diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/README.md b/core-maven-plugins/httproutes-generator-maven-plugin/README.md
index 6710a6dd46..b136674684 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/README.md
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/README.md
@@ -2,14 +2,20 @@
This module contains `com.netcracker.cloud.plugins:httproutes-generator-maven-plugin`.
It scans compiled Java classes and generates Gateway API `HTTPRoute` manifests
-for Istio deployments.
+and Istio `AuthorizationPolicy` manifests for Istio deployments.
## What It Does
- Scans Spring MVC and Quarkus/JAX-RS endpoints from compiled classes.
-- Includes only classes/methods annotated with `@Route`.
-- Supports gateway path remapping via `@Gateway` and `@GatewayRequestMapping`.
-- Groups generated routes by route type (`INTERNAL`, `PRIVATE`, `PUBLIC`, `FACADE`).
+- Includes only classes/methods annotated with `@Route`, `@Routes`, `@FacadeRoute` or `@ForbiddenRoute`.
+- Supports gateway path remapping via `@Gateway` and `@GatewayRequestMapping`, and facade gateway paths via
+ `@FacadeGateway` and `@FacadeGatewayRequestMapping`.
+- Generates only `PathPrefix` path matches (see [How Paths Are Matched](#how-paths-are-matched)).
+- Groups generated routes by route type (`PUBLIC`, `PRIVATE`, `INTERNAL`, `FACADE`).
+- Generates `AuthorizationPolicy` resources with `DENY` rules for paths that must not be reachable
+ through a gateway (see [Forbidden Routes and AuthorizationPolicies](#forbidden-routes-and-authorizationpolicies)).
+- Fails the build before writing anything when the generated routing can't keep the legacy behavior
+ (see [Route Errors](#route-errors)).
- Emits Helm-ready YAML wrapped in:
`{{- if eq .Values.SERVICE_MESH_TYPE "Istio" }}`.
- Runs as an **aggregator** mojo, so it collects routes across reactor modules.
@@ -31,7 +37,7 @@ Add the plugin to your `pom.xml`:
com.netcracker.cloud.plugins
httproutes-generator-maven-plugin
- 1.0.0
+ 1.0.0
@@ -45,7 +51,7 @@ Add the plugin to your `pom.xml`:
8080
helm-templates/my-service/templates/annotations-httproutes.yaml
- {{ .Values.DEPLOYMENT_RESOURCE_NAME }}
+ {{ .Values.SERVICE_NAME }}
app.kubernetes.io/name
@@ -60,13 +66,25 @@ Add the plugin to your `pom.xml`:
### Parameters
-| Parameter | Type | Default | Description |
-|-----------------|----------------------|------------------------------------------|-----------------------------------------------------------------------------------------|
-| `packages` | `String[]` | `com.netcracker` | Package prefixes scanned in compiled classes. |
-| `servicePort` | `int` | `8080` | Backend service port for generated `backendRefs`. |
-| `outputFile` | `String` | `gateway-httproutes.yaml` | Output path relative to project base dir. |
-| `backendRefVal` | `String` | `{{ .Values.DEPLOYMENT_RESOURCE_NAME }}` | Backend service name in generated routes. |
-| `labels` | `List` | empty list | Custom labels for generated HTTPRoutes metadata. When set, they replace default labels. Each `` entry has a `` and `` child element, which allows label names containing `/`. |
+| Parameter | Type | Default | Description |
+|-------------------------------------|-----------------------|------------------------------------------|-----------------------------------------------------------------------------------------|
+| `packages` | `String[]` | `com.netcracker` | Package prefixes scanned in compiled classes. |
+| `servicePort` | `int` | `8080` | Backend service port for generated `backendRefs`. |
+| `outputFile` | `String` | `gateway-httproutes.yaml` | Output path relative to project base dir. |
+| `backendRefVal` | `String` | `{{ .Values.SERVICE_NAME }}` | Backend service name in generated routes. |
+| `labels` | `List` | empty list | Custom labels for the metadata of generated HTTPRoutes and AuthorizationPolicies. When set, they replace default labels. Each `` entry has a `` and `` child element, which allows label names containing `/`. |
+| `autoGenerateAuthorizationPolicies` | `boolean` | `false` | When `true`, the plugin generates the `DENY` rules that keep the legacy behavior, so you don't have to declare them with `@ForbiddenRoute`. See [Automatic DENY rules](#automatic-deny-rules). |
+
+Example that enables automatic DENY rules:
+
+```xml
+
+
+ com.example.service
+
+ true
+
+```
## Supported Annotations
@@ -75,20 +93,60 @@ Add the plugin to your `pom.xml`:
- Class/method mappings:
- `@RequestMapping`, `@GetMapping`, `@PostMapping`, `@PutMapping`,
`@DeleteMapping`, `@PatchMapping`
-- Route metadata:
- - `com.netcracker.cloud.routesregistration.common.annotation.Route`
- Gateway path mapping:
- `com.netcracker.cloud.routesregistration.common.annotation.Gateway`
- `com.netcracker.cloud.routesregistration.common.spring.gateway.route.annotation.GatewayRequestMapping`
+- Facade gateway path mapping:
+ - `com.netcracker.cloud.routesregistration.common.annotation.FacadeGateway`
+ - `com.netcracker.cloud.routesregistration.common.spring.gateway.route.annotation.FacadeGatewayRequestMapping`
### Quarkus / JAX-RS
- `@Path` with HTTP method annotations:
- `@GET`, `@POST`, `@PUT`, `@DELETE`, `@PATCH`
-- Route metadata:
- - `@Route`
- Gateway path mapping:
- `@Gateway`
+- Facade gateway path mapping:
+ - `@FacadeGateway`
+
+### Route metadata (both frameworks)
+
+All in `com.netcracker.cloud.routesregistration.common.annotation`:
+
+- `@Route`: the route type (`PUBLIC`, `PRIVATE`, `INTERNAL`, `FACADE`), `timeout` and `gateways`.
