Package org.apache.juneau.petstore.console.dev

Class SecureApiRest

java.lang.Object

jakarta.servlet.GenericServlet

jakarta.servlet.http.HttpServlet

org.apache.juneau.rest.server.servlet.RestServlet

org.apache.juneau.rest.server.servlet.BasicRestServlet

org.apache.juneau.petstore.console.PetstoreConsolePage

org.apache.juneau.petstore.console.dev.SecureApiRest

All Implemented Interfaces:

jakarta.servlet.Servlet, jakarta.servlet.ServletConfig, Serializable, BasicUniversalConfig, DefaultConfig, DefaultHtmlConfig

public class SecureApiRest
extends PetstoreConsolePage

The bearer-token protected API behind the Secure page.

Every op is gated by a fail-closed BearerTokenGuard backed by StubBearerTokenValidator: no token or an unknown token is a 401 with a WWW-Authenticate: Bearer realm="petstore" challenge. On success the resolved Principal reaches ops as an @Auth parameter.

Why a guard rather than a filter chain? AuthFilterChain composes several mechanisms and is fail-open by design, so a downstream guard decides. With one mechanism, the op-level guard is the whole story.

Example:

// One bean gates every op on the resource. @Bean public RestGuardList guards(BeanStore bs) { return RestGuardList.create(bs) .append(BearerTokenGuard.create().realm("petstore").validator(new StubBearerTokenValidator()).build()) .build(); } // curl -H 'Authorization: Bearer petstore-user' http://localhost:10000/console/dev/secure/api/pets

See Also:

• Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.juneau.rest.server.servlet.RestServlet

RestServlet.Builder<R extends RestServlet,SELF extends RestServlet.Builder<R,SELF>>, RestServlet.DefaultBuilder<R extends RestServlet>

Field Summary

Fields inherited from class org.apache.juneau.petstore.console.PetstoreConsolePage

PAGE_HEADER, TEMPLATES

Fields inherited from class jakarta.servlet.http.HttpServlet

LEGACY_DO_HEAD

Constructor Summary

Constructors

Constructor	Description
SecureApiRest()

Method Summary

Modifier and Type	Method	Description
RestGuardList	guards(BeanStore bs)	Gates every op on this resource with a bearer-token guard.
Pet	pet(long id)
Collection<Pet>	pets()
Map<String,String>	whoami(Principal caller)

Methods inherited from class org.apache.juneau.petstore.console.PetstoreConsolePage

builder, freemarker, store, twin

Methods inherited from class org.apache.juneau.rest.server.servlet.RestServlet

builder, createAuthenticator, destroy, doLog, getContext, getPath, getPaths, getRequest, getResponse, getRestBuilder, init, log, log, service, setContext

Methods inherited from class jakarta.servlet.http.HttpServlet

doDelete, doGet, doHead, doOptions, doPatch, doPost, doPut, doTrace, getLastModified, isSensitiveHeader, service

Methods inherited from class jakarta.servlet.GenericServlet

getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecureApiRest

public SecureApiRest()

Method Details

guards

public RestGuardList guards(BeanStore bs)

Gates every op on this resource with a bearer-token guard.

Parameters:

bs - The bean store.

Returns:

The guard list.

pets

public Collection<Pet> pets()

Returns:

All pets.

pet

public Pet pet(@Path("id")
 long id)

Parameters:

id - The pet id.

Returns:

The pet.

Throws:

NotFound - If there is no such pet.

whoami

public Map<String,String> whoami(@Auth
 Principal caller)

Parameters:

caller - The authenticated principal (never null: the guard rejects anonymous calls first).

Returns:

{name: <principal>}.