RESTEasy Reactive - prevent repeating of standard security checks

extensions/resteasy-reactive/quarkus-resteasy-reactive/deployment/src/main/java/io/quarkus/resteasy/reactive/server/deployment/ResteasyReactiveProcessor.java

@@ -143,6 +143,7 @@
 import io.quarkus.resteasy.reactive.server.runtime.ResteasyReactiveRecorder;
 import io.quarkus.resteasy.reactive.server.runtime.ResteasyReactiveRuntimeRecorder;
 import io.quarkus.resteasy.reactive.server.runtime.ResteasyReactiveServerRuntimeConfig;
+import io.quarkus.resteasy.reactive.server.runtime.StandardSecurityCheckInterceptor;
 import io.quarkus.resteasy.reactive.server.runtime.exceptionmappers.AuthenticationCompletionExceptionMapper;
 import io.quarkus.resteasy.reactive.server.runtime.exceptionmappers.AuthenticationFailedExceptionMapper;
 import io.quarkus.resteasy.reactive.server.runtime.exceptionmappers.AuthenticationRedirectExceptionMapper;
@@ -1131,6 +1132,17 @@ public void visit(int version, int access, String name, String signature,
 
  }
 
+ @BuildStep
+ void registerSecurityInterceptors(Capabilities capabilities,
+ BuildProducer<AdditionalBeanBuildItem> beans) {
+ if (capabilities.isPresent(Capability.SECURITY)) {
+ // Register interceptors for standard security annotations to prevent repeated security checks
+ beans.produce(new AdditionalBeanBuildItem(StandardSecurityCheckInterceptor.RolesAllowedInterceptor.class,
+ StandardSecurityCheckInterceptor.AuthenticatedInterceptor.class,
+ StandardSecurityCheckInterceptor.PermitAllInterceptor.class));
+ }
+ }
+
  private <T> T consumeStandardSecurityAnnotations(MethodInfo methodInfo, ClassInfo classInfo, IndexView index,
  Function<ClassInfo, T> function) {
  if (SecurityTransformerUtils.hasStandardSecurityAnnotation(methodInfo)) {

extensions/resteasy-reactive/quarkus-resteasy-reactive/deployment/src/test/java/io/quarkus/resteasy/reactive/server/test/security/RolesAllowedJaxRsTestCase.java

@@ -29,10 +29,9 @@ public class RolesAllowedJaxRsTestCase {
  static QuarkusUnitTest runner = new QuarkusUnitTest()
  .withApplicationRoot((jar) -> jar
  .addClasses(RolesAllowedResource.class, UserResource.class, RolesAllowedBlockingResource.class,
- SerializationEntity.class, SerializationRolesResource.class,
- TestIdentityProvider.class,
- TestIdentityController.class,
- UnsecuredSubResource.class));
+ SerializationEntity.class, SerializationRolesResource.class, TestIdentityProvider.class,
+ TestIdentityController.class, UnsecuredSubResource.class, RolesAllowedService.class,
+ RolesAllowedServiceResource.class));
 
  @BeforeAll
  public static void setupUsers() {
@@ -61,6 +60,14 @@ public void testUser() {
  RestAssured.given().auth().preemptive().basic("user", "user").get("/user").then().body(is("user"));
  }
 
+ @Test
+ public void testNestedRolesAllowed() {
+ // there are 2 different checks in place: user & admin on resource, admin on service
+ RestAssured.given().auth().basic("admin", "admin").get("/roles-service/hello").then().statusCode(200)
+ .body(is(RolesAllowedService.SERVICE_HELLO));
+ RestAssured.given().auth().basic("user", "user").get("/roles-service/hello").then().statusCode(403);
+ }
+
  @Test
  public void testSecurityRunsBeforeValidation() {
  read = false;

extensions/resteasy-reactive/quarkus-resteasy-reactive/deployment/src/test/java/io/quarkus/resteasy/reactive/server/test/security/RolesAllowedService.java

