如何在单个应用程序中部署多个RestEasyInterceptor？

Question

I am deploying some web services using RestEasy on JBoss 7.1.1. I have two classes that process different resource requests along the same path. UserAPI.java handles /books and /books/{id} , etc. MaintenanceAPI.java handles /books/checkedout .

UserAPI requires a previous login, which is validated by a RestEasyInterceptor called AuthInterceptor . The maintenance API does not require a login, but should only be accessible as a GET via localhost; it's handled by LocalInterceptor .

To keep them separate, AuthInterceptor's accept() method returns false if declaring.getName().contains("Maintenance") - so it should not process /books/checkedout at all. LocalInterceptor's accept() method returns true if declaring.equals(MaintenanceAPI.class) .

AuthInterceptor is declared in web.xml under 'resteasy.providers'. But Eclipse thinks there can be only 1 parameter in the XML element, so LocalInterceptor has the annotation @Provider in hopes it'll magically work.

Rejected XML config

This fails:

<context-param>
    <param-name>resteasy.providers</param-name>
    <param-value>com.foo.AuthInterceptor</param-value>
    <param-value>com.foo.LocalInterceptor</param-value>
</context-param>

I'm not sure what the correct syntax is, there is no help in the RestEasy docs. This also fails:

<context-param>
    <param-name>resteasy.providers</param-name>
    <param-value>com.foo.AuthInterceptor</param-value>
</context-param>
<context-param>
    <param-name>resteasy.providers</param-name>
    <param-value>com.foo.LocalInterceptor</param-value>
</context-param>

However, what's happening is that a URL request from a remote machine to /books/checkedout ( which should fail with NOT_AUTHORIZED ) is routed to the UserAPI's /books/{id}/ handler, which proceeds to try to deal with it and returns a very big exception!! That's wrong for several reasons: it's not the right path, not the right handler, not the right argument type, and it should require an auth token! Apparently, LocalInterceptor is not magically added via the annotation, so it's not getting a chance to accept the request. AuthInterceptor must be correctly rejecting it, but why would UserAPI be asked to handle it and furthermore, why would the int {id} be assigned the string "checkedout"?

I haven't posted code because I am asking both whether I can even do what I'm trying (like "why can't I subclass String" - no code needed if you understand the question) and why the mapping is trying to do the wrong thing instead of just failing.

Maybe it's as simple as getting web.xml correct?

Answer 1

For your XML config ( usually web.xml ), here's what you're looking for.

<context-param>
    <param-name>resteasy.providers</param-name>
    <param-value>com.foo.AuthInterceptor, com.foo.LocalInterceptor</param-value>
</context-param>

You should be supplying a comma delimited list of fully qualified @Provider class names. This will ensure your LocalInterceptor also kicks in and does it's job. see Table 2.1 of the Documentation .

That said, I'm assuming your @Path annotation on both interfaces MaintenanceAPI and UserAPI both look like this @Path("/books") . This I think is the root of you problems.

/books/checkedout is not much different from /books/{id} at the Interface entry level, until the request hits the handling method so that if a request for /books/checkedout got into your UserAPI first (which is expecting /books/{id} ), the string "checkedout" would be then getting read as the integer {id} , hence your Very Big Exception... ( i'm guessing it's a NumberFormatException at the root of the StackTrace ).

In your shoes, I would handle all requests @Path("/books") with only one interface and change my method paths to NOT conflict with one another.

@Path("/books")
@Produces(MediaType.APPLICATION_JSON)
public interface BooksAPI{

    @GET
    @Path("/{id}")
    public Response getBookByID(@PathParam("id") String id);
    // so the url here looks like --> /books/1234

    @GET
    @Path("/status/checkedout")
    public Response getCheckedOut(); 
    // and the url here looks like --> /books/status/checkedout
}

OR if I decide to retain both interfaces, i'll make the entry paths different. Essentially something like these;

@Path("/maintenance")
@Produces(MediaType.APPLICATION_JSON)
public interface MaintenanceAPI{

    @GET
    @Path("/books/checkedout")
    public Response getCheckedOut(); 
}
// so the url here looks like --> /maintenance/books/checkedout

.

@Path("/users")
@Produces(MediaType.APPLICATION_JSON)
public interface UserAPI{

    @GET
    @Path("/books/{id}")
    public Response getBookByID(@PathParam("id") String id);
}
// and the url here looks like --> /users/books/1234

---

ADDITIONAL SUGGESTIONS - to filter request originating either from localhost or remote , a quite robust technique that i've once used before is access/role management with something like this;

Create an Annotation interface like eg

 @Documented @Retention (RUNTIME) @Target({TYPE, METHOD}) public @interface RolesAllowed { String[] value(); } 

And then your interceptor's accept() method could look like the following;

LocalInterceptor.java

 @Override public boolean accept(Class declaring, Method method) { if(method.isAnnotationPresent(RolesAllowed.class)){ RolesAllowed rolesAnnotation = method.getAnnotation(RolesAllowed.class); Set<String> rolesSet = new HashSet<String (Arrays.asList(rolesAnnotation.value())); return rolesSet.contains("local"); } return false; } 

AuthInterceptor.java

 @Override public boolean accept(Class declaring, Method method) { if(method.isAnnotationPresent(RolesAllowed.class)){ RolesAllowed rolesAnnotation = method.getAnnotation(RolesAllowed.class); Set<String> rolesSet = new HashSet<String (Arrays.asList(rolesAnnotation.value())); return rolesSet.contains("remote"); } return false; } 

Finally annotate your interface methods with the desired roles as required. (NOTE - I'm using the first method that I pointed out above) eg;

 @Path("/books") @Produces(MediaType.APPLICATION_JSON) public interface BooksAPI{ @GET @Path("/{id}") @RolesAllowed({"remote"}) public Response getBookByID(@PathParam("id") String id); @GET @Path("/status/checkedout") @RolesAllowed({"local"}) public Response getCheckedOut(); }