Найдите ниже мой класс конфигурации безопасности:
Код: Выделить всё
@Configuration
@EnableWebSecurity
@EnableMethodSecurity // Enable method security
public class SecurityConfig {
@Autowired
private JwtRequestFilter jwtRequestFilter;
@Autowired
private MyUserDetailsService myUserDetailsService; // Autowire your service here
// Autowired@
// private WhiteListURLGenerator whiteListURLGenerator;
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.csrf(AbstractHttpConfigurer::disable) // Disable CSRF protection
.authorizeHttpRequests(authz -> authz
// .requestMatchers(whiteListURLGenerator.getWhiteListURLs()).permitAll()
.requestMatchers(HttpMethod.POST, "/api/admin/users").permitAll()
.requestMatchers(HttpMethod.GET, "/api/admin/users").permitAll()
.requestMatchers(HttpMethod.GET, "/api/admin/users/{id}").permitAll()
.requestMatchers(HttpMethod.PUT, "/api/admin/users/**").hasRole("ADMIN")
.requestMatchers(HttpMethod.DELETE, "/api/admin/users/**").hasRole("ADMIN")
// .requestMatchers("/authenticate").permitAll() // Allow access to /authenticate
.requestMatchers("/api/admin/products").permitAll()
.requestMatchers(HttpMethod.GET, "/api/admin/products/{id}").permitAll()
.requestMatchers(HttpMethod.DELETE, "/api/admin/products/**").hasRole("ADMIN")
// Swagger UI and API docs
.requestMatchers("/swagger-ui/**", "/v3/api-docs/**", "/swagger-resources/**", "/swagger-ui.html", "/webjars/**").permitAll()
// Secure other endpoints
.anyRequest().permitAll()
)
.sessionManagement(session -> session
.sessionCreationPolicy(SessionCreationPolicy.STATELESS) // Use stateless sessions (JWT)
);
// Register the JWT filter
http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
return http.build();
}
@Bean
public AuthenticationManager authManager(HttpSecurity http) throws Exception {
AuthenticationManagerBuilder authenticationManagerBuilder =
http.getSharedObject(AuthenticationManagerBuilder.class);
authenticationManagerBuilder.userDetailsService(myUserDetailsService)
.passwordEncoder(passwordEncoder());
return authenticationManagerBuilder.build();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
Код: Выделить всё
@Configuration
@OpenAPIDefinition(info = @Info(title = "User Management API", version = "1.0", description = "API documentation for User Management Services"))
@SecurityScheme(
name = "bearerAuth",
type = SecuritySchemeType.HTTP,
bearerFormat = "JWT",
scheme = "bearer"
)
public class SwaggerConfig {
@Bean
public GroupedOpenApi authApi() {
return GroupedOpenApi.builder()
.group("Authentication")
.pathsToMatch("/authenticate/**")
.build();
}
@Bean
public GroupedOpenApi userApi() {
return GroupedOpenApi.builder()
.group("User Management")
.pathsToMatch("/api/admin/users/**")
.build();
}
@Bean
public GroupedOpenApi productApi() {
return GroupedOpenApi.builder()
.group("Product Management")
.pathsToMatch("/api/admin/products/**")
.build();
}
@Bean
public OpenAPI customOpenAPI() {
return new OpenAPI()
.info(new io.swagger.v3.oas.models.info.Info()
.title("User Management API")
.version("1.0")
.description("API documentation for User Management Services"));
}
}
Код: Выделить всё
org.springdoc
springdoc-openapi-security
1.8.0
org.springdoc
springdoc-openapi-ui
1.8.0
Подробнее здесь: https://stackoverflow.com/questions/790 ... ng-swagger