Support for @PreAuthorize spring-security annotation

Hello,

I’m using Springfox 2.6.1 in JHipster apps and this is a feature request.

It would be nice if Springfox could support spring-security annotations, especially @PreAuthorize . It could be:

• Exposing in the swagger UI the requirements to access a resource or its methods
• Expose in the swagger spec only the resources and methods allowed for current user

Thanks

[chriswhite199]

Adapting the antMatcher link posted by @wojciech-soltys, the following works for my purposes (but by NO MEANS is exhaustive for all spring security annotations)

/**
 * Parse out Spring Security {@link PreAuthorize} annotations and add in operation notes section to convey constraints
 */
@Component
@Order(SwaggerPluginSupport.SWAGGER_PLUGIN_ORDER)
public class OperationNotesResourcesReader implements OperationBuilderPlugin {
    @Override
    public void apply(final OperationContext context) {
        // Look for @PreAuthorize on method, otherwise look on controller
        Optional.ofNullable(context.findAnnotation(PreAuthorize.class)
            .or(context.findControllerAnnotation(PreAuthorize.class))
            .orNull())
            .ifPresent(preAuth -> context.operationBuilder()
                .notes("**Security @PreAuthorize expression:** `" + preAuth.value() + "`"));
    }

    @Override
    public boolean supports(final DocumentationType delimiter) {
        return SwaggerPluginSupport.pluginDoesApply(delimiter);
    }
}

[gmarziou]

Yes that’s correct, it seems to me that currently the securityContexts and securitySchemes mainly deal with authentication and I would like to be able to document also authorizations.

The other point is that the swagger spec generated dynamically does not take into account the authorizations of the current user and so is exposing the complete API even though the current user is not authorized to use it. To me that’s a reason why some people are reluctant to enable swagger in production.

So maybe this should be split in 2 requests.