@@ -0,0 +1,16 @@
+package io.quarkus.resteasy.reactive.server.test.security;
+
+import javax.annotation.security.RolesAllowed;
+import javax.enterprise.context.ApplicationScoped;
+
+@ApplicationScoped
+public class RolesAllowedService {
+
+ public static final String SERVICE_HELLO = "Hello from Service!";
+
+ @RolesAllowed("admin")
+ public String hello() {
+ return SERVICE_HELLO;
+ }
+
+}

extensions/resteasy-reactive/quarkus-resteasy-reactive/deployment/src/test/java/io/quarkus/resteasy/reactive/server/test/security/RolesAllowedServiceResource.java

@@ -0,0 +1,21 @@
+package io.quarkus.resteasy.reactive.server.test.security;
+
+import javax.annotation.security.RolesAllowed;
+import javax.inject.Inject;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+
+@Path("/roles-service")
+public class RolesAllowedServiceResource {
+
+ @Inject
+ RolesAllowedService rolesAllowedService;
+
+ @Path("/hello")
+ @RolesAllowed({ "user", "admin" })
+ @GET
+ public String getServiceHello() {
+ return rolesAllowedService.hello();
+ }
+
+}

extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/StandardSecurityCheckInterceptor.java

@@ -0,0 +1,80 @@
+package io.quarkus.resteasy.reactive.server.runtime;
+
+import static io.quarkus.security.spi.runtime.SecurityHandlerConstants.EXECUTED;
+import static io.quarkus.security.spi.runtime.SecurityHandlerConstants.SECURITY_HANDLER;
+
+import java.lang.reflect.Method;
+
+import javax.annotation.Priority;
+import javax.annotation.security.DenyAll;
+import javax.annotation.security.PermitAll;
+import javax.annotation.security.RolesAllowed;
+import javax.inject.Inject;
+import javax.interceptor.AroundInvoke;
+import javax.interceptor.Interceptor;
+import javax.interceptor.InvocationContext;
+
+import org.jboss.resteasy.reactive.server.core.CurrentRequestManager;
+
+import io.quarkus.security.Authenticated;
+import io.quarkus.security.spi.runtime.AuthorizationController;
+import io.quarkus.security.spi.runtime.MethodDescription;
+
+/**
+ * Security checks for RBAC annotations on endpoints are done by
+ * the {@link io.quarkus.resteasy.reactive.server.runtime.security.EagerSecurityHandler},
+ * this interceptor propagates the information to the SecurityHandler to prevent repeated checks. The {@link DenyAll}
+ * security check is performed just once.
+ */
+public abstract class StandardSecurityCheckInterceptor {
+
+ public static final String STANDARD_SECURITY_CHECK_INTERCEPTOR = StandardSecurityCheckInterceptor.class.getName();
+
+ @Inject
+ AuthorizationController controller;
+
+ @AroundInvoke
+ public Object intercept(InvocationContext ic) throws Exception {
+ if (controller.isAuthorizationEnabled() && CurrentRequestManager.get() != null
+ && alreadyDoneByEagerSecurityHandler(
+ CurrentRequestManager.get().getProperty(STANDARD_SECURITY_CHECK_INTERCEPTOR), ic.getMethod())) {
+ ic.getContextData().put(SECURITY_HANDLER, EXECUTED);
+ }
+ return ic.proceed();
+ }
+
+ private boolean alreadyDoneByEagerSecurityHandler(Object methodWithFinishedChecks, Method method) {
+ // compare methods: EagerSecurityHandler only intercept endpoints, we still want SecurityHandler run for CDI beans
+ return methodWithFinishedChecks != null && MethodDescription.ofMethod(method).equals(methodWithFinishedChecks);
+ }
+
+ /**
+ * Prevent the SecurityHandler from performing {@link RolesAllowed} security checks
+ */
+ @Interceptor
+ @RolesAllowed("")
+ @Priority(Interceptor.Priority.PLATFORM_BEFORE)
+ public static final class RolesAllowedInterceptor extends StandardSecurityCheckInterceptor {
+
+ }
+
+ /**
+ * Prevent the SecurityHandler from performing {@link javax.annotation.security.PermitAll} security checks
+ */
+ @Interceptor
+ @PermitAll
+ @Priority(Interceptor.Priority.PLATFORM_BEFORE)
+ public static final class PermitAllInterceptor extends StandardSecurityCheckInterceptor {
+
+ }
+
+ /**
+ * Prevent the SecurityHandler from performing {@link Authenticated} security checks
+ */
+ @Interceptor
+ @Authenticated
+ @Priority(Interceptor.Priority.PLATFORM_BEFORE)
+ public static final class AuthenticatedInterceptor extends StandardSecurityCheckInterceptor {
+
+ }
+}

extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java

@@ -1,5 +1,7 @@
 package io.quarkus.resteasy.reactive.server.runtime.security;
 
