DmitriyChurmeev/test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
dmitriy.churmeev
2026-03-29 13:54:25 +03:00
parent fc7f9964e5
commit 4d68f36c69
1 changed files with 45 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
src/main/kotlin/com/auth/config/WebSecurityConfig.kt
View File

@@ -9,6 +9,7 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer
import org.springframework.security.config.http.SessionCreationPolicy
import org.springframework.security.core.authority.SimpleGrantedAuthority
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter
import org.springframework.security.web.SecurityFilterChain
@@ -38,26 +39,56 @@ class WebSecurityConfig () {
return http.build()
}
//
// // Конвертер JWT Authentication (извлекает роли из токена)
// private fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
// val converter = JwtAuthenticationConverter()
//
// // Извлекаем роли из поля resource_access.test_client.roles
// val authoritiesExtractor = JwtGrantedAuthoritiesConverter()
// authoritiesExtractor.setAuthoritiesClaimName("resource_access.test_client.roles") // где лежат роли
// authoritiesExtractor.setAuthorityPrefix("ROLE_") // добавляем префикс ROLE_
//
// converter.setJwtGrantedAuthoritiesConverter(authoritiesExtractor)
//
//// // Дополнительно: проверяем, что роли не пустые
//// converter.setJwtGrantedAuthoritiesConverter { jwt ->
//// val authorities = authoritiesExtractor.convert(jwt)
//// if (authorities.isEmpty()) {
//// throw IllegalArgumentException("User has no roles assigned in token")
//// }
//// authorities
//// }
//
// return converter
// }
// Конвертер JWT Authentication (извлекает роли из токена)
private fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
val converter = JwtAuthenticationConverter()
// Извлекаем роли из поля resource_access.test_client.roles
val authoritiesExtractor = JwtGrantedAuthoritiesConverter()
authoritiesExtractor.setAuthoritiesClaimName("resource_access.test_client.roles") // где лежат роли
authoritiesExtractor.setAuthorityPrefix("ROLE_") // добавляем префикс ROLE_
converter.setJwtGrantedAuthoritiesConverter { jwt ->
val roles = mutableSetOf<SimpleGrantedAuthority>()
converter.setJwtGrantedAuthoritiesConverter(authoritiesExtractor)
// Извлекаем роли из resource_access.test_client.roles
val resourceAccess = jwt.claims["resource_access"] as? Map<*, *>
val clientAccess = resourceAccess?.get("test_client") as? Map<*, *>
val clientRoles = clientAccess?.get("roles") as? List<*>
// // Дополнительно: проверяем, что роли не пустые
// converter.setJwtGrantedAuthoritiesConverter { jwt ->
// val authorities = authoritiesExtractor.convert(jwt)
// if (authorities.isEmpty()) {
// throw IllegalArgumentException("User has no roles assigned in token")
// }
// authorities
// }
clientRoles?.forEach { role ->
roles.add(SimpleGrantedAuthority("ROLE_$role"))
}
// Альтернативно: можно также читать из realm_access.roles
val realmAccess = jwt.claims["realm_access"] as? Map<*, *>
val realmRoles = realmAccess?.get("roles") as? List<*>
realmRoles?.forEach { role ->
roles.add(SimpleGrantedAuthority("ROLE_$role"))
}
roles.toList()
}
return converter
}