+ Several `@Route` annotations on one element (the `@Routes` container) are all read. As in legacy, `value` wins over
+ `type` unless it is `INTERNAL`, and a `@Route` without a type is `INTERNAL`.
+- `@FacadeRoute`: the same as `@Route(RouteType.FACADE)`, with its own `gateways`.
+- `@ForbiddenRoute`: gateways on which the gateway path of the element must not be reachable
+ (see [Forbidden Routes and AuthorizationPolicies](#forbidden-routes-and-authorizationpolicies)).
+
+A method-level route list replaces the class-level list, as in the legacy route registration, so a method `@Route`
+without a type is `INTERNAL` whatever the class `@Route` says. Each `@Route`/`@FacadeRoute` entry becomes these routes:
+
+- no `gateways`, type `PUBLIC`/`PRIVATE`/`INTERNAL`: a route of that type, with the gateway path from
+ `@Gateway`/`@GatewayRequestMapping`;
+- no `gateways`, type `FACADE`: a **facade route**, with the gateway path from
+ `@FacadeGateway`/`@FacadeGatewayRequestMapping`, or the service path when there is none;
+- every name in `gateways`: `public-gateway-service`, `private-gateway-service` and `internal-gateway-service`
+ give a route of type `PUBLIC`, `PRIVATE` and `INTERNAL`. Every other name is a composite gateway and gives a
+ **composite route**, with the gateway path from `@Gateway`/`@GatewayRequestMapping`.
+
+`hosts` are ignored: Istio has no composite gateways and no virtual hosts on a Service-bound HTTPRoute.
+
+### Inheritance
+
+Superclasses and interfaces are handled as in the legacy route registration libs:
+
+- **Spring**: each annotation is looked up in the class or method first, then in its interfaces, then in its
+ superclass, like Spring's `AnnotationUtils.findAnnotation`, and an annotation of the subclass replaces the same
+ annotation of the parent. Only concrete classes are controllers: a controller maps all its methods, the inherited
+ ones too, with its class annotations, inherited or its own. Abstract classes and interfaces give no routes of their
+ own.
+- **Quarkus**: only `@Path` and the HTTP method annotations (`@GET`, ...) are inherited. `@Route`, `@Gateway` and the
+ other route annotations are read from the class or method itself. A class or interface with a route annotation of its
+ own maps the methods it declares.
+
+Superclasses and interfaces must be in the compiled output of the scanned module.
## Example: Spring Controller
@@ -120,8 +178,8 @@ public class UserController {
Generated route characteristics for this example:
-- match path `/api/users`,
-- URL rewrite filter is added because gateway and service paths differ.
+- match `PathPrefix /api/users`: only the class has `@Route`, so it gives the only route, and the methods are reached below it,
+- URL rewrite filter `ReplacePrefixMatch /users`, because gateway and service paths differ,
- parent refs for `private-gateway`, `internal-gateway-service`.
## Example: Quarkus Resource
@@ -151,6 +209,279 @@ This produces a `PUBLIC` HTTPRoute rule with:
- parent refs for `public-gateway`, `private-gateway`,
and `internal-gateway-service`.
+## How Paths Are Matched
+
+The legacy mesh matched every gateway path as a pattern: a variable such as `{id}` matched one path segment, and
+the longest matching gateway path won. The generated HTTPRoutes use only `PathPrefix` matches, which Istio evaluates
+natively.
+
+### The cut
+
+Every gateway path is **cut** at its first variable: the match is the part before the segment that contains the
+first `{`, without its trailing slash, or `/` if nothing is left. A path without variables only loses its trailing
+slash, because the legacy mesh matched `/a/` and `/a` alike, and Istio ignores the trailing slash of a `PathPrefix`.
+
+| Gateway path | Match |
+|---------------------------------|------------------------------|
+| `/api/v1/svc/items` | `PathPrefix /api/v1/svc/items` |
+| `/api/v1/svc/items/` | `PathPrefix /api/v1/svc/items` |
+| `/api/v1/svc/items/{id}` | `PathPrefix /api/v1/svc/items` |
+| `/api/v1/svc/users/{id}/profile`| `PathPrefix /api/v1/svc/users` |
+| `/{tenant}/items` | `PathPrefix /` |
+
+A `PathPrefix` match also matches every path below it, so a cut rule routes more requests than the legacy pattern
+did. DENY rules keep the legacy behavior for them (see
+[Forbidden Routes and AuthorizationPolicies](#forbidden-routes-and-authorizationpolicies)).
+
+### Rewrite derivation
+
+When the gateway path and the service path differ, the service path is cut at its first variable too, and the result
+becomes the `ReplacePrefixMatch` rewrite. For example, `/api/v1/{id}/items` → `/items/{id}/items` gives match
+`PathPrefix /api/v1` and rewrite `ReplacePrefixMatch /items`.
+
+`ReplacePrefixMatch` keeps the part of the request after the match unchanged, so this is correct only when the part
+after the cut is the same in both paths (variables are compared by position). This holds for the routes services
+declare in practice, and **the plugin doesn't check it**.
+
+### Merging
+
+Routes cut to the same match are grouped together, whatever their route types, because Istio can't tell apart two
+`PathPrefix` rules with the same value, even in different HTTPRoutes. They become one rule:
+
+- with the rewrite of the first route (by gateway path, then service path). The plugin doesn't compare the rewrites:
+ routes cut to one match share one rewrite in practice;
+- with the largest timeout, where a route without a timeout counts as the 2-minute gateway default (see
+ [Timeout Generation](#timeout-generation)). A warning is logged when the timeouts differ.
