Make resource server paths configurable

Author: sluehr

src/main/java/engineering/everest/starterkit/security/config/ResourceServerConfig.java

@@ -2,6 +2,7 @@
 
 import engineering.everest.starterkit.security.ApplicationUserDetailsService;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -21,51 +22,27 @@
 @EnableResourceServer
 public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
 
-    private static final String ADMIN_API = "/admin/**";
-    private static final String SPRING_ACTUATOR_API = "/actuator/**";
-    private static final String APP_API = "/api/**";
-    private static final String SPRING_ACTUATOR_PROM_API = "/actuator/prometheus/**";
-    private static final String CATCH_ALL_PATH = "/**";
-    private static final String ORGANIZATIONS_REGISTER_API = "/api/organizations/register/**";
-    private static final String ORGANIZATIONS_REGISTER_CONFIRM_API = "/api/organizations/**/register/**";
-    private static final String VERSION_API = "/api/version";
-    private static final String SPRING_ACTUATOR_HEALTH_API = "/actuator/health/**";
-    private static final String GUEST_API = "/api/guest";
-    private static final String SWAGGER_API_DOCUMENTATION = "/api/doc/**";
-    private static final String SWAGGER_UI = "/swagger-ui/**";
-    private static final String SWAGGER_RESOURCES = "/swagger-resources/**";
-
-    private static final String[] ADMIN_USERS_PATHS = {
-            ADMIN_API,
-            SPRING_ACTUATOR_API
-    };
-    private static final String[] AUTHENTICATED_USER_PATHS = {
-            APP_API,
-            SPRING_ACTUATOR_PROM_API,
-            CATCH_ALL_PATH
-    };
-    private static final String[] ANONYMOUS_USER_PATHS = {
-            ORGANIZATIONS_REGISTER_API,
-            ORGANIZATIONS_REGISTER_CONFIRM_API,
-            VERSION_API,
-            SPRING_ACTUATOR_HEALTH_API,
-            GUEST_API,
-            SWAGGER_API_DOCUMENTATION,
-            SWAGGER_UI,
-            SWAGGER_RESOURCES
-    };
+    private final String[] anonymousUserAntPaths;
+    private final String[] authenticatedUserAntPaths;
+    private final String[] adminUserAntPaths;
 
     private final JwtAccessTokenConverter jwtAccessTokenConverter;
 
     @Autowired
     public ResourceServerConfig(JwtAccessTokenConverter jwtAccessTokenConverter,
-                                ApplicationUserDetailsService userDetailsService) {
+                                ApplicationUserDetailsService userDetailsService,
+                                @Value("${application.security.endpoint.matchers.anonymous}") String[] anonymousUserAntPaths,
+                                @Value("${application.security.endpoint.matchers.authenticated}") String[] authenticatedUserAntPaths,
+                                @Value("${application.security.endpoint.matchers.admin}") String[] adminUserAntPaths) {
         super();
         var defaultUserAuthenticationConverter = new DefaultUserAuthenticationConverter();
         defaultUserAuthenticationConverter.setUserDetailsService(userDetailsService);
         var accessTokenConverter = (DefaultAccessTokenConverter) jwtAccessTokenConverter.getAccessTokenConverter();
         accessTokenConverter.setUserTokenConverter(defaultUserAuthenticationConverter);
         this.jwtAccessTokenConverter = jwtAccessTokenConverter;
+        this.anonymousUserAntPaths = anonymousUserAntPaths;
+        this.authenticatedUserAntPaths = authenticatedUserAntPaths;
+        this.adminUserAntPaths = adminUserAntPaths;
     }
 
     @Override
@@ -79,8 +56,8 @@ public void configure(HttpSecurity http) throws Exception {
                 .csrf().disable()
                 .sessionManagement().sessionCreationPolicy(STATELESS).and()
                 .authorizeRequests(request ->
-                        request.antMatchers(ANONYMOUS_USER_PATHS).access("permitAll")
-                                .antMatchers(ADMIN_USERS_PATHS).access("hasRole('ADMIN')")
-                                .antMatchers(AUTHENTICATED_USER_PATHS).access("authenticated"));
+                        request.antMatchers(anonymousUserAntPaths).access("permitAll")
+                                .antMatchers(adminUserAntPaths).access("hasRole('ADMIN')")
+                                .antMatchers(authenticatedUserAntPaths).access("authenticated"));
     }
 }