManager(
+    clientRegistrationRepository: ClientRegistrationRepository,
+    oAuth2AuthorizedClientService: OAuth2AuthorizedClientService,
+  ): OAuth2AuthorizedClientManager {


If you don't have any client registrations then Spring doesn't create a ClientRegistrationRepository, hence the @Bean annotation is commented out.

…n-spring-boot-starter

mikehalmamoj · 2024-02-23T17:05:29Z

...justice/digital/hmpps/hmppstemplatepackagename/config/HmppsTemplateKotlinExceptionHandler.kt

 @RestControllerAdvice
 class HmppsTemplateKotlinExceptionHandler {


This is a prime candidate for moving to the library hmpps-kotlin-spring-boot-starter, as long we make it easy to extend.

petergphillips · 2024-02-26T09:39:54Z

helm_deploy/values-dev.yaml

@@ -9,6 +9,7 @@ generic-service:

  env:
    APPLICATIONINSIGHTS_CONFIGURATION_FILE: applicationinsights.dev.json
+    API_BASE_URL_OAUTH: "https://sign-in-dev.hmpps.service.justice.gov.uk/auth"


Wondering if we could have a better variable now for HMPPS Auth instead

petergphillips · 2024-02-26T09:40:35Z

...otlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/config/WebClientConfiguration.kt

+
+@Configuration
+class WebClientConfiguration(
+  @Value("\${api.base.url.oauth}") val oauthApiBaseUri: String,


could this be hmppsAuthBaseUri instead?

petergphillips · 2024-02-26T09:43:18Z

src/main/kotlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/health/HealthCheck.kt

+import org.springframework.web.reactive.function.client.WebClientResponseException
+import reactor.core.publisher.Mono
+
+abstract class HealthCheck(private val webClient: WebClient) : ReactiveHealthIndicator {


should this be extending the Reactive version?

petergphillips · 2024-02-26T09:45:51Z

...v/justice/digital/hmpps/hmppstemplatepackagename/integration/wiremock/HmppsAuthMockServer.kt

+      WireMock.get("/auth/health/ping").willReturn(
+        aResponse()
+          .withHeader("Content-Type", "application/json")
+          .withBody(if (status == 200) "pong" else "some error")


don't think it matters too much, but these days this should be {"status":"UP"}

petergphillips · 2024-02-26T09:47:53Z

src/main/kotlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/TimeResource.kt

+ * This is just an example of what a secured endpoint might look like.
+ * Remove this class and associated tests in [TimeResourceIntTest] and replace with your own implementation.
+ */
+@RestController


wondering if you could do something like only enabling for local / dev/ test based on a bean property so it doesn't get deployed to other people's instances if they don't remove it?

petergphillips · 2024-02-26T09:48:16Z

src/main/kotlin/uk/gov/justice/digital/hmpps/hmppstemplatepackagename/TimeResource.kt

+
+  @PreAuthorize("hasRole('TEMPLATE_EXAMPLE')")
+  @GetMapping
+  fun getTime() = "${LocalDateTime.now()}"


Suggested change

fun getTime() = "${LocalDateTime.now()}"

fun getTime() = LocalDateTime.now().toString()

SDIT-1336 Add in Spring Security by including the library hmpps-kotli…

9fc5b27

…n-spring-boot-starter

mikehalmamoj force-pushed the mh-SDIT-1336-secure-endpoint branch from 56e464e to 9fc5b27 Compare February 23, 2024 16:46

mikehalmamoj marked this pull request as draft February 23, 2024 16:47

mikehalmamoj commented Feb 23, 2024

View reviewed changes

SDIT-1336 Add in Spring Security by including the library hmpps-kotli…

be3e39a

…n-spring-boot-starter

mikehalmamoj commented Feb 23, 2024

View reviewed changes

petergphillips reviewed Feb 26, 2024

View reviewed changes

mikehalmamoj force-pushed the mh-SDIT-1336-secure-endpoint branch 5 times, most recently from abeebb9 to 10f4b45 Compare February 27, 2024 16:39

SDIT-1336 Use web client and health ping helpers from the kotlin lib

4eb7fb7

mikehalmamoj force-pushed the mh-SDIT-1336-secure-endpoint branch from 10f4b45 to 4eb7fb7 Compare February 27, 2024 16:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SDIT-1336 Add in Spring Security by including the library hmpps-kotlin-spring-boot-starter #196

SDIT-1336 Add in Spring Security by including the library hmpps-kotlin-spring-boot-starter #196

mikehalmamoj commented Feb 23, 2024 •

edited

Loading

mikehalmamoj Feb 23, 2024 •

edited

Loading

mikehalmamoj Feb 23, 2024

mikehalmamoj Feb 23, 2024

mikehalmamoj Feb 23, 2024 •

edited

Loading

mikehalmamoj Feb 23, 2024

petergphillips Feb 26, 2024

petergphillips Feb 26, 2024

petergphillips Feb 26, 2024

petergphillips Feb 26, 2024

petergphillips Feb 26, 2024

petergphillips Feb 26, 2024 •

edited

Loading

		@RestControllerAdvice
		class HmppsTemplateKotlinExceptionHandler {

	fun getTime() = "${LocalDateTime.now()}"
	fun getTime() = LocalDateTime.now().toString()

SDIT-1336 Add in Spring Security by including the library hmpps-kotlin-spring-boot-starter #196

Are you sure you want to change the base?

SDIT-1336 Add in Spring Security by including the library hmpps-kotlin-spring-boot-starter #196

Conversation

mikehalmamoj commented Feb 23, 2024 • edited Loading

mikehalmamoj Feb 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikehalmamoj Feb 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

petergphillips Feb 26, 2024 • edited Loading

Choose a reason for hiding this comment

mikehalmamoj commented Feb 23, 2024 •

edited

Loading

mikehalmamoj Feb 23, 2024 •

edited

Loading

mikehalmamoj Feb 23, 2024 •

edited

Loading

petergphillips Feb 26, 2024 •

edited

Loading