+
+A merged rule goes into the HTTPRoute of the widest route type, because `PUBLIC` routes are exposed on every gateway
+that `PRIVATE` and `INTERNAL` routes are exposed on. On the wider gateways, the narrower routes of the group must be
+forbidden by DENY rules.
+
+## Route Errors
+
+Before it writes any file, the plugin logs every problem it finds. When there is at least one error, the build fails
+with ` route migration errors, see log`, and the output file is left unchanged.
+
+Errors:
+
+- A path that legacy didn't route on a gateway, and Istio would, has no DENY rule
+ (see [Forbidden Routes and AuthorizationPolicies](#forbidden-routes-and-authorizationpolicies)):
+
+ ```
+ [ERROR] /api/v1/my-service/resource/{var1}/internal-api is forbidden by legacy, as its route type is narrower, but Istio routes it by PathPrefix /api/v1/my-service/resource on public-gateway, private-gateway: add @ForbiddenRoute({PUBLIC, PRIVATE}) to the element mapped to /api/v1/my-service/resource/{var1}/internal-api
+ [ERROR] /api/v1/my-service/order is not routed by legacy, but Istio routes it by PathPrefix /api/v1/my-service/order cut from /api/v1/my-service/order/{var1}/items on public-gateway, private-gateway: add @ForbiddenRoute({PUBLIC, PRIVATE}) to the element mapped to /api/v1/my-service/order
+ ```
+
+- A DENY rule can't be expressed, because a forbidden path or a route that overlaps it has a variable that takes up
+ only part of a segment:
+
+ ```
+ [ERROR] /api/v1/my-service/files/{name}.txt is a forbidden path or overlaps one, and an AuthorizationPolicy can't express it: variables must take up whole path segments
+ ```
+
+- `@ForbiddenRoute` forbids the gateway path of a route on a gateway where the route is exposed.
+- `@ForbiddenRoute` lists no gateway, or lists `INTERNAL` or `FACADE`.
+
+Warnings:
+
+- Routes with different timeouts were merged into one rule with the largest timeout.
+- Facade or composite routes have timeouts, and no service-bound HTTPRoute is generated
+ (see [Facade and Composite Routes](#facade-and-composite-routes)).
+
+Not checked:
+
+- Overlaps with routes of **other services**. The plugin sends every rule to the single backend
+ (`backendRefVal`:`servicePort`) and doesn't know the routes of other services on the same gateways.
+- Whether the part after the cut is the same in the gateway path and the service path
+ (see [Rewrite derivation](#rewrite-derivation)).
+- Whether the routes cut to one match have the same rewrite (see [Merging](#merging)).
+
+## Forbidden Routes and AuthorizationPolicies
+
+### `@ForbiddenRoute`
+
+`@ForbiddenRoute` (in `com.netcracker.cloud.routesregistration.common.annotation`, route-registration-common) marks
+the gateway path of a class or method as forbidden on the listed gateways: `PUBLIC` and/or `PRIVATE`. The internal
+gateway needs no DENY rules.
+The legacy route registration ignores it. The gateway path is resolved like the gateway path of a route on the same
+element, so `@ForbiddenRoute` can be used on a class or method without `@Route`.
+
+```java
+@RestController
+@RequestMapping("/resource")
+@GatewayRequestMapping("/api/v1/my-service/resource")
+@Route(RouteType.PUBLIC)
+public class ResourceController {
+
+ @GetMapping("/{var1}")
+ @GatewayRequestMapping("/{var1}")
+ @Route(RouteType.PUBLIC)
+ public void get() {
+ }
+
+ @GetMapping("/{var1}/internal-api")
+ @GatewayRequestMapping("/{var1}/internal-api")
+ @Route(RouteType.INTERNAL)
+ @ForbiddenRoute({RouteType.PUBLIC, RouteType.PRIVATE})
+ public void internalApi() {
+ }
+
+ @GetMapping("/{var1}/internal-api/status")
+ @GatewayRequestMapping("/{var1}/internal-api/status")
+ @Route(RouteType.PUBLIC)
+ public void status() {
+ }
+}
+
+@RestController
+@RequestMapping("/order")
+@GatewayRequestMapping("/api/v1/my-service/order")
+@ForbiddenRoute({RouteType.PUBLIC, RouteType.PRIVATE})
+public class OrderController {
+
+ @GetMapping("/{var1}/items")
+ @GatewayRequestMapping("/{var1}/items")
+ @Route(RouteType.PUBLIC)
+ public void items() {
+ }
+}
+```
+
+`@ForbiddenRoute` must not forbid a route's own gateway path on a gateway where that route is allowed.
+
+### AuthorizationPolicy output
+
+For each gateway with at least one DENY rule, the plugin generates one `AuthorizationPolicy` named
+`{{ .Values.SERVICE_NAME }}-java-annotations-deny-`, with `action: DENY`, bound to Gateway
+`public-gateway` or `private-gateway`. No policy is generated
+when there are no DENY rules. Each forbidden path `F` gives one rule:
+
+- `paths`: `F` and everything below it, with each variable replaced by `{*}`;
+- `notPaths`: every longer route allowed on that gateway that matches some of the same requests as `F`, and
+ everything below it, so these routes stay reachable. The paths are compared segment by segment, and a variable
+ segment in one of them matches a literal segment in the other: for `F` = `/a/lit/x`, the `PUBLIC` route
+ `/a/{id}/x/y` gives the `notPaths` `/a/{*}/x/y` and `/a/{*}/x/y/{**}`. Every route allowed on that gateway that
+ legacy routes some of these requests by is excluded too, even if it is shorter: for `F` = `/api/{version}`, the
+ `PUBLIC` route `/api/v1/x/y` gives the `notPaths` `/api/v1/x/y` and `/api/v1/x/y/{**}`. An explicit `@ForbiddenRoute`
+ path is denied even where legacy routed it by a shorter exposed route: for `F` = `/api/v1/svc/admin`, the `PUBLIC`
+ route `/api/v1/svc` gives no `notPaths`, so `/api/v1/svc/admin` returns 403, and the rest of `/api/v1/svc` stays
+ routed;
+- `ports`: `8080`, the listener port of the public and private gateways.
