Skip to content

Commit b6a9eca

Browse files
phiz71phiz71
committed
refactor(gateway): create abstractions
Creates: - AbstractSecurityPlan - AbstractSecurityChain - AbstractReactorFactory - AbstractPolicyChain - AbstractPolicyChainFactory
1 parent 8c212a1 commit b6a9eca

File tree

13 files changed

+847
-526
lines changed

13 files changed

+847
-526
lines changed

‎gravitee-apim-gateway/gravitee-apim-gateway-handlers/gravitee-apim-gateway-handlers-api/src/main/java/io/gravitee/gateway/reactive/handlers/api/security/AbstractSecurityChain.java‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
/*
2+
* Copyright © 2015 The Gravitee team (http://gravitee.io)
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package io.gravitee.gateway.reactive.handlers.api.security;
17+
18+
import static io.gravitee.common.http.HttpStatusCode.SERVICE_UNAVAILABLE_503;
19+
import static io.gravitee.common.http.HttpStatusCode.UNAUTHORIZED_401;
20+
import static io.gravitee.gateway.reactive.api.context.InternalContextAttributes.ATTR_INTERNAL_FLOW_STAGE;
21+
import static io.gravitee.gateway.reactive.api.context.InternalContextAttributes.ATTR_INTERNAL_SECURITY_SKIP;
22+
import static io.gravitee.gateway.reactive.api.context.InternalContextAttributes.ATTR_INTERNAL_SECURITY_TOKEN;
23+
import static io.reactivex.rxjava3.core.Completable.defer;
24+
25+
import io.gravitee.gateway.reactive.api.ExecutionFailure;
26+
import io.gravitee.gateway.reactive.api.context.base.BaseExecutionContext;
27+
import io.gravitee.gateway.reactive.api.policy.base.BaseSecurityPolicy;
28+
import io.gravitee.gateway.reactive.handlers.api.security.plan.AbstractSecurityPlan;
29+
import io.gravitee.gateway.reactive.handlers.api.security.plan.SecurityPlan;
30+
import io.reactivex.rxjava3.core.Completable;
31+
import io.reactivex.rxjava3.core.Flowable;
32+
import io.reactivex.rxjava3.core.Single;
33+
import io.reactivex.rxjava3.core.SingleSource;
34+
import java.util.Objects;
35+
import lombok.extern.slf4j.Slf4j;
36+
37+
/**
38+
* {@link AbstractSecurityChain} is a special chain dedicated to execute policy associated with plans.
39+
* The security chain is responsible to create {@link SecurityPlan} for each plan of the api and executed them in order.
40+
* Only the first {@link SecurityPlan} that can handle the current request is executed.
41+
* The result of the security chain execution depends on this {@link SecurityPlan} execution.
42+
*
43+
* @author Jeoffrey HAEYAERT (jeoffrey.haeyaert at graviteesource.com)
44+
* @author GraviteeSource Team
45+
*/
46+
@Slf4j
47+
public abstract class AbstractSecurityChain<
48+
P extends AbstractSecurityPlan<? extends BaseSecurityPolicy, C>, C extends BaseExecutionContext
49+
> {
50+
51+
protected static final String PLAN_UNRESOLVABLE = "GATEWAY_PLAN_UNRESOLVABLE";
52+
protected static final String PLAN_RESOLUTION_FAILURE = "GATEWAY_PLAN_RESOLUTION_FAILURE";
53+
protected static final String UNAUTHORIZED_MESSAGE = "Unauthorized";
54+
protected static final String TEMPORARILY_UNAVAILABLE_MESSAGE = "Temporarily Unavailable";
55+
protected static final String ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE = "securityChain.planResolutionFailure";
56+
57+
protected static final Single<Boolean> TRUE = Single.just(true);
