Skip to content

Commit dfb562b

Browse files
author
springdoc
committed
ignore Authentication in controller params. Fixes #245 
1 parent a0b5104 commit dfb562b

File tree

10 files changed

+166
-42
lines changed

10 files changed

+166
-42
lines changed

‎springdoc-openapi-common/src/main/java/org/springdoc/core/AbstractRequestBuilder.java

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package org.springdoc.core;
22

33
import com.fasterxml.jackson.annotation.JsonView;
4+
import io.swagger.v3.oas.annotations.Hidden;
45
import io.swagger.v3.oas.models.Components;
56
import io.swagger.v3.oas.models.Operation;
67
import io.swagger.v3.oas.models.media.Schema;
@@ -9,6 +10,7 @@
910
import org.springdoc.core.RequestInfo.ParameterType;
1011
import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
1112
import org.springframework.core.annotation.AnnotatedElementUtils;
13+
import org.springframework.core.annotation.AnnotationUtils;
1214
import org.springframework.util.CollectionUtils;
1315
import org.springframework.web.bind.annotation.*;
1416
import org.springframework.web.method.HandlerMethod;
@@ -32,6 +34,7 @@ public abstract class AbstractRequestBuilder {
3234
private final AbstractParameterBuilder parameterBuilder;
3335
private final RequestBodyBuilder requestBodyBuilder;
3436
private final OperationBuilder operationBuilder;
37+
public static List<Class> PARAM_TYPES_TO_IGNORE = new ArrayList<>();
3538

3639
protected AbstractRequestBuilder(AbstractParameterBuilder parameterBuilder, RequestBodyBuilder requestBodyBuilder,
3740
OperationBuilder operationBuilder) {
@@ -41,7 +44,9 @@ protected AbstractRequestBuilder(AbstractParameterBuilder parameterBuilder, Requ
4144
this.operationBuilder = operationBuilder;
4245
}
4346

44-
protected abstract boolean isParamTypeToIgnore(Class<?> paramType);
47+
protected boolean isParamTypeToIgnore(Class<?> paramType){
48+
return false;
49+
}
4550

4651
public Operation build(Components components, HandlerMethod handlerMethod, RequestMethod requestMethod,
4752
Operation operation, MethodAttributes methodAttributes) {
@@ -110,7 +115,7 @@ protected boolean isParamToIgnore(java.lang.reflect.Parameter parameter) {
110115
if (parameter.isAnnotationPresent(PathVariable.class)) {
111116
return false;
112117
}
113-
return parameterBuilder.isAnnotationToIgnore(parameter) || isParamTypeToIgnore(parameter.getType());
118+
return parameterBuilder.isAnnotationToIgnore(parameter) || isParamTypeToIgnore(parameter.getType()) || PARAM_TYPES_TO_IGNORE.contains(parameter.getType()) || (AnnotationUtils.findAnnotation(parameter.getType(), Hidden.class) != null);
114119
}
115120

116121
private void setParams(Operation operation, List<Parameter> operationParameters, RequestBodyInfo requestBodyInfo) {

‎springdoc-openapi-kotlin/src/main/java/org/springdoc/core/KotlinCoroutinesRequestBuilder.java

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,19 @@
66
import org.springframework.stereotype.Component;
77
import org.springframework.web.method.HandlerMethod;
88

9-
import java.util.List;
10-
119
@Primary
1210
@Component
1311
public class KotlinCoroutinesRequestBuilder extends AbstractRequestBuilder {
1412

15-
private final List<AbstractRequestBuilder> requestBuilders;
1613

1714
public KotlinCoroutinesRequestBuilder(AbstractParameterBuilder parameterBuilder, RequestBodyBuilder requestBodyBuilder,
18-
OperationBuilder operationBuilder, List<AbstractRequestBuilder> requestBuilders) {
15+
OperationBuilder operationBuilder) {
1916
super(parameterBuilder, requestBodyBuilder, operationBuilder);
20-
this.requestBuilders = requestBuilders;
2117
}
2218

2319
@Override
2420
protected boolean isParamTypeToIgnore(Class<?> paramType) {
25-
return paramType.isAssignableFrom(Continuation.class) || requestBuilders.stream().anyMatch(builder -> builder.isParamTypeToIgnore(paramType));
21+
return paramType.isAssignableFrom(Continuation.class);
2622
}
2723