+
+For the controllers above, the generated file has the `PUBLIC` HTTPRoute with the rules
+`PathPrefix /api/v1/my-service/resource` → `/resource` and `PathPrefix /api/v1/my-service/order` → `/order`, followed
+by two policies. The public one is:
+
+```yaml
+---
+apiVersion: "security.istio.io/v1"
+kind: "AuthorizationPolicy"
+metadata:
+ name: "{{ .Values.SERVICE_NAME }}-java-annotations-deny-public"
+ labels:
+ app.kubernetes.io/managed-by: "{{ .Values.MANAGED_BY }}"
+ app.kubernetes.io/name: "{{ .Values.SERVICE_NAME }}"
+ app.kubernetes.io/part-of: "{{ .Values.APPLICATION_NAME }}"
+ app.kubernetes.io/processed-by-operator: "istiod"
+ deployer.cleanup/allow: "true"
+ deployment.netcracker.com/sessionId: "{{ .Values.DEPLOYMENT_SESSION_ID }}"
+spec:
+ targetRefs:
+ - group: "gateway.networking.k8s.io"
+ kind: "Gateway"
+ name: "public-gateway"
+ action: "DENY"
+ rules:
+ - to:
+ - operation:
+ ports:
+ - "8080"
+ paths:
+ - "/api/v1/my-service/order"
+ - "/api/v1/my-service/order/{**}"
+ notPaths:
+ - "/api/v1/my-service/order/{*}/items"
+ - "/api/v1/my-service/order/{*}/items/{**}"
+ - to:
+ - operation:
+ ports:
+ - "8080"
+ paths:
+ - "/api/v1/my-service/resource/{*}/internal-api"
+ - "/api/v1/my-service/resource/{*}/internal-api/{**}"
+ notPaths:
+ - "/api/v1/my-service/resource/{*}/internal-api/status"
+ - "/api/v1/my-service/resource/{*}/internal-api/status/{**}"
+```
+
+`deny-private` has the same rules, bound to `private-gateway`.
+
+### Which paths need DENY rules
+
+Legacy registered every route on all border gateways, and forbade it on the gateways wider than its type. On the
+public and private gateways, a path needs a DENY rule when Istio routes it and legacy didn't:
+
+- the gateway path of a route of a narrower type that lies below the cut match of a route exposed on the gateway, such
+ as `internalApi` above, below `PathPrefix /api/v1/my-service/resource`. A narrower route that legacy routed by a
+ longer exposed route needs no rule: `/api/v1/svc/orders` of type `INTERNAL` next to the `PUBLIC` route
+ `/api/v1/svc/{tenantIdentifier}`;
+- the cut match `P` of an exposed route with a variable, when no route exposed on the gateway matches `P` itself in
+ legacy, such as `/api/v1/my-service/order` above.
+
+By default, each of these paths must be declared with `@ForbiddenRoute`, or the build fails
+(see [Route Errors](#route-errors)).
+
+### Automatic DENY rules
+
+With `autoGenerateAuthorizationPolicies` set to `true`, the plugin generates the DENY rules for these paths itself.
+For the example above without any `@ForbiddenRoute`, it generates the same policies. `@ForbiddenRoute` still adds rules
+for any other paths it lists.
+
+The default is `false`, because DENY rules on the shared public and private gateways are a security-relevant change
+that service owners should opt into explicitly.
+
+### DENY rules on shared gateways
+
+The public and private gateways are shared by all services. A DENY rule on a gateway also applies to paths of other
+services under the same prefix. This is safe as long as gateway paths are namespaced per service
+(`/api///...`).
+
+## Facade and Composite Routes
+
+Istio has no facade or composite gateways. Clients call the Service `{{ .Values.SERVICE_NAME }}` directly, and
+Istio sends every request for it to the service unchanged, unless an HTTPRoute is bound to the Service. So the
+facade and composite routes (see [Route metadata](#route-metadata-both-frameworks)) are planned together, with the
+same cut and merging as a gateway, but no AuthorizationPolicies are generated for them.
+
+- If **no** facade or composite rule has a rewrite, no service-bound HTTPRoute is generated. If any of these routes has
+ a timeout, the timeout is not applied, and a warning says so:
+
+ ```
+ [WARNING] No facade or composite route has a rewrite, so no service-bound HTTPRoute is generated, and the timeouts of the facade and composite routes are not applied
+ ```
+
+- If **any** of them has a rewrite, one HTTPRoute `{{ .Values.SERVICE_NAME }}-java-annotations-facade` is generated,
+ bound only to Service `{{ .Values.SERVICE_NAME }}`, and it lists **all** facade and composite rules, including those
+ without a rewrite. While it exists, Istio returns **404 for every other path** through the Service. To fix that,
+ declare those endpoints as facade routes, or call them through a border gateway.
+
+Legacy facade and composite gateways were separate gateways, so two such routes with the same gateway path and
+different service paths were valid there. In the service-bound HTTPRoute they are merged into one rule with the
+rewrite of the first one, and this isn't checked.
