Merge pull request #1 from Making-Sense-Info/Feat/dependencies

Feat/dependencies

.github/workflows/ci.yml

@@ -1,14 +1,10 @@
 name: Trevas Lab CI
 
 on:
-  #schedule:
-  #- cron: "0 10 * * *" # everyday at 10am
   push:
-    branches:
-      - "**"
+    branches: ["master", "develop"]
     tags:
       - "*"
-  pull_request:
 
 jobs:
   build:

pom.xml

@@ -5,12 +5,11 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>2.7.14</version>
-        <relativePath/> <!-- lookup parent from repository -->
+        <version>3.3.4</version>
     </parent>
     <groupId>fr.insee</groupId>
     <artifactId>trevas-lab</artifactId>
-    <version>0.6.0</version>
+    <version>0.7.0</version>
     <name>Trevas Lab</name>
     <description>VTL API calling Trevas</description>
 
@@ -25,6 +24,8 @@
         <java.version>21</java.version>
         <trevas.version>1.7.0</trevas.version>
         <jackson.version>2.15.2</jackson.version>
+        <jakarta-servlet.version>4.0.3</jakarta-servlet.version>
+        <jersey.version>2.36</jersey.version>
     </properties>
 
     <dependencyManagement>
@@ -175,58 +176,43 @@
             <version>${jackson.version}</version>
         </dependency>
 
-        <!-- Temp fix. TODO: Update Spring boot -->
-        <dependency>
-            <groupId>org.projectlombok</groupId>
-            <artifactId>lombok</artifactId>
-            <version>1.18.30</version>
-            <scope>provided</scope>
-        </dependency>
-
+        <!-- Spring Web -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.springframework.boot</groupId>
-                    <artifactId>spring-boot-starter-logging</artifactId>
-                </exclusion>
-            </exclusions>
+            <version>3.3.4</version>
         </dependency>
+        <!-- Spring Security -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-log4j2</artifactId>
+            <artifactId>spring-boot-starter-security</artifactId>
+            <version>3.3.4</version>
         </dependency>
+        <!-- OIDC -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-security</artifactId>
+            <artifactId>spring-boot-starter-oauth2-client</artifactId>
+            <version>3.3.4</version>
         </dependency>
+        <!-- Test dependencies -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <version>3.3.4</version>
+            <scope>test</scope>
         </dependency>
         <dependency>
-            <groupId>org.springframework.security.oauth</groupId>
-            <artifactId>spring-security-oauth2</artifactId>
-            <version>2.3.5.RELEASE</version>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-log4j2</artifactId>
+            <version>3.3.4</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
+            <version>3.3.4</version>
             <scope>runtime</scope>
             <optional>true</optional>
         </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-test</artifactId>
-            <scope>test</scope>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.junit.vintage</groupId>
-                    <artifactId>junit-vintage-engine</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
     </dependencies>
 
     <build>

src/main/java/fr/insee/trevas/lab/configuration/security/SecurityConfiguration.java

@@ -0,0 +1,61 @@
+package fr.insee.trevas.lab.configuration.security;
+
+import fr.insee.trevas.lab.model.User;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfiguration {
+
+    @Value("${app.security.enabled}")
+    private boolean securityEnabled;
+
+    @Value("${spring.security.oauth2.login-page}")
+    private String loginPage;
+
+    @Value("${jwt.username-claim}")
+    private String usernameClaim;
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        if (!securityEnabled) {
+            // Désactive toute sécurité
+            http.csrf(AbstractHttpConfigurer::disable)
+                    .authorizeHttpRequests(authorize -> authorize
+                            .anyRequest().permitAll()
+                    );
+        } else {
+            // Active OIDC
+            http.csrf(AbstractHttpConfigurer::disable)
+                    .authorizeHttpRequests(authorize -> authorize
+                            .requestMatchers("/public").permitAll()  // Endpoint public
+                            .anyRequest().authenticated()
+                    )
+                    .oauth2Login(oauth2 -> oauth2
+                            .loginPage("/oauth2/authorization/myclient") // Page de login personnalisée, peut être modifiée
+                    );
+        }
+        return http.build();
+    }
+
+    @Bean
+    public UserProvider getUserProvider() {
+        return auth -> {
+            final User user = new User();
+            if (null == auth) {
+                return user;
+            }
+            final Jwt jwt = (Jwt) auth.getPrincipal();
+            user.setId(jwt.getClaimAsString(usernameClaim));
+            user.setAuthToken(jwt.getTokenValue());
+            return user;
+        };
+    }
+}

src/main/resources/application.yaml

@@ -1,12 +1,26 @@
-auth:
-  mode: "NONE"
 spark:
   master: "local"
+
+app:
+  security:
+    enabled: false
+
 spring:
   security:
     oauth2:
-      resourceserver:
-        jwt:
-          issuer-uri: ""
+      login-page: "/oauth2/authorization/myclient"
+      client:
+        registration:
+          myclient:
+            client-id: your-client-id
+            client-secret: your-client-secret
+            scope: openid,profile,email
+            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
+            client-name: My OIDC Client
+            provider: myprovider
+        provider:
+          myprovider:
+            issuer-uri: https://accounts.google.com  # Par exemple Google ou un autre fournisseur OIDC
+
 jwt:
-  username-claim: "preferred_username"
+  username-claim: "preferred_username"