默认情况下，不要在实体类中公开字段，使用 Spring Data Rest 和 Jpa

Question

I have an entity class Account. It has a bunch of fields. Most of them for now are exposed in REST calls except where I explicitly ignore the password field with @JsonIgnore , but I will be adding more fields and I don't want to forget adding @JsonIgnore to something new that shouldn't be exposed.

Can I invert the exposure, so that I explicitly have to enable fields to be exported, with the default being that it won't be exposed?

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;

import lombok.Data;
import lombok.ToString;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

import com.fasterxml.jackson.annotation.JsonIgnore;

@Data
@ToString(exclude = "password")
@Entity
public class Account {

    public static final PasswordEncoder PASSWORD_ENCODER = new BCryptPasswordEncoder();

    private @Id @GeneratedValue Long id;

    private String name;

    @JsonIgnore private String password;

    private String[] roles;

    public void setPassword(String password) {
        this.password = PASSWORD_ENCODER.encode(password);
    }

    protected Account() {}

    public Account(String name, String password, String... roles) {

        this.name = name;
        this.setPassword(password);
        this.roles = roles;
    }

}

Using Spring Data REST here, so everything else that is there is just repositories, there is no extra layer to do something smart.

Answer 1

There is two main ways to get the "white-list" properties effect in Jackson library

First Way:

Remove @Data annotation from your Account class and add getters only to fields you want to expose. To make sure that properties without getters will not be excludes add @JsonIgnoreProperties(ignoreUnknown=true) to your Account class

Second Way:

Wrap your Account class with AccountForJson class. for example :

public class AccountForJson {

private Account account;

public MyClassForJson(Account accountToWrapped) {
    this.account = accountToWrapped;
}

/**
 * Example of property that you want to expose
 */
public String getName() {
    return this.account.getName();
 }
}

ps : there is an open issuse in Jackson github repository for that feature, here is the link for watching that issuse - Add @JsonIncludeProperties(propertyNames) (reverse of @JsonIgnoreProperties )