+
+Example: a method with `@FacadeRoute` and `@FacadeGatewayRequestMapping("/facade/items")` on `/items`, a method with
+`@Route(RouteType.FACADE)` on `/orders`, and a method on `/shared` with `@GatewayRequestMapping("/api/v1/svc/shared")`,
+`@Route(RouteType.PUBLIC)` and `@Route(gateways = "composite-gw", hosts = "example.com")` give the `PUBLIC` HTTPRoute
+with the rule `PathPrefix /api/v1/svc/shared` → `/shared`, and the service-bound HTTPRoute
+`{{ .Values.SERVICE_NAME }}-java-annotations-facade` with the parentRef Service `{{ .Values.SERVICE_NAME }}` and these
+rules:
+
+| Match | Rewrite |
+|---------------------------------|--------------------------------|
+| `PathPrefix /api/v1/svc/shared` | `ReplacePrefixMatch /shared` |
+| `PathPrefix /facade/items` | `ReplacePrefixMatch /items` |
+| `PathPrefix /orders` | none (`filters: []`) |
+
## Generated YAML Shape
The plugin writes:
@@ -158,7 +489,8 @@ The plugin writes:
1. Header comment (`DO NOT EDIT`),
2. Istio conditional guard:
`{{- if eq .Values.SERVICE_MESH_TYPE "Istio" }}`,
-3. One or more `HTTPRoute` resources grouped by route type.
+3. `HTTPRoute` resources grouped by route type, in the order public, private, internal, facade,
+4. `AuthorizationPolicy` resources, in the order public, private.
Snippet:
@@ -170,45 +502,50 @@ Snippet:
# -----------------------------------------------------------------------------
{{- if eq .Values.SERVICE_MESH_TYPE "Istio" }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
+---
+apiVersion: "gateway.networking.k8s.io/v1"
+kind: "HTTPRoute"
metadata:
- name: {{ .Values.SERVICE_NAME }}-java-annotations-public
+ name: "{{ .Values.SERVICE_NAME }}-java-annotations-public"
labels:
- app.kubernetes.io/managed-by: {{ .Values.MANAGED_BY }}
- app.kubernetes.io/name: {{ .Values.SERVICE_NAME }}
- app.kubernetes.io/part-of: {{ .Values.APPLICATION_NAME }}
- app.kubernetes.io/processed-by-operator: istiod
+ app.kubernetes.io/managed-by: "{{ .Values.MANAGED_BY }}"
+ app.kubernetes.io/name: "{{ .Values.SERVICE_NAME }}"
+ app.kubernetes.io/part-of: "{{ .Values.APPLICATION_NAME }}"
+ app.kubernetes.io/processed-by-operator: "istiod"
deployer.cleanup/allow: "true"
- deployment.netcracker.com/sessionId: {{ .Values.DEPLOYMENT_SESSION_ID }}
+ deployment.netcracker.com/sessionId: "{{ .Values.DEPLOYMENT_SESSION_ID }}"
spec:
parentRefs:
- - group: gateway.networking.k8s.io
- kind: Gateway
- name: public-gateway
- - group: gateway.networking.k8s.io
- kind: Gateway
- name: private-gateway
- - group: ''
- kind: Service
- name: internal-gateway-service
+ - group: "gateway.networking.k8s.io"
+ kind: "Gateway"
+ name: "public-gateway"
+ - group: "gateway.networking.k8s.io"
+ kind: "Gateway"
+ name: "private-gateway"
+ - group: ""
+ kind: "Service"
+ name: "internal-gateway-service"
rules:
- matches:
- path:
- type: PathPrefix
- value: /api/users
+ type: "PathPrefix"
+ value: "/api/v1/my-service/resource"
filters:
- - type: URLRewrite
+ - type: "URLRewrite"
urlRewrite:
path:
- type: ReplacePrefixMatch
- replacePrefixMatch: /users
+ type: "ReplacePrefixMatch"
+ replacePrefixMatch: "/resource"
backendRefs:
- - group: ''
- kind: Service
- name: {{ .Values.DEPLOYMENT_RESOURCE_NAME }}
+ - group: ""
+ kind: "Service"
+ name: "{{ .Values.SERVICE_NAME }}"
port: 8080
weight: 1
+---
+apiVersion: "security.istio.io/v1"
+kind: "AuthorizationPolicy"
+# ...
{{- end }}
```
@@ -224,23 +561,34 @@ The plugin can generate per-rule HTTPRoute timeouts from `@Route(timeout = ...)`
- divisible by `60000` -> `m`
- divisible by `1000` -> `s`
- otherwise -> `ms`
+- When routes with different timeouts are merged into one rule (see [Merging](#merging)), the largest timeout is
+ used, where a route without a timeout counts as the 2-minute gateway default. When the default wins, the
+ `timeouts` block is omitted:
+
+ | Merged timeouts | Rule timeout |
+ |-----------------|-----------------------|
+ | unset + `5s` | none (the 2m default) |
+ | unset + `2m` | `2m` |
+ | unset + `5m` | `5m` |
+ | `5s` + `10s` | `10s` |
Example (`@Route(timeout = 5000)`):
```yaml
-rules:
-- matches:
- - path:
- type: PathPrefix
- value: /api/test
- backendRefs:
- - group: ''
- kind: Service
- name: {{ .Values.DEPLOYMENT_RESOURCE_NAME }}
- port: 8080
- weight: 1
- timeouts:
- request: 5s
+ rules:
+ - matches:
+ - path:
+ type: "PathPrefix"
+ value: "/api/test"
+ filters: []
+ backendRefs:
+ - group: ""
+ kind: "Service"
+ name: "{{ .Values.SERVICE_NAME }}"
+ port: 8080
+ weight: 1
+ timeouts:
+ request: "5s"
```
## Route Type to parentRefs mapping
@@ -249,16 +597,17 @@ Generated HTTPRoute names use:
`{{ .Values.SERVICE_NAME }}-java-annotations-`
-Where `` is lowercase route type (`internal`, `private`, `public`, `facade`).
+Where `` is lowercase route type (`public`, `private`, `internal`, `facade`).