58+
protected static final Single<Boolean> FALSE = Single.just(false);
59+
private final Flowable<P> chain;
60+
61+
public AbstractSecurityChain(Flowable<P> securityPlans) {
62+
this.chain = securityPlans;
63+
}
64+
65+
protected abstract Completable sendError(C ctx, ExecutionFailure failure);
66+
67+
protected abstract SingleSource<Boolean> executePlan(P securityPlan, C ctx);
68+
69+
/**
70+
* Executes the security chain by executing all the {@link SecurityPlan}s in an ordered sequence.
71+
* It's up to each {@link SecurityPlan} to provide its order. The lower is the order, the highest priority is.
72+
* The result of the security chain execution depends on the first {@link SecurityPlan} able to execute the request.
73+
* If no {@link SecurityPlan} has been executed because there is no {@link SecurityPlan} in the chain or none of them can execute the request,
74+
* then the chain is interrupted with a 401 response status and the {@link Completable} returns an error.
75+
*
76+
* @param ctx the current execution context.
77+
* @return a {@link Completable} that completes if the request has been successfully handled by a {@link SecurityPlan} or returns
78+
* an error if no {@link SecurityPlan} can execute the request or the {@link SecurityPlan} failed.
79+
*/
80+
public Completable execute(C ctx) {
81+
return defer(() -> {
82+
if (!Objects.equals(true, ctx.getInternalAttribute(ATTR_INTERNAL_SECURITY_SKIP))) {
83+
return chain
84+
.concatMapSingle(securityPlan -> continueChain(ctx, securityPlan))
85+
.any(Boolean::booleanValue)
86+
.flatMapCompletable(securityHandled -> {
87+
if (Boolean.FALSE.equals(securityHandled)) {
88+
Throwable throwable = ctx.getInternalAttribute(ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE);
89+
if (throwable != null) {
90+
return sendError(
91+
ctx,
92+
new ExecutionFailure(SERVICE_UNAVAILABLE_503)
93+
.key(PLAN_RESOLUTION_FAILURE)
94+
.message(TEMPORARILY_UNAVAILABLE_MESSAGE)
95+
);
96+
}
97+
return sendError(
98+
ctx,
99+
new ExecutionFailure(UNAUTHORIZED_401).key(PLAN_UNRESOLVABLE).message(UNAUTHORIZED_MESSAGE)
100+
);
101+
}
102+
return Completable.complete();
103+
})
104+
.doOnSubscribe(disposable -> {
105+
log.debug("Executing security chain");
106+
ctx.putInternalAttribute(ATTR_INTERNAL_FLOW_STAGE, "security");
107+
})
108+
.doFinally(() -> {
109+
ctx.removeInternalAttribute(ATTR_INTERNAL_FLOW_STAGE);
110+
ctx.removeInternalAttribute(ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE);
111+
ctx.removeInternalAttribute(ATTR_INTERNAL_SECURITY_TOKEN);
112+
});
113+
}
114+
115+
log.debug("Skipping security chain because it has been explicitly required");
116+
return Completable.complete();
117+
});
118+
}
119+
120+
private Single<Boolean> continueChain(C ctx, P securityPlan) {
121+
return securityPlan
122+
.canExecute(ctx)
123+
.onErrorResumeNext(throwable -> {
124+
log.error("An error occurred while checking if security plan {} can be executed", securityPlan.id(), throwable);
125+
ctx.setInternalAttribute(ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE, throwable);
126+
return FALSE;
127+
})
128+
.flatMap(canExecute -> {
129+
if (Boolean.TRUE.equals(canExecute)) {
130+
return executePlan(securityPlan, ctx);
131+
}
132+
return FALSE;
133+
});
134+
}
135+
}

