Does @DgsQuery work with @EnableReactiveMethodSecurity and @PreAuthorize or @Secured

[rthomsenshiftconnect]

I am using graphql-dgs-webflux-starter and EnableReactiveMethodSecurity to protect my Spring Boot endpoints; When I add @PreAuthorize("isAuthenticated()") to a RestController mapping, it works as expected. However, when I add it a method annotated with @DgsQuery I get the following error:

The returnType class java.util.concurrent.CompletableFuture on public java.util.concurrent.CompletableFuture com.company.endpoint.UserEndpoint.getUser() must return an instance of org.reactivestreams.Publisher (i.e. Mono / Flux) or the function must be a Kotlin coroutine function in order to support Reactor Context

If I change the return type on the method annotated with @DgsQuery to a Flux I get the following error:

Can't resolve value (/getUser) : type mismatch error, expected type LIST got class reactor.core.publisher.MonoFlatMapMany

Are @DgsQuery and @EnableReactiveMethodSecurity compatiable?

Thanks in advance.

Rick

[paulbakker]

@rthomsenshiftconnect the first issue is that Flux/Mono wasn't supported as a return type yet. There is an issue about this, where I replied with a possible PR: #376.

I've not looked into EnableReactiveMethodSecurity yet.

[AlexRiedler]

I think #375 (comment) is on the same note as this discussion. I think there is a way to do it with a small change to DataFetcherResultProcessor , by providing the DFE into it; but not sure what peoples opinions are on that.

[rthomsenshiftconnect]

@AlexRiedler Thanks for sharing. Seems to me you are on the right track. Thanks for submitting the PR.

I have tested on version 4.2.0, and can comfirm the EnableReactiveMethodSecurity does not work, even though Mono and Flux are now supported. I was able to verify EnableReactiveMethodSecurity worked correctly with RestController and an injected Service containing a method annotated with PreAuthorize("isAuthenticated()"). Calling the same method from a component annotated with DgsComponent/ DgsQuery resulted in the following error/stacktrace:

org.springframework.security.access.AccessDeniedException: Denied at org.springframework.security.access.prepost.PrePostAdviceReactiveMethodInterceptor.lambda$invoke$2(PrePostAdviceReactiveMethodInterceptor.java:112) ~[spring-security-core-5.5.0.jar:5.5.0] at reactor.core.publisher.MonoDefer.subscribe(MonoDefer.java:44) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.Mono.subscribe(Mono.java:4150) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxSwitchIfEmpty$SwitchIfEmptySubscriber.onComplete(FluxSwitchIfEmpty.java:81) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxFilter$FilterSubscriber.onComplete(FluxFilter.java:166) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.Operators$MonoSubscriber.complete(Operators.java:1816) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxDefaultIfEmpty$DefaultIfEmptySubscriber.onComplete(FluxDefaultIfEmpty.java:108) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onComplete(FluxMapFuseable.java:150) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.MonoFlatMap$FlatMapMain.onComplete(MonoFlatMap.java:181) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxFilterFuseable$FilterFuseableSubscriber.onComplete(FluxFilterFuseable.java:171) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.Operators$ScalarSubscription.request(Operators.java:2399) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxFilterFuseable$FilterFuseableSubscriber.request(FluxFilterFuseable.java:191) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.MonoFlatMap$FlatMapMain.onSubscribe(MonoFlatMap.java:110) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.FluxFilterFuseable$FilterFuseableSubscriber.onSubscribe(FluxFilterFuseable.java:87) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.MonoCurrentContext.subscribe(MonoCurrentContext.java:36) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.Mono.subscribe(Mono.java:4150) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.Mono.subscribeWith(Mono.java:4265) ~[reactor-core-3.4.6.jar:3.4.6] at reactor.core.publisher.Mono.toFuture(Mono.java:4670) ~[reactor-core-3.4.6.jar:3.4.6] at com.netflix.graphql.dgs.reactive.internal.FluxDataFetcherResultProcessor.process(ReactiveDataFetcherResultProcessor.kt:45) ~[graphql-dgs-reactive-4.2.0.jar:4.2.0] at com.netflix.graphql.dgs.internal.DgsSchemaProvider$createBasicDataFetcher$1.get(DgsSchemaProvider.kt:293) ~[graphql-dgs-4.2.0.jar:4.2.0] at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:270) ~[graphql-java-16.2.jar:na] at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:203) ~[graphql-java-16.2.jar:na] at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:60) ~[graphql-java-16.2.jar:na] at graphql.execution.Execution.executeOperation(Execution.java:165) ~[graphql-java-16.2.jar:na] at graphql.execution.Execution.execute(Execution.java:104) ~[graphql-java-16.2.jar:na] at graphql.GraphQL.execute(GraphQL.java:557) ~[graphql-java-16.2.jar:na] at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:482) ~[graphql-java-16.2.jar:na] at graphql.GraphQL.executeAsync(GraphQL.java:446) ~[graphql-java-16.2.jar:na] at com.netflix.graphql.dgs.internal.BaseDgsQueryExecutor.baseExecute(DefaultDgsQueryExecutor.kt:226) ~[graphql-dgs-4.2.0.jar:4.2.0] at com.netflix.graphql.dgs.reactive.internal.DefaultDgsReactiveQueryExecutor$execute$2.apply(DefaultDgsReactiveQueryExecutor.kt:71) ~[graphql-dgs-reactive-4.2.0.jar:4.2.0] at com.netflix.graphql.dgs.reactive.internal.DefaultDgsReactiveQueryExecutor$execute$2.apply(DefaultDgsReactiveQueryExecutor.kt:40) ~[graphql-dgs-reactive-4.2.0.jar:4.2.0]

[shiyouping]

I tested it with com.netflix.graphql.dgs:graphql-dgs-webflux-starter:4.3.1, and confirmed that only @PreAuthorize works with @EnableReactiveMethodSecurity in classes annotated with @RestController and @DgsComponent. But @RolesAllowed, and @Secured still don't work.

[AlexRiedler]

as per spring-boot RolesAllowed and Secured are not supported from what I understand on this ticket: spring-projects/spring-security#5103 ; this is more of an issue with WebFlux support in Spring Boot rather than DGS framework support.

[shiyouping]

The document here https://netflix.github.io/dgs/advanced/security/ should be corrected. It is so misleading that many developers may waste too much time trying it out.

[shiyouping]

Sorry for my misleading comment above. @PreAuthorize can protect the methods annotated, but it cannot retrieve the right SecurityContext, which leads to the exception mentioned by @rthomsenshiftconnect. In other words, PreAuthorize doesn't work with DgsComponent either.