-- `INTERNAL` -> Service `internal-gateway-service`
-- `PRIVATE` -> Gateway `private-gateway` + Service `internal-gateway-service`
- `PUBLIC` -> Gateway `public-gateway` + Gateway `private-gateway` + Service `internal-gateway-service`
-- `FACADE` -> Service `{{ .Values.SERVICE_NAME }}`
+- `PRIVATE` -> Gateway `private-gateway` + Service `internal-gateway-service`
+- `INTERNAL` -> Service `internal-gateway-service`
+- `FACADE` -> Service `{{ .Values.SERVICE_NAME }}`, only when a facade or composite rule has a rewrite
+ (see [Facade and Composite Routes](#facade-and-composite-routes))
## Generated Labels
-When `labels` is **not** configured, each generated `HTTPRoute` includes these
+When `labels` is **not** configured, each generated `HTTPRoute` and `AuthorizationPolicy` includes these
default metadata labels:
- `app.kubernetes.io/name: {{ .Values.SERVICE_NAME }}`
@@ -299,14 +648,47 @@ not added automatically.
## Route Sorting
-Generated rules are sorted by path specificity before rendering:
+Within each HTTPRoute, rules are sorted by their match value before rendering:
1. More path segments first (for example `/api/v1/users/profile` before `/api/users`).
2. If segment count is equal, longer path first.
-3. If still equal, lexical path order for deterministic output.
-
-This keeps more specific routes ahead of generic ones and makes generated YAML
-stable between builds.
+3. If still equal, lexical path order.
+
+Istio picks the longest `PathPrefix`, so the order doesn't change routing; it makes the generated YAML stable between
+builds. Each match value appears in only one HTTPRoute (see [Merging](#merging)).
+
+## Differences from Legacy Routing
+
+- **403 instead of 404.** A request denied by an `AuthorizationPolicy` returns `403 Forbidden` with the body
+ `RBAC: access denied`, where the legacy mesh returned `404 Not Found`.
+- **Path normalization.** DENY rules match request paths, so `%2F`, `..` and duplicate slashes can bypass them unless
+ `meshConfig.pathNormalization.normalization` is at least `MERGE_SLASHES`
+ (see [Istio path normalization](https://istio.io/latest/docs/ops/best-practices/security/#understand-path-normalization)).
+- **Port 8080.** DENY rules apply only to port `8080` of the public and private gateways.
+- **Shared gateways.** DENY rules also apply to other services' paths under the same prefix
+ (see [DENY rules on shared gateways](#deny-rules-on-shared-gateways)).
+- **Facade gateway paths.** Facade routes take their gateway path from `@FacadeGateway`/`@FacadeGatewayRequestMapping`,
+ or use the service path, as in legacy. Earlier plugin versions used `@Gateway`/`@GatewayRequestMapping` paths for them.
+- **Service-bound HTTPRoute.** While it exists, other paths through the Service return 404
+ (see [Facade and Composite Routes](#facade-and-composite-routes)).
+- **Internal gateway.** No DENY rules. Paths that legacy forbade there (404), and subtrees widened by the cut, are
+ routed to the service.
+
+## Migrating Existing Services
+
+An existing service can fail the build after the upgrade, for example when a narrower route lies below a wider one, or
+when a cut prefix routes a path that legacy didn't. Fix the errors in this order:
+
+1. **Add `@ForbiddenRoute`** where the error says. This keeps the legacy behavior and documents it in the code. Add
+ the route-registration-common version that contains `@ForbiddenRoute`.
+2. **Or set `true `** to generate these DENY
+ rules instead.
+3. **Align the paths** for the errors that DENY rules can't fix: forbidden paths with partial-segment variables such
+ as `/{name}.txt`.
+
+Then check facade routes that relied on `@Gateway` paths, paths called through the Service while a service-bound
+HTTPRoute exists, and clients that expect `404` for forbidden paths. Overlaps with routes of other services are not
+checked; review them separately.
## Build and Run
@@ -330,15 +712,22 @@ mvn com.netcracker.cloud.plugins:httproutes-generator-maven-plugin:generate-rout
- Ensure `packages` includes your controllers/resources.
- Ensure classes or methods use `@Route` (without it, routes are ignored).
+### Build fails with route migration errors
+
+- Each error in the build log names the paths and gateways involved and the fix.
+- See [Route Errors](#route-errors) and [Migrating Existing Services](#migrating-existing-services).
+
### Expected gateway rewrite is missing
- Rewrite filters are only generated when `gatewayPath != servicePath`.
- Add `@Gateway` or `@GatewayRequestMapping` to provide gateway path.
+- For facade routes, use `@FacadeGateway` or `@FacadeGatewayRequestMapping`.
### Superclass endpoints not discovered
-- Scanner recursively processes superclasses, but those classes still must be
- available in compiled output and inside accepted packages.
+- See [Inheritance](#inheritance): a Spring base class must have a concrete subclass, and a Quarkus resource doesn't
+ inherit `@Route`.
+- Superclasses and interfaces must be available in the compiled output of the scanned module.
### Helm template syntax issues
@@ -347,8 +736,8 @@ mvn com.netcracker.cloud.plugins:httproutes-generator-maven-plugin:generate-rout
**Solution**: The plugin wraps output with:
```yaml
{{- if eq .Values.SERVICE_MESH_TYPE "Istio" }}
-# ... routes ...
-{{ end }}
+# ... routes and policies ...
+{{- end }}
```
Ensure your Helm chart defines SERVICE_MESH_TYPE.
@@ -362,10 +751,12 @@ The plugin uses:
- **Jackson**: For YAML serialization
- **Maven Plugin API**: For Maven integration
-No runtime dependencies required in your application.
+No runtime dependencies required in your application. `@ForbiddenRoute` is in route-registration-common, which
+services already depend on for `@Route`.