‎gravitee-apim-gateway/gravitee-apim-gateway-handlers/gravitee-apim-gateway-handlers-api/src/main/java/io/gravitee/gateway/reactive/handlers/api/security/SecurityChain.java‎

Lines changed: 21 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,11 @@
1515
*/
1616
package io.gravitee.gateway.reactive.handlers.api.security;
1717

18-
import static io.gravitee.common.http.HttpStatusCode.SERVICE_UNAVAILABLE_503;
19-
import static io.gravitee.common.http.HttpStatusCode.UNAUTHORIZED_401;
20-
import static io.gravitee.gateway.reactive.api.context.InternalContextAttributes.ATTR_INTERNAL_FLOW_STAGE;
21-
import static io.gravitee.gateway.reactive.api.context.InternalContextAttributes.ATTR_INTERNAL_SECURITY_SKIP;
22-
import static io.gravitee.gateway.reactive.api.context.InternalContextAttributes.ATTR_INTERNAL_SECURITY_TOKEN;
23-
import static io.reactivex.rxjava3.core.Completable.defer;
24-
2518
import io.gravitee.definition.model.Api;
2619
import io.gravitee.gateway.reactive.api.ExecutionFailure;
2720
import io.gravitee.gateway.reactive.api.ExecutionPhase;
2821
import io.gravitee.gateway.reactive.api.context.http.HttpExecutionContext;
22+
import io.gravitee.gateway.reactive.api.context.http.HttpPlainExecutionContext;
2923
import io.gravitee.gateway.reactive.api.hook.Hookable;
3024
import io.gravitee.gateway.reactive.api.hook.SecurityPlanHook;
3125
import io.gravitee.gateway.reactive.core.hook.HookHelper;
@@ -34,14 +28,12 @@
3428
import io.gravitee.gateway.reactive.policy.PolicyManager;
3529
import io.reactivex.rxjava3.core.Completable;
3630
import io.reactivex.rxjava3.core.Flowable;
37-
import io.reactivex.rxjava3.core.Single;
31+
import io.reactivex.rxjava3.core.SingleSource;
3832
import java.util.ArrayList;
3933
import java.util.Comparator;
4034
import java.util.List;
4135
import java.util.Objects;
4236
import java.util.stream.Collectors;
43-
import org.slf4j.Logger;
44-
import org.slf4j.LoggerFactory;
4537

4638
/**
4739
* {@link SecurityChain} is a special chain dedicated to execute policy associated with plans.
@@ -52,24 +44,14 @@
5244
* @author Jeoffrey HAEYAERT (jeoffrey.haeyaert at graviteesource.com)
5345
* @author GraviteeSource Team
5446
*/
55-
public class SecurityChain implements Hookable<SecurityPlanHook> {
56-
57-
protected static final String PLAN_UNRESOLVABLE = "GATEWAY_PLAN_UNRESOLVABLE";
58-
protected static final String PLAN_RESOLUTION_FAILURE = "GATEWAY_PLAN_RESOLUTION_FAILURE";
59-
protected static final String UNAUTHORIZED_MESSAGE = "Unauthorized";
60-
protected static final String TEMPORARILY_UNAVAILABLE_MESSAGE = "Temporarily Unavailable";
61-
protected static final String ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE = "securityChain.planResolutionFailure";
47+
public class SecurityChain extends AbstractSecurityChain<SecurityPlan, HttpPlainExecutionContext> implements Hookable<SecurityPlanHook> {
6248

63-
protected static final Single<Boolean> TRUE = Single.just(true);
64-
protected static final Single<Boolean> FALSE = Single.just(false);
65-
private static final Logger log = LoggerFactory.getLogger(SecurityChain.class);
66-
private final Flowable<SecurityPlan> chain;
6749
private final ExecutionPhase executionPhase;
6850

6951
private List<SecurityPlanHook> securityPlanHooks;
7052

7153
public SecurityChain(Api api, PolicyManager policyManager, ExecutionPhase executionPhase) {
72-
this(
54+
super(
7355
Flowable.fromIterable(
7456
api
7557
.getPlans()
@@ -78,81 +60,32 @@ public SecurityChain(Api api, PolicyManager policyManager, ExecutionPhase execut
7860
.filter(Objects::nonNull)
7961
.sorted(Comparator.comparingInt(SecurityPlan::order))
8062
.collect(Collectors.toList())
81-
),
82-
executionPhase
63+
)
8364
);
65+
this.executionPhase = executionPhase;
8466
}
8567

8668
public SecurityChain(Flowable<SecurityPlan> securityPlans, ExecutionPhase executionPhase) {
87-
this.chain = securityPlans;
69+
super(securityPlans);
8870
this.executionPhase = executionPhase;
8971
}
9072

