Skip to content

Commit d996224

Browse files
oharstaoharsta
committed
Add security to prometheus endpoint. Wraps up #670 
1 parent 3216902 commit d996224

8 files changed

Lines changed: 46 additions & 37 deletions

File tree

‎account-gui/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"devDependencies": {
88
"@babel/core": "^7.28.0",
99
"@babel/preset-env": "^7.28.0",
10-
"@sveltejs/vite-plugin-svelte": "^5.1.0",
10+
"@sveltejs/vite-plugin-svelte": "^6.0.0",
1111
"babel-jest": "^29.7.0",
1212
"babel-loader": "^10.0.0",
1313
"core-js": "^3.44.0",

‎account-gui/yarn.lock‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1516,24 +1516,24 @@
15161516
dependencies:
15171517
"@sinonjs/commons" "^3.0.0"
15181518

1519-
"@sveltejs/vite-plugin-svelte-inspector@^4.0.1":
1520-
version "4.0.1"
1521-
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-4.0.1.tgz#2f99a4a593bb910d1492f6c00a042b521c07147e"
1522-
integrity sha512-J/Nmb2Q2y7mck2hyCX4ckVHcR5tu2J+MtBEQqpDrrgELZ2uvraQcK/ioCV61AqkdXFgriksOKIceDcQmqnGhVw==
1519+
"@sveltejs/vite-plugin-svelte-inspector@^5.0.0-next.1":
1520+
version "5.0.0"
1521+
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.0.tgz#6daf8fb9fced43390614caf449409371847ba655"
1522+
integrity sha512-iwQ8Z4ET6ZFSt/gC+tVfcsSBHwsqc6RumSaiLUkAurW3BCpJam65cmHw0oOlDMTO0u+PZi9hilBRYN+LZNHTUQ==
15231523
dependencies:
1524-
debug "^4.3.7"
1524+
debug "^4.4.1"
15251525

1526-
"@sveltejs/vite-plugin-svelte@^5.1.0":
1527-
version "5.1.0"
1528-
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-5.1.0.tgz#5c1df403a23a7bfc5b856621c3234de3e8946121"
1529-
integrity sha512-wojIS/7GYnJDYIg1higWj2ROA6sSRWvcR1PO/bqEyFr/5UZah26c8Cz4u0NaqjPeVltzsVpt2Tm8d2io0V+4Tw==
1526+
"@sveltejs/vite-plugin-svelte@^6.0.0":
1527+
version "6.0.0"
1528+
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.0.0.tgz#4a1fbbac98f1eac46c7689515de3cd6ae4638499"
1529+
integrity sha512-mma5GJ23pYiWpTNbN//g9XI3Hfob3aAlXPP42qRtvjgTAU6pfJyLyNPTdLjFuj+jfC9JslP4J3AkeiJNhjtLLA==
15301530
dependencies:
1531-
"@sveltejs/vite-plugin-svelte-inspector" "^4.0.1"
1531+
"@sveltejs/vite-plugin-svelte-inspector" "^5.0.0-next.1"
15321532
debug "^4.4.1"
15331533
deepmerge "^4.3.1"
15341534
kleur "^4.1.5"
15351535
magic-string "^0.30.17"
1536-
vitefu "^1.0.6"
1536+
vitefu "^1.1.1"
15371537

15381538
"@trysound/sax@0.2.0":
15391539
version "0.2.0"
@@ -2188,7 +2188,7 @@ debug@2.6.9:
21882188
dependencies:
21892189
ms "2.0.0"
21902190

2191-
debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.7, debug@^4.4.1:
2191+
debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.4.1:
21922192
version "4.4.1"
21932193
resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.1.tgz#e5a8bc6cbc4c6cd3e64308b0693a3d4fa550189b"
21942194
integrity sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==
@@ -4146,10 +4146,10 @@ vite@^6.3.5:
41464146
optionalDependencies:
41474147
fsevents "~2.3.3"
41484148