+import static io.quarkus.resteasy.reactive.server.runtime.StandardSecurityCheckInterceptor.STANDARD_SECURITY_CHECK_INTERCEPTOR;
+
 import java.lang.reflect.Method;
 import java.util.Collections;
 import java.util.List;
@@ -75,7 +77,9 @@ public void handle(ResteasyReactiveRequestContext requestContext) throws Excepti
 
  requestContext.requireCDIRequestScope();
  SecurityCheck theCheck = check;
- if (!theCheck.isPermitAll()) {
+ if (theCheck.isPermitAll()) {
+ preventRepeatedSecurityChecks(requestContext, methodDescription);
+ } else {
  requestContext.suspend();
  Uni<SecurityIdentity> deferredIdentity = getCurrentIdentityAssociation().get().getDeferredIdentity();
 
@@ -95,6 +99,7 @@ public void handle(ResteasyReactiveRequestContext requestContext) throws Excepti
  public Object apply(SecurityIdentity securityIdentity) {
  theCheck.apply(securityIdentity, methodDescription,
  requestContext.getParameters());
+ preventRepeatedSecurityChecks(requestContext, methodDescription);
  return null;
  }
  })
@@ -117,6 +122,13 @@ public void onFailure(Throwable failure) {
  }
  }
 
+ private void preventRepeatedSecurityChecks(ResteasyReactiveRequestContext requestContext,
+ MethodDescription methodDescription) {
+ // propagate information that security check has been performed on this method to the SecurityHandler
+ // via io.quarkus.resteasy.reactive.server.runtime.StandardSecurityCheckInterceptor
+ requestContext.setProperty(STANDARD_SECURITY_CHECK_INTERCEPTOR, methodDescription);
+ }
+
  private InjectableInstance<CurrentIdentityAssociation> getCurrentIdentityAssociation() {
  InjectableInstance<CurrentIdentityAssociation> identityAssociation = this.currentIdentityAssociation;
  if (identityAssociation == null) {

extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/SecurityHandlerConstants.java

@@ -0,0 +1,15 @@
+package io.quarkus.security.spi.runtime;
+
+public class SecurityHandlerConstants {
+
+ /**
+ * Invocation context data key used by the SecurityHandler to save a security checks state
+ */
+ public static final String SECURITY_HANDLER = "io.quarkus.security.securityHandler";
+
+ /**
+ * The SecurityHandler keep a state of security checks in the Invocation context data to prevent repeated checks.
+ * `executed` means the check has already been done.
+ */
+ public static final String EXECUTED = "executed";
+}

extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java

@@ -1,5 +1,8 @@
 package io.quarkus.security.runtime.interceptor;
 
+import static io.quarkus.security.spi.runtime.SecurityHandlerConstants.EXECUTED;
+import static io.quarkus.security.spi.runtime.SecurityHandlerConstants.SECURITY_HANDLER;
+
 import java.util.concurrent.CompletionStage;
 import java.util.function.Function;
 
@@ -16,9 +19,6 @@
 @Singleton
 public class SecurityHandler {
 
- private static final String HANDLER_NAME = SecurityHandler.class.getName();
- private static final String EXECUTED = "executed";
-
  @Inject
  SecurityConstrainer constrainer;
 
@@ -49,7 +49,7 @@ public Object handle(InvocationContext ic) throws Exception {
  }
 
  private boolean alreadyHandled(InvocationContext ic) {
- return ic.getContextData().put(HANDLER_NAME, EXECUTED) != null;
+ return ic.getContextData().put(SECURITY_HANDLER, EXECUTED) != null;
  }
 
  private static class UniContinuation implements Function<Object, Uni<?>> {