2824
@Override

‎springdoc-openapi-security/src/main/java/org/springdoc/core/IgnoredParameterAnnotationsWithSecurity.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package org.springdoc.core;
22

33
import org.springframework.context.annotation.Primary;
4+
import org.springframework.security.core.Authentication;
45
import org.springframework.security.core.annotation.AuthenticationPrincipal;
56
import org.springframework.stereotype.Component;
67

@@ -12,5 +13,4 @@ public class IgnoredParameterAnnotationsWithSecurity implements IgnoredParameter
1213
public boolean isAnnotationToIgnore(java.lang.reflect.Parameter parameter) {
1314
return parameter.isAnnotationPresent(AuthenticationPrincipal.class);
1415
}
15-
1616
}

‎springdoc-openapi-security/src/main/java/org/springdoc/core/IgnoredParameterTypes.java

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package org.springdoc.core;
2+
3+
import org.springframework.security.core.Authentication;
4+
import org.springframework.stereotype.Component;
5+
6+
@Component
7+
public class IgnoredParameterTypes {
8+
static {
9+
AbstractRequestBuilder.PARAM_TYPES_TO_IGNORE.add(Authentication.class);
10+
}
11+
}

‎springdoc-openapi-security/src/test/java/test/org/springdoc/api/app2/app1/HelloController.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package test.org.springdoc.api.app2.app1;
2+
3+
import org.springframework.web.bind.annotation.GetMapping;
4+
import org.springframework.web.bind.annotation.RequestBody;
5+
import org.springframework.web.bind.annotation.RestController;
6+
7+
@RestController
8+
public class HelloController {
9+
10+
11+
@GetMapping
12+
public Object doPost(@RequestBody String req, org.springframework.security.core.Authentication auth) {
13+
return null;
14+
}
15+
16+
}

‎springdoc-openapi-security/src/test/java/test/org/springdoc/api/app2/app1/SpringDocApp2Test.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package test.org.springdoc.api.app2.app1;
2+
3+
import test.org.springdoc.api.AbstractSpringDocTest;
4+
5+
public class SpringDocApp2Test extends AbstractSpringDocTest {
6+
7+
}

‎springdoc-openapi-security/src/test/java/test/org/springdoc/api/app2/app1/SpringDocTestApp.java

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package test.org.springdoc.api.app2.app1;
2+
3+
import io.swagger.v3.oas.models.OpenAPI;
4+
import io.swagger.v3.oas.models.info.Info;
5+
import io.swagger.v3.oas.models.info.License;
6+
import org.springframework.boot.SpringApplication;
7+
import org.springframework.boot.autoconfigure.SpringBootApplication;
8+
import org.springframework.context.annotation.Bean;
9+
import org.springframework.context.annotation.ComponentScan;
10+
11+
@SpringBootApplication
12+
@ComponentScan(basePackages = {"org.springdoc", "test.org.springdoc.api.app2"})
13+
public class SpringDocTestApp {
14+
public static void main(String[] args) {
15+
SpringApplication.run(SpringDocTestApp.class, args);
16+
}
17+
18+
@Bean
19+
public OpenAPI customOpenAPI() {
20+
return new OpenAPI()
21+
.info(new Info().title("Security API").version("v1")
22+
.license(new License().name("Apache 2.0").url("http://springdoc.org")));
23+
}
24+
}

‎springdoc-openapi-security/src/test/resources/results/app2.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"openapi": "3.0.1",
3+
"info": {
4+
"title": "Security API",
5+
"license": {
6+
"name": "Apache 2.0",
7+
"url": "http://springdoc.org"
8+
},
9+
"version": "v1"
10+
},
11+
"servers": [
12+
{
13+
"url": "",
14+
"description": "Generated server url"
15+
}
16+
],
17+
"paths": {
18+
"/": {
19+
"get": {
20+
"tags": [
21+
"hello-controller"
22+
],
23+
"operationId": "doPost",
24+
"parameters": [
25+
{
26+
"name": "req",
27+
"in": "query",
28+
"required": true,
29+
"schema": {
30+
"type": "string"
31+
}
32+
}
33+
],
34+
"responses": {
35+
"200": {
36+
"description": "default response",
37+
"content": {
38+
"*/*": {
39+
"schema": {
40+
"type": "object"
41+
}
42+
}
43+
}
44+
}
45+
}
46+
}
47+
}
48+
},
49+
"components": {}
50+
}

