Spring security context in Graphql Kotlin

[szaluzhskiy]

Hi team!
I'm trying to find some guides on how to integrate Spring security oauth2 in GraphQL-kotlin. At the moment there are few issues found - 692, 8 but they don't allow me to build the "full puzzle" on how to integrate reactive spring security to GraphQL

[DBetta]

Hi @szaluzhskiy,

From my analysis, the reactive security methods were not working because the ReactorContext is dropped by the implementation of FunctionDataFetcher#runSuspendingFunction. This method does receive a context that is always EmptyCoroutineContext thus clearing the spring boot coroutines integration.

This is my solution which seems to work.

1. I created an interface that can be used to create a new reactor context to be passed to FunctionDataFetcher.

import graphql.schema.DataFetchingEnvironment
import reactor.util.context.Context

interface DataFetcherContextEnhancer {

    /**
     * This method extracts a graphqlContext and creates reactor context
     */
    fun getContext(environment: DataFetchingEnvironment): Context

}

2. Created a spring component implementing the above interface.

@Component
class UaaDataFetcherContextEnhancer : DataFetcherContextEnhancer {

    override fun getContext(environment: DataFetchingEnvironment): Context {
        val graphQlAuthContext = environment.graphQlContext
        val contextWithAuthentication = graphQlAuthContext.get<ContextWithAuthentication>(ContextKeys.AUTHENTICATION)
        val authentication = contextWithAuthentication?.getAuthentication()
            ?: return ReactiveSecurityContextHolder.withSecurityContext(Mono.empty())
        return ReactiveSecurityContextHolder.withAuthentication(authentication)
    }
}

3. Create a new component of FunctionDataFetcher and use the above context enhancer to get the new reactor context, build a new spring SecurityContext and pass it to runSuspendingFunction as the restored context.

class MyDataFetcher(
    private val target: Any?,
    private val fn: KFunction<*>,
    objectMapper: ObjectMapper,
    context: ApplicationContext,
    private val contextEnhancerProvider: ObjectProvider<DataFetcherContextEnhancer>
) : SpringDataFetcher(target, fn, objectMapper, context) {

    override fun get(environment: DataFetchingEnvironment): Any? {
        val instance: Any? = target ?: environment.getSource<Any?>()
        val instanceParameter = fn.instanceParameter

        return if (instance != null && instanceParameter != null) {
            val parameterValues = getParameters(fn, environment)
                .plus(instanceParameter to instance)

            if (fn.isSuspend) {
                val coroutineContext = getCoroutineContext(environment)
                runSuspendingFunction(parameterValues, coroutineContext)
            } else {
                runBlockingFunction(parameterValues)
            }
        } else {
            null
        }
    }

    protected fun getCoroutineContext(environment: DataFetchingEnvironment): CoroutineContext =
        contextEnhancerProvider.ifAvailable
            ?.getContext(environment)
            ?.asCoroutineContext() ?: EmptyCoroutineContext
}

With the above implementation I can eventually use spring pre/post methods on my graphql queries/mutations/subscriptions as below:

@PreAuthorize("isAuthenticated()")
    suspend fun currentUser(context: GraphQlAuthContext): UserDto {
        // ...
    }

[tabneib]

@DBetta I tried your workaround but my DataFetchingEnvironment.graphQlContext is always null. Also, I don't introduce new interface + its implementation as you do but inline the logic of getContext directly into getCoroutineContext.

[stasbit]

@tabneib Can you please share a code snippet which is showing how to you call DataFetchingEnvironment.graphQlContext? I was following sample provided by @DBetta and recommendations from @dariuszkuc and it works!

[tabneib]

@stasbit

My CustomDataFetcherFactoryProvider:

class CustomDataFetcherFactoryProvider(
  private val springDataFetcherFactory: SpringDataFetcherFactory,
  private val objectMapper: ObjectMapper,
  private val applicationContext: ApplicationContext
) : SimpleKotlinDataFetcherFactoryProvider(objectMapper) {

  @Autowired
  lateinit var contextEnhancerProvider: ObjectProvider<DataFetcherContextEnhancer>

  override fun functionDataFetcherFactory(target: Any?, kFunction: KFunction<*>) = DataFetcherFactory {
    CustomFunctionDataFetcher(
      target = target,
      fn = kFunction,
      objectMapper = objectMapper,
      appContext = applicationContext,
      contextEnhancerProvider = contextEnhancerProvider,
    )
  }

  override fun propertyDataFetcherFactory(kClass: KClass<*>, kProperty: KProperty<*>): DataFetcherFactory<Any?> =
    if (kProperty.isLateinit) {
      springDataFetcherFactory
    } else {
      super.propertyDataFetcherFactory(kClass, kProperty)
    }
}

GraphQL Config:

 @Bean
  fun dataFetcherFactoryProvider(
    springDataFetcherFactory: SpringDataFetcherFactory,
    objectMapper: ObjectMapper,
    applicationContext: ApplicationContext
  ) = CustomDataFetcherFactoryProvider(springDataFetcherFactory, objectMapper, applicationContext)

btw, I also create the ContextWithAuthentication interface

interface ContextWithAuthentication {
  val authentication: Authentication
}

and there is a minor change in the getContext method (because ContextKeys.AUTHENTICATION is not resolved):

@Component
class DataFetcherContextEnhancerImpl : DataFetcherContextEnhancer {
  override fun getContext(environment: DataFetchingEnvironment): Context {
    val graphQlContext = environment.graphQlContext
    return if (graphQlContext is ContextWithAuthentication) {
      val authentication = graphQlContext.get<ContextWithAuthentication>("authentication")
      ReactiveSecurityContextHolder.withAuthentication(authentication)
    } else {
      ReactiveSecurityContextHolder.withSecurityContext(Mono.empty())
    }
  }
}

[tabneib]

@stasbit I am using graphql-kotlin-spring-server 5.3.1. Can you confirm which version are you working with?

[gronnern]

Have anyone done this is graphql-kotlin version 6.5.6 or newer?