Spring Security

[vetm73]

Hi,

I would like to use spring security to 'protect' some of my mutations. When using the @PreAuthorize("hasRole('ROLE_USER')") annotation I get the message:

Caused by: com.expedia.graphql.exceptions.TypeNotSupportedException: Cannot convert kotlin.Unit since it is outside the supported packages [ee.seventythr.web.backend]
	at com.expedia.graphql.generator.state.TypesCache.getCacheKeyString(TypesCache.kt:56) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.state.TypesCache.get(TypesCache.kt:23) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.TypeBuilder.objectFromReflection$graphql_kotlin(TypeBuilder.kt:32) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.TypeBuilder.graphQLTypeOf$graphql_kotlin(TypeBuilder.kt:24) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.TypeBuilder.graphQLTypeOf$graphql_kotlin$default(TypeBuilder.kt:20) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.types.FunctionTypeBuilder.function$graphql_kotlin(FunctionTypeBuilder.kt:53) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.SchemaGenerator.function$graphql_kotlin(SchemaGenerator.kt:61) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.SchemaGenerator.function$graphql_kotlin$default(SchemaGenerator.kt:60) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.types.MutationTypeBuilder.getMutationObject(MutationTypeBuilder.kt:33) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.generator.SchemaGenerator.generate$graphql_kotlin(SchemaGenerator.kt:51) ~[graphql-kotlin-0.2.6.jar:na]
	at com.expedia.graphql.ToSchemaKt.toSchema(toSchema.kt:23) ~[graphql-kotlin-0.2.6.jar:na]
	at ee.seventythr.web.backend.configuration.GraphQL.schema(GraphQL.kt:58) ~[classes/:na]
	at ee.seventythr.web.backend.configuration.GraphQL$$EnhancerBySpringCGLIB$$192e108f.CGLIB$schema$1(<generated>) ~[classes/:na]
	at ee.seventythr.web.backend.configuration.GraphQL$$EnhancerBySpringCGLIB$$192e108f$$FastClassBySpringCGLIB$$dba02518.invoke(<generated>) ~[classes/:na]
	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:244) ~[spring-core-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:363) ~[spring-context-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at ee.seventythr.web.backend.configuration.GraphQL$$EnhancerBySpringCGLIB$$192e108f.schema(<generated>) ~[classes/:na]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:na]
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
	at java.base/java.lang.reflect.Method.invoke(Method.java:566) ~[na:na]
	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ~[spring-beans-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	... 48 common frames omitted

Do I need to configure something or am I doing something wrong? The @RolesAllowed("ROLE_ADMIN") annotation compiles but is not working and I found some examples that tell me to use PreAuthorize.

Kind regards,
Mike

[smyrick]

@vetm73 Can you provide the code you are trying to parse into a schema?

It look like you are not returning a value from a function, so Kotlin defaults to returning kotlin.Unit as the type. Does this function need to be ignored from the schema? If so you can include @GraphQLIgnore

[vetm73]

Hi Shane,

It is my Mutation:

@Component
class ForCompanyMutation(val forCompanyRepository: ForCompanyRepository) : Mutation {
    @Value("\${files.forCompany}")
    lateinit var imagePath: String

    private val logger by LoggerDelegate()


    @GraphQLDescription("add for company")
    @PreAuthorize("hasRole('ROLE_USER')")
    fun addForCompany(input: UploadImage, @GraphQLContext context: MyGraphQLContext): ForCompany {
        // if (!context.authenticated) throw NotAuthorizedException("Mike")
        File(imagePath, input.filename).writeBytes(stringToByteArray(input.data))
        return save(
            ForCompany(
                    name = input.name,
                    image = "${imagePath.substringAfterLast("/")}/${input.filename}"
            ), forCompanyRepository
        )
    }
}

[vetm73]

It is working without the annotation

[dariuszkuc]

I think your problem might be due to a proxy created by aspect (didn't get a chance to verify it). How are you creating your schema? i.e. when you create TopLevelObject that are passed to SchemaGenerator are you explicitly passing the object and its corresponding kClass?

[dariuszkuc]

Another thing to consider is that you probably want to expose this functionality through GraphQL directives, i.e. I'd assume you don't want to expose those queries/mutations to users if they don't have the proper role (vs throwing some unauthorized exception at runtime))

[9yx]

I had the same error when working with spring, used AopUtils.getTargetClass in TopLevelObject:
TopLevelObject(it, Reflection.getOrCreateKotlinClass(AopUtils.getTargetClass(it)))
it solved the problem

[smyrick]

Here is an example of auth directives from the grahpql-java docs https://www.graphql-java.com/documentation/v11/sdl-directives/

I am going to close the issue. If you need more help we can continue the discussion still

[vetm73]

@dkuc84 I solved the problem with directives. Tnx

[FranBisquerra]

Hi!, I am not sure if it is the best place to ask this question but I am a little bit lost and it seems that you could help me, thank you in advance.

I am using your server to implement an API and I want to authorize the queries and mutations I see that its better if I expose them in a directive based way and I am going to try it that way.

Just out of curiosity, is there any filter in your implementation that removes the Authenticated user from the reactive security context, I am doing something like this:

my query:

    suspend fun people(count: Int): List<PersonDTO> {
           return personService.getPeople(count).awaitFirst()
    }

and my service

 @PreAuthorize("hasAuthority('SCOPE_profile')")
  fun getPeople(count: Int) = personService
            .getPeople(count)
            .map { PersonDTO(it.id, it.firstName, it.lastName) }
            .collectList()

And the user I get when checking the authorities is always the default anonymous one.

Thank you again for your great job!

[FranBisquerra]

@dkuc84 I solved the problem with directives. Tnx

Hi!, Could you please elaborate a bit on how you solved the problem I am facing the same issue and don't really know how to do it.

Thx!

[ermadmi78]

Hi All.

See schema-first Kotlin Spring Boot GraphQL Server with Spring Security authentication and authorization example here:
https://github.com/ermadmi78/kobby-gradle-example