## Related Resources
- [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/)
+- [Istio AuthorizationPolicy](https://istio.io/latest/docs/reference/config/security/authorization-policy/)
- [Spring Web Annotations](https://docs.spring.io/spring-framework/docs/current/reference/html/web.html#mvc-ann-requestmapping)
- [Quarkus REST](https://quarkus.io/guides/rest-json)
- [Istio Gateway](https://istio.io/latest/docs/reference/config/networking/gateway/)
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/pom.xml b/core-maven-plugins/httproutes-generator-maven-plugin/pom.xml
index ecfc24ba12..d560d7f72e 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/pom.xml
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/pom.xml
@@ -110,6 +110,25 @@
21
+
+ org.jacoco
+ jacoco-maven-plugin
+ 0.8.15
+
+
+
+ prepare-agent
+
+
+
+ report
+ verify
+
+ report
+
+
+
+
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/AuthorizationPolicyRenderer.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/AuthorizationPolicyRenderer.java
new file mode 100644
index 0000000000..1e08fa6f3f
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/AuthorizationPolicyRenderer.java
@@ -0,0 +1,193 @@
+package com.netcracker.routes.gateway.plugin;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import java.util.*;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+/**
+ * Renders one DENY {@code AuthorizationPolicy} per external gateway, public then private. Exposure on the internal
+ * gateway needs no rule, like that of facade routes.
+ *
+ * Legacy gateways forbid a route on the gateways wider than its type, and don't route a path no route matches.
+ * Istio routes by the {@code PathPrefix} cut from each gateway path, so it routes some of these paths:
+ *
+ * a narrower route's path below the prefix of a route exposed on the gateway;
+ * the prefix itself, cut from a route with variables, if no route exposed on the gateway matches it.
+ *
+ * These paths need DENY rules. They are generated if {@code autoGenerateAuthorizationPolicies} is set, else they must
+ * be declared with {@code @ForbiddenRoute}, as all other forbidden paths.
+ */
+public class AuthorizationPolicyRenderer {
+
+ private static final List PORTS = List.of("8080");
+ private static final String ACTION_DENY = "DENY";
+ private static final List GATEWAYS =
+ List.of(HttpRoute.Type.PUBLIC, HttpRoute.Type.PRIVATE);
+
+ private final Map labels;
+ private final boolean autoGenerateAuthorizationPolicies;
+
+ public AuthorizationPolicyRenderer(Map labels, boolean autoGenerateAuthorizationPolicies) {
+ this.labels = labels == null ? Collections.emptyMap() : labels;
+ this.autoGenerateAuthorizationPolicies = autoGenerateAuthorizationPolicies;
+ }
+
+ @JsonInclude(JsonInclude.Include.NON_NULL)
+ public record AuthorizationPolicyResource(String apiVersion, String kind, Metadata metadata, Spec spec) {
+
+ public AuthorizationPolicyResource(Metadata metadata, Spec spec) {
+ this("security.istio.io/v1", "AuthorizationPolicy", metadata, spec);
+ }
+
+ public record Metadata(String name, Map labels) {
+ }
+
+ public record Spec(List targetRefs, String action, List rules) {
+
+ public record TargetRef(String group, String kind, String name) {
+ }
+
+ public record Rule(List to) {
+
+ public record To(Operation operation) {
+ }
+
+ @JsonInclude(JsonInclude.Include.NON_EMPTY)
+ public record Operation(List ports, List paths, List notPaths) {
+ }
+ }
+ }
+ }
+
+ /**
+ * A path forbidden on a gateway that Istio would route without a DENY rule.
+ */
+ private record Missing(String reason, Set gateways) {
+ }
+
+ public String generateAuthorizationPoliciesYaml(Set routes, Set forbidden, Problems problems) {
+ List border = routes.stream().filter(r -> r.type() != HttpRoute.Type.FACADE).toList();
+ Map missing = new TreeMap<>();
+ Set inexpressible = new TreeSet<>();
+ StringBuilder yaml = new StringBuilder();
+ for (HttpRoute.Type gateway : GATEWAYS) {
+ Collection rules =
+ denyRules(gateway, border, forbidden, missing, inexpressible, problems);
+ if (!rules.isEmpty()) {
+ yaml.append(HttpRouteRenderer.writeYaml(toResource(gateway, List.copyOf(rules))));
+ }
+ }
+ missing.forEach((path, m) -> problems.error(path + " " + m.reason() + " on " + gatewayNames(m.gateways())
+ + ": add @ForbiddenRoute({" + m.gateways().stream().sorted(Comparator.reverseOrder()).map(Enum::name)
+ .collect(Collectors.joining(", ")) + "}) to the element mapped to " + path));
+ inexpressible.forEach(path -> problems.error(path + " is a forbidden path or overlaps one, and an "
+ + "AuthorizationPolicy can't express it: variables must take up whole path segments"));
+ return yaml.toString();
+ }
+
+ private Collection denyRules(HttpRoute.Type gateway, List border,
+ Set forbidden,
+ Map missing,
+ Set inexpressible, Problems problems) {
+ Set allowed = border.stream().filter(r -> r.type().compareTo(gateway) >= 0)
+ .map(HttpRoute::gatewayPath).collect(Collectors.toCollection(TreeSet::new));
+ Set allowedTemplates = allowed.stream().map(RoutePaths::template).collect(Collectors.toSet());
+ Set implicit = border.stream().filter(r -> r.type().compareTo(gateway) < 0)