‎springdoc-openapi-webflux-core/src/main/java/org/springdoc/core/RequestBuilder.java

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
import io.swagger.v3.oas.models.Operation;
44
import org.springframework.http.HttpMethod;
5-
import org.springframework.http.server.ServerHttpResponse;
65
import org.springframework.http.server.reactive.ServerHttpRequest;
76
import org.springframework.stereotype.Component;
87
import org.springframework.validation.BindingResult;
@@ -22,20 +21,30 @@ public RequestBuilder(AbstractParameterBuilder parameterBuilder, RequestBodyBuil
2221
super(parameterBuilder, requestBodyBuilder, operationBuilder);
2322
}
2423

25-
@Override
26-
protected boolean isParamTypeToIgnore(Class<?> paramType) {
27-
return WebRequest.class.equals(paramType) || NativeWebRequest.class.equals(paramType)
28-
|| java.security.Principal.class.equals(paramType) || HttpMethod.class.equals(paramType)
29-
|| java.util.Locale.class.equals(paramType) || java.util.TimeZone.class.equals(paramType)
30-
|| java.time.ZoneId.class.equals(paramType) || java.io.InputStream.class.equals(paramType)
31-
|| java.io.Reader.class.equals(paramType) || java.io.OutputStream.class.equals(paramType)
32-
|| java.io.Writer.class.equals(paramType) || java.util.Map.class.equals(paramType)
33-
|| org.springframework.ui.Model.class.equals(paramType) || ServerHttpRequest.class.equals(paramType)
34-
|| org.springframework.ui.ModelMap.class.equals(paramType) || ServerHttpResponse.class.equals(paramType)
35-
|| Errors.class.equals(paramType) || BindingResult.class.equals(paramType) || ServerWebExchange.class.equals(paramType)
36-
|| SessionStatus.class.equals(paramType) || UriComponentsBuilder.class.equals(paramType);
24+
static {
25+
PARAM_TYPES_TO_IGNORE.add(WebRequest.class);
26+
PARAM_TYPES_TO_IGNORE.add(NativeWebRequest.class);
27+
PARAM_TYPES_TO_IGNORE.add(java.security.Principal.class);
28+
PARAM_TYPES_TO_IGNORE.add(HttpMethod.class);
29+
PARAM_TYPES_TO_IGNORE.add(java.util.Locale.class);
30+
PARAM_TYPES_TO_IGNORE.add(java.util.TimeZone.class);
31+
PARAM_TYPES_TO_IGNORE.add(java.io.InputStream.class);
32+
PARAM_TYPES_TO_IGNORE.add(java.time.ZoneId.class);
33+
PARAM_TYPES_TO_IGNORE.add(java.io.Reader.class);
34+
PARAM_TYPES_TO_IGNORE.add(java.io.OutputStream.class);
35+
PARAM_TYPES_TO_IGNORE.add(java.io.Writer.class);
36+
PARAM_TYPES_TO_IGNORE.add(java.util.Map.class);
37+
PARAM_TYPES_TO_IGNORE.add(org.springframework.ui.Model.class);
38+
PARAM_TYPES_TO_IGNORE.add(ServerHttpRequest.class);
39+
PARAM_TYPES_TO_IGNORE.add(org.springframework.ui.ModelMap.class);
40+
PARAM_TYPES_TO_IGNORE.add(Errors.class);
41+
PARAM_TYPES_TO_IGNORE.add(BindingResult.class);
42+
PARAM_TYPES_TO_IGNORE.add(ServerWebExchange.class);
43+
PARAM_TYPES_TO_IGNORE.add(SessionStatus.class);
44+
PARAM_TYPES_TO_IGNORE.add(UriComponentsBuilder.class);
3745
}
3846

47+
3948
@Override
4049
protected Operation customiseOperation(Operation operation, HandlerMethod handlerMethod) {
4150
return operation;

‎springdoc-openapi-webmvc-core/src/main/java/org/springdoc/core/RequestBuilder.java

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
package org.springdoc.core;
22