4149-
vitefu@^1.0.6:
4150-
version "1.0.6"
4151-
resolved "https://registry.yarnpkg.com/vitefu/-/vitefu-1.0.6.tgz#3d2534621ea95081e6fbf4c0d8db9a292357a41b"
4152-
integrity sha512-+Rex1GlappUyNN6UfwbVZne/9cYC4+R2XDk9xkNXBKMw6HQagdX9PgZ8V2v1WUSK1wfBLp7qbI1+XSNIlB1xmA==
4149+
vitefu@^1.1.1:
4150+
version "1.1.1"
4151+
resolved "https://registry.yarnpkg.com/vitefu/-/vitefu-1.1.1.tgz#c39b7e4c91bf2f6c590fb96e0758f394dff5795b"
4152+
integrity sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ==
41534153

41544154
walker@^1.0.8:
41554155
version "1.0.8"

‎myconext-gui/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"@babel/core": "^7.28.0",
99
"@babel/preset-env": "^7.28.0",
1010
"@castlenine/svelte-qrcode": "^2.3.0",
11-
"@sveltejs/vite-plugin-svelte": "^5.1.0",
11+
"@sveltejs/vite-plugin-svelte": "^6.0.0",
1212
"babel-jest": "^29.7.0",
1313
"babel-loader": "^10.0.0",
1414
"core-js": "^3.44.0",

‎myconext-gui/yarn.lock‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1536,24 +1536,24 @@
15361536
dependencies:
15371537
"@sinonjs/commons" "^3.0.0"
15381538

1539-
"@sveltejs/vite-plugin-svelte-inspector@^4.0.1":
1540-
version "4.0.1"
1541-
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-4.0.1.tgz#2f99a4a593bb910d1492f6c00a042b521c07147e"
1542-
integrity sha512-J/Nmb2Q2y7mck2hyCX4ckVHcR5tu2J+MtBEQqpDrrgELZ2uvraQcK/ioCV61AqkdXFgriksOKIceDcQmqnGhVw==
1539+
"@sveltejs/vite-plugin-svelte-inspector@^5.0.0-next.1":
1540+
version "5.0.0"
1541+
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.0.tgz#6daf8fb9fced43390614caf449409371847ba655"
1542+
integrity sha512-iwQ8Z4ET6ZFSt/gC+tVfcsSBHwsqc6RumSaiLUkAurW3BCpJam65cmHw0oOlDMTO0u+PZi9hilBRYN+LZNHTUQ==
15431543
dependencies:
1544-
debug "^4.3.7"
1544+
debug "^4.4.1"
15451545

1546-
"@sveltejs/vite-plugin-svelte@^5.1.0":
1547-
version "5.1.0"
1548-
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-5.1.0.tgz#5c1df403a23a7bfc5b856621c3234de3e8946121"
1549-
integrity sha512-wojIS/7GYnJDYIg1higWj2ROA6sSRWvcR1PO/bqEyFr/5UZah26c8Cz4u0NaqjPeVltzsVpt2Tm8d2io0V+4Tw==
1546+
"@sveltejs/vite-plugin-svelte@^6.0.0":
1547+
version "6.0.0"
1548+
resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.0.0.tgz#4a1fbbac98f1eac46c7689515de3cd6ae4638499"
1549+
integrity sha512-mma5GJ23pYiWpTNbN//g9XI3Hfob3aAlXPP42qRtvjgTAU6pfJyLyNPTdLjFuj+jfC9JslP4J3AkeiJNhjtLLA==
15501550
dependencies:
1551-
"@sveltejs/vite-plugin-svelte-inspector" "^4.0.1"
1551+
"@sveltejs/vite-plugin-svelte-inspector" "^5.0.0-next.1"
15521552
debug "^4.4.1"
15531553
deepmerge "^4.3.1"
15541554
kleur "^4.1.5"
15551555
magic-string "^0.30.17"
1556-
vitefu "^1.0.6"
1556+
vitefu "^1.1.1"
15571557