91-
/**
92-
* Executes the security chain by executing all the {@link SecurityPlan}s in an ordered sequence.
93-
* It's up to each {@link SecurityPlan} to provide its order. The lower is the order, the highest priority is.
94-
* The result of the security chain execution depends on the first {@link SecurityPlan} able to execute the request.
95-
* If no {@link SecurityPlan} has been executed because there is no {@link SecurityPlan} in the chain or none of them can execute the request,
96-
* then the chain is interrupted with a 401 response status and the {@link Completable} returns an error.
97-
*
98-
* @param ctx the current execution context.
99-
* @return a {@link Completable} that completes if the request has been successfully handled by a {@link SecurityPlan} or returns
100-
* an error if no {@link SecurityPlan} can execute the request or the {@link SecurityPlan} failed.
101-
*/
102-
public Completable execute(HttpExecutionContext ctx) {
103-
return defer(() -> {
104-
if (!Objects.equals(true, ctx.getInternalAttribute(ATTR_INTERNAL_SECURITY_SKIP))) {
105-
return chain
106-
.concatMapSingle(securityPlan -> continueChain(ctx, securityPlan))
107-
.any(Boolean::booleanValue)
108-
.flatMapCompletable(securityHandled -> {
109-
if (Boolean.FALSE.equals(securityHandled)) {
110-
Throwable throwable = ctx.getInternalAttribute(ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE);
111-
if (throwable != null) {
112-
return ctx.interruptWith(
113-
new ExecutionFailure(SERVICE_UNAVAILABLE_503)
114-
.key(PLAN_RESOLUTION_FAILURE)
115-
.message(TEMPORARILY_UNAVAILABLE_MESSAGE)
116-
);
117-
}
118-
return ctx.interruptWith(
119-
new ExecutionFailure(UNAUTHORIZED_401).key(PLAN_UNRESOLVABLE).message(UNAUTHORIZED_MESSAGE)
120-
);
121-
}
122-
return Completable.complete();
123-
})
124-
.doOnSubscribe(disposable -> {
125-
log.debug("Executing security chain");
126-
ctx.putInternalAttribute(ATTR_INTERNAL_FLOW_STAGE, "security");
127-
})
128-
.doFinally(() -> {
129-
ctx.removeInternalAttribute(ATTR_INTERNAL_FLOW_STAGE);
130-
ctx.removeInternalAttribute(ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE);
131-
ctx.removeInternalAttribute(ATTR_INTERNAL_SECURITY_TOKEN);
132-
});
133-
}
134-
135-
log.debug("Skipping security chain because it has been explicitly required");
136-
return Completable.complete();
137-
});
73+
@Override
74+
protected Completable sendError(HttpPlainExecutionContext ctx, ExecutionFailure failure) {
75+
return ctx.interruptWith(failure);
13876
}
13977

140-
private Single<Boolean> continueChain(HttpExecutionContext ctx, SecurityPlan securityPlan) {
141-
return securityPlan
142-
.canExecute(ctx)
143-
.onErrorResumeNext(throwable -> {
144-
log.error("An error occurred while checking if security plan {} can be executed", securityPlan.id(), throwable);
145-
ctx.setInternalAttribute(ATTR_INTERNAL_PLAN_RESOLUTION_FAILURE, throwable);
146-
return FALSE;
147-
})
148-
.flatMap(canExecute -> {
149-
if (Boolean.TRUE.equals(canExecute)) {
150-
return HookHelper
151-
.hook(() -> securityPlan.execute(ctx, executionPhase), securityPlan.id(), securityPlanHooks, ctx, executionPhase)
152-
.andThen(TRUE);
153-
}
154-
return FALSE;
155-
});
78+
@Override
79+
protected SingleSource<Boolean> executePlan(SecurityPlan securityPlan, HttpPlainExecutionContext ctx) {
80+
return HookHelper
81+
.hook(
82+
() -> securityPlan.execute(ctx, executionPhase),
83+
securityPlan.id(),
84+
securityPlanHooks,
85+
(HttpExecutionContext) ctx,
86+
executionPhase
87+
)
88+
.andThen(TRUE);
15689
}
15790

15891
@Override

0 commit comments

Comments
 (0)