Spring Data Rest查找通过安全性检查嵌套实体

Question

I am using Spring-data-rest for my REST interface and I have implemented custom security checks on my exposed endpoints. Everything works fine but now I came across some non-trivial scenario and I am wondering if spring data rest is capable of solving this.

I have the following model:

@Entity
public class Cycle {

  @Id
  @GeneratedValue(strategy = GenerationType.AUTO)
  @Column(name = "unique_cycle_id")
  private long id;

  @Column(name = "user_id")
  private long userId;

  ...

  @OneToMany(cascade = CascadeType.ALL)
  @JoinTable(name = "cycles_records", joinColumns = @JoinColumn(name = "unique_cycle_id"),
      inverseJoinColumns = @JoinColumn(name = "unique_record_id"))
  private List<Record> records;
}

@Entity
public class Record {

  @Id
  @GeneratedValue(strategy = GenerationType.AUTO)
  @Column(name = "unique_record_id")
  private long id;

  ...
}

When fetching a cycle, I check that the logged-in user has the same id as the userId in my Cycle entity.

I have implemented cystom security check like this:

@Slf4j
@Component
public class SecurityCheck {

  public boolean check(Record record, Authentication authentication) {
    log.debug("===Security check for record===");
    if (record == null || record.getCycle() == null) {
      return false;
    }

    return Long.toString(record.getCycle().getUserId()).equals(authentication.getName());
  }

  public boolean check(Cycle cycle, Authentication authentication) {
    if (cycle == null) {
      return false;
    }

    return Long.toString(cycle.getUserId()).equals(authentication.getName());
  }
}

But now, I am trying to implement a similar security check for records. So when fetching records for a given cycle, I need to check that the cycle's userId is matching the id in the authentication object.

I have the following method on my RecordRepository:

@Repository
public interface RecordRepository extends JpaRepository<Record, Long> {

      @PreAuthorize("hasRole('ROLE_ADMIN') OR @securityCheck.check(???, authentication)")
      Page<Record> findByCycle_Id(@Param("id") Long id, Pageable pageable);
}

Is it possible to access the userId inside the cycle with the id I am querying with this method inside this securityCheck? If not, what would be the correct Spring way of achieving this functionality?

Sorry it my question is not clear. Let me know if further explanation is necessary.

EDIT: I found quick and dirty solution by accessing the returned page in a post-filter. The downside is that I can access records not belonging to my logged-in user when the returned array is empty (so I am still looking for some more elegant solution)

@PostAuthorize("hasRole('ROLE_ADMIN') OR @securityCheck.check(returnObject, authentication)")
Page<Record> findByCycle_Id(@Param("id") Long id, Pageable pageable);

public boolean check(Page<Record> page, Authentication authentication) {
    log.debug("===Security check for page===");
    if (!page.hasContent()) {
      return true;
    }

    long userId = page.getContent().get(0).getCycle().getUserId();

    return Long.toString(userId).equals(authentication.getName());
  }

Answer 1

If I've understood you correctly...

First, make sure that SpEL EvaluationContext extension is enabled.

Then do something like this:

public interface RecordRepository extends JpaRepository<Record, Long> {

    @Query("select r from Record r join r.cycle c where c.id = ?1 and (c.userId = ?#{@RecordRepository.toLong(principal)} or 1 = ?#{hasRole('ROLE_ADMIN') ? 1 : 0})")
    Page<Record> findByCycleId(Long id, Pageable pageable);

    default Long toLong(String name) {
        return Long.valueOf(name);
    }
}

I suppose that principal contains the string representation of userId so here I convert it to long then compare them...

Also you can check my example related to this issue...

UPDATE

Instead of @RecordRepository.toLong(principal) in SpEL expression try to use T(java.lang.Long).valueOf(principal) and delete toLong method from your repo.

Answer 2

If you just needed to get a specific record of "Cycle" while checking that the userId is the same as your logged user, i would just use something like:

Page<Record> findByCycle_IdAndUserId(Long cycleId, Long userId, Pageable pageable);

JPA handles a lot of stuff by itself without having you to manually create queries. See query method at https://docs.spring.io/spring-data/jpa/docs/current/reference/html/#repositories.query-methods .

Of course this means the security checks need to be handled on the Controller side with Spring Security instead of the Model side. Your DAOs should not have to care if the request is valid/authorized because those checks are done beforehand.

Cheers

Answer 3

You can introduce two handlers into your application like below:-

  //This is your Request handler

public class CxfHttpRequestHandler extends AbstractPhaseInterceptor<Message> {


    public CxfHttpRequestHandler() {
        super("marshal");
    }

    @Override
    public void handleMessage(final Message message) throws Fault {
        //handle your all request here
       }
}

//this is your Response handler
public class CxfHttpResponseHandler extends AbstractPhaseInterceptor<Message> {

    public CxfHttpResponseHandler() {
        super("pre-stream");
    }

    @Override
    public void handleMessage(final Message message) throws Fault {
        //handle your outgoing message here
    }
}


Add the following  in your spring-bean.xml file:-

<bean id="cxfHttpRequestHandler" class="com.yourpackage.CxfHttpRequestHandler" >
        <description>
            This Bean implements Interceptor for all request
        </description>
</bean>

<bean id="cxfHttpResponseHandler" class="com.yourpackage.CxfHttpResponseHandler">
        <description>
            This Bean implements Interceptor for all response
        </description>
    </bean>

<cxf:bus>
        <cxf:inInterceptors>
            <ref bean="cxfHttpRequestHandler" />
        </cxf:inInterceptors>

        <cxf:outInterceptors>
            <ref bean="cxfHttpResponseHandler" />
        </cxf:outInterceptors>

</cxf:bus>