3-
import io.swagger.v3.oas.annotations.Hidden;
43
import io.swagger.v3.oas.models.Operation;
5-
import org.springframework.core.annotation.AnnotationUtils;
64
import org.springframework.http.HttpMethod;
75
import org.springframework.stereotype.Component;
86
import org.springframework.validation.BindingResult;
@@ -22,24 +20,32 @@ public RequestBuilder(AbstractParameterBuilder parameterBuilder, RequestBodyBuil
2220
super(parameterBuilder, requestBodyBuilder, operationBuilder);
2321
}
2422

25-
@Override
26-
protected boolean isParamTypeToIgnore(Class<?> paramType) {
27-
return WebRequest.class.equals(paramType) || NativeWebRequest.class.equals(paramType)
28-
|| javax.servlet.ServletRequest.class.equals(paramType)
29-
|| javax.servlet.ServletResponse.class.equals(paramType)
30-
|| javax.servlet.http.HttpServletRequest.class.equals(paramType)
31-
|| javax.servlet.http.HttpServletResponse.class.equals(paramType)
32-
|| javax.servlet.http.HttpSession.class.equals(paramType)
33-
|| java.security.Principal.class.equals(paramType) || HttpMethod.class.equals(paramType)
34-
|| java.util.Locale.class.equals(paramType) || java.util.TimeZone.class.equals(paramType)
35-
|| java.time.ZoneId.class.equals(paramType) || java.io.InputStream.class.equals(paramType)
36-
|| java.io.Reader.class.equals(paramType) || java.io.OutputStream.class.equals(paramType)
37-
|| java.io.Writer.class.equals(paramType) || java.util.Map.class.equals(paramType)
38-
|| org.springframework.ui.Model.class.equals(paramType)
39-
|| org.springframework.ui.ModelMap.class.equals(paramType) || RedirectAttributes.class.equals(paramType)
40-
|| Errors.class.equals(paramType) || BindingResult.class.equals(paramType)
41-
|| SessionStatus.class.equals(paramType) || UriComponentsBuilder.class.equals(paramType)
42-
|| (AnnotationUtils.findAnnotation(paramType, Hidden.class) != null);
23+
static {
24+
PARAM_TYPES_TO_IGNORE.add(WebRequest.class);
25+
PARAM_TYPES_TO_IGNORE.add(NativeWebRequest.class);
26+
PARAM_TYPES_TO_IGNORE.add(javax.servlet.ServletRequest.class);
27+
PARAM_TYPES_TO_IGNORE.add(javax.servlet.ServletResponse.class);
28+
PARAM_TYPES_TO_IGNORE.add(javax.servlet.http.HttpServletRequest.class);
29+
PARAM_TYPES_TO_IGNORE.add(javax.servlet.http.HttpServletResponse.class);
30+
PARAM_TYPES_TO_IGNORE.add(javax.servlet.http.HttpSession.class);
31+
PARAM_TYPES_TO_IGNORE.add(java.security.Principal.class);
32+
PARAM_TYPES_TO_IGNORE.add(javax.servlet.http.HttpSession.class);
33+
PARAM_TYPES_TO_IGNORE.add(java.util.Locale.class);
34+
PARAM_TYPES_TO_IGNORE.add(HttpMethod.class);
35+
PARAM_TYPES_TO_IGNORE.add(java.util.TimeZone.class);
36+
PARAM_TYPES_TO_IGNORE.add(java.time.ZoneId.class);
37+
PARAM_TYPES_TO_IGNORE.add(java.io.InputStream.class);
38+
PARAM_TYPES_TO_IGNORE.add(java.io.Reader.class);
39+
PARAM_TYPES_TO_IGNORE.add(java.io.OutputStream.class);
40+
PARAM_TYPES_TO_IGNORE.add(java.util.Map.class);
41+
PARAM_TYPES_TO_IGNORE.add(org.springframework.ui.Model.class);
42+
PARAM_TYPES_TO_IGNORE.add(org.springframework.ui.ModelMap.class);
43+
PARAM_TYPES_TO_IGNORE.add(RedirectAttributes.class);
44+
PARAM_TYPES_TO_IGNORE.add(Errors.class);
45+
PARAM_TYPES_TO_IGNORE.add(BindingResult.class);
46+
PARAM_TYPES_TO_IGNORE.add(SessionStatus.class);
47+
PARAM_TYPES_TO_IGNORE.add(UriComponentsBuilder.class);
48+
PARAM_TYPES_TO_IGNORE.add(BindingResult.class);
4349
}
4450

4551
@Override

0 commit comments

Comments
 (0)