15581558
"@trysound/sax@0.2.0":
15591559
version "0.2.0"
@@ -2252,7 +2252,7 @@ debug@2.6.9:
22522252
dependencies:
22532253
ms "2.0.0"
22542254

2255-
debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.7, debug@^4.4.1:
2255+
debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.4.1:
22562256
version "4.4.1"
22572257
resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.1.tgz#e5a8bc6cbc4c6cd3e64308b0693a3d4fa550189b"
22582258
integrity sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==
@@ -4241,10 +4241,10 @@ vite@^6.3.5:
42414241
optionalDependencies:
42424242
fsevents "~2.3.3"
42434243

4244-
vitefu@^1.0.6:
4245-
version "1.0.6"
4246-
resolved "https://registry.yarnpkg.com/vitefu/-/vitefu-1.0.6.tgz#3d2534621ea95081e6fbf4c0d8db9a292357a41b"
4247-
integrity sha512-+Rex1GlappUyNN6UfwbVZne/9cYC4+R2XDk9xkNXBKMw6HQagdX9PgZ8V2v1WUSK1wfBLp7qbI1+XSNIlB1xmA==
4244+
vitefu@^1.1.1:
4245+
version "1.1.1"
4246+
resolved "https://registry.yarnpkg.com/vitefu/-/vitefu-1.1.1.tgz#c39b7e4c91bf2f6c590fb96e0758f394dff5795b"
4247+
integrity sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ==
42484248

42494249
walker@^1.0.8:
42504250
version "1.0.8"

‎myconext-server/src/main/java/myconext/security/SecurityConfiguration.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,11 +280,14 @@ public SecurityFilterChain appSecurityFilterChain(HttpSecurity http) throws Exce
280280
"/myconext/api/attribute-manipulation/**",
281281
"/myconext/api/system/**",
282282
"/myconext/api/invite/**",
283-
"/api/remote-creation/**"
283+
"/api/remote-creation/**",
284+
"/internal/prometheus"
284285
};
285286
http.securityMatcher(antPatterns)
286287
.securityContext(sc -> sc.requireExplicitSave(false))
287288
.csrf(csrf -> csrf.disable())
289+
.authorizeHttpRequests(auth -> auth
290+
.requestMatchers("/internal/prometheus").hasRole("actuator"))
288291
.authorizeHttpRequests(auth -> auth
289292
.requestMatchers(antPatterns).authenticated())
290293
.httpBasic(withDefaults())

‎myconext-server/src/main/resources/application.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ logging:
33
level:
44
org.springframework.data.mongodb: INFO
55
org.springframework.data.convert: INFO
6-
org.springframework.security: INFO
6+
org.springframework.security: TRACE
77
io.mongock.: TRACE
88
tiqr.org: DEBUG
99
myconext: DEBUG
@@ -183,6 +183,11 @@ external-api-configuration:
183183
password: "secret"
184184
scopes:
185185
- invite
186+
-
187+
username: internal
188+
password: "secret"
189+
scopes:
190+
- actuator
186191

187192
oidc-token-api:
188193
token-url: https://connect.test2.surfconext.nl/tokens

‎myconext-server/src/main/resources/logback-spring.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
</appender>
99
<logger name="access" level="DEBUG"/>
1010
<logger name="io.mongock." level="DEBUG"/>
11-
<logger name="org.springframework.security" level="INFO"/>
11+
<logger name="org.springframework.security" level="TRACE"/>
1212
<logger name="org.mariadb.jdbc.message.server" level="ERROR"/>
1313
<logger name="com.zaxxer.hikari" level="ERROR"/>
1414
<root level="WARN">

‎myconext-server/src/test/java/myconext/api/MetricsControllerTest.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ void prometheus() throws IOException {
2626

2727
InputStream inputStream = given()
2828
.when()
29+
.auth().basic("internal", "secret")
2930
.get("/internal/prometheus")
3031
.asInputStream();
3132
SpringApplication.exit(applicationContext);

0 commit comments

Comments
 (0)