+ .map(HttpRoute::gatewayPath).filter(p -> !allowedTemplates.contains(RoutePaths.template(p)))
+ .collect(Collectors.toCollection(TreeSet::new));
+ Set explicit = forbidden.stream().filter(f -> f.gateways().contains(gateway))
+ .map(ForbiddenPath::gatewayPath).collect(Collectors.toCollection(TreeSet::new));
+ explicit.stream().filter(p -> allowedTemplates.contains(RoutePaths.template(p))).forEach(p -> problems.error(
+ "@ForbiddenRoute forbids " + p + " on " + gateway.gatewayName() + ", where a route with this gateway path is exposed"));
+
+ Map needed = new TreeMap<>();
+ Set prefixes = allowed.stream().map(RoutePaths::cut).collect(Collectors.toCollection(TreeSet::new));
+ for (String path : implicit) {
+ if (legacyRoute(RoutePaths.sample(path, path), allowed, implicit).filter(allowed::contains).isPresent()) {
+ continue;
+ }
+ prefixes.stream().filter(prefix -> RoutePaths.covers(prefix, path)).findFirst().ifPresent(prefix -> needed.put(path,
+ "is forbidden by legacy, as its route type is narrower, but Istio routes it by PathPrefix " + prefix));
+ }
+ for (String path : allowed) {
+ String prefix = RoutePaths.cut(path);
+ if (!RoutePaths.hasVariable(path)) {
+ continue;
+ }
+ if (legacyRoute(prefix, allowed, implicit).filter(allowed::contains).isEmpty()) {
+ needed.putIfAbsent(prefix,
+ "is not routed by legacy, but Istio routes it by PathPrefix " + prefix + " cut from " + path);
+ }
+ }
+
+ Set explicitTemplates = explicit.stream().map(RoutePaths::template).collect(Collectors.toSet());
+ Set rulePaths = new TreeSet<>(explicit);
+ needed.forEach((path, reason) -> {
+ if (autoGenerateAuthorizationPolicies) {
+ rulePaths.add(path);
+ } else if (!explicitTemplates.contains(RoutePaths.template(path))) {
+ missing.computeIfAbsent(path, p -> new Missing(reason, EnumSet.noneOf(HttpRoute.Type.class)))
+ .gateways().add(gateway);
+ }
+ });
+
+ Map rules = new TreeMap<>();
+ for (String path : rulePaths) {
+ List overlapping = allowed.stream()
+ .filter(route -> route.length() > path.length() && RoutePaths.overlaps(path, route)).toList();
+ // Probes the rule path and its intersection with every overlapping allowed route: the route legacy routes
+ // a probe by, if the rule denies the probe, is excluded too, so that the rule denies nothing legacy routed
+ Set excluded = new TreeSet<>(overlapping);
+ Stream.concat(Stream.of(path), allowed.stream().filter(route -> RoutePaths.overlaps(path, route)))
+ .map(route -> RoutePaths.sample(path, route))
+ .forEach(request -> legacyRoute(request, allowed, implicit).filter(allowed::contains)
+ .ifPresent(excluded::add));
+ if (explicit.contains(path)) {
+ // An explicit rule denies its path even where legacy routed it by a wider route
+ excluded.removeIf(route -> RoutePaths.covers(route, RoutePaths.sample(path, path)));
+ }
+ List invalid = Stream.concat(Stream.of(path), excluded.stream())
+ .filter(p -> !RoutePaths.expressible(p)).toList();
+ if (!invalid.isEmpty()) {
+ inexpressible.addAll(invalid);
+ continue;
+ }
+ List notPaths = excluded.stream().map(RoutePaths::template).distinct().sorted()
+ .flatMap(t -> subtree(t).stream()).toList();
+ rules.putIfAbsent(RoutePaths.template(path), new AuthorizationPolicyResource.Spec.Rule(List.of(
+ new AuthorizationPolicyResource.Spec.Rule.To(new AuthorizationPolicyResource.Spec.Rule.Operation(
+ PORTS, subtree(RoutePaths.template(path)), notPaths)))));
+ }
+ return rules.values();
+ }
+
+ /**
+ * @return the route legacy matches a literal request path by: the longest covering one, the forbidden one on a tie
+ */
+ private static Optional legacyRoute(String request, Set allowed, Set implicit) {
+ return Stream.concat(allowed.stream(), implicit.stream()).filter(route -> RoutePaths.covers(route, request))
+ .max(Comparator.comparingInt(String::length).thenComparing(route -> !allowed.contains(route)));
+ }
+
+ private static List subtree(String template) {
+ return List.of(template, template.equals("/") ? "/{**}" : template + "/{**}");
+ }
+
+ private static String gatewayNames(Set gateways) {
+ return gateways.stream().sorted(Comparator.reverseOrder()).map(HttpRoute.Type::gatewayName)
+ .collect(Collectors.joining(", "));
+ }
+
+ private AuthorizationPolicyResource toResource(HttpRoute.Type gateway, List rules) {
+ AuthorizationPolicyResource.Metadata metadata = new AuthorizationPolicyResource.Metadata(
+ "{{ .Values.SERVICE_NAME }}-java-annotations-deny-" + gateway.name().toLowerCase(),
+ HttpRouteRenderer.buildRouteLabels(labels));
+ HttpRouteRenderer.HTTPRouteResource.Spec.ParentRef ref = HttpRouteRenderer.gatewayParentRef(gateway.gatewayName());
+ AuthorizationPolicyResource.Spec.TargetRef targetRef =
+ new AuthorizationPolicyResource.Spec.TargetRef(ref.group(), ref.kind(), ref.name());
+ return new AuthorizationPolicyResource(metadata,
+ new AuthorizationPolicyResource.Spec(List.of(targetRef), ACTION_DENY, rules));
+ }
+}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/ForbiddenPath.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/ForbiddenPath.java
new file mode 100644
index 0000000000..3fff4b3a14
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/ForbiddenPath.java
@@ -0,0 +1,14 @@
+package com.netcracker.routes.gateway.plugin;
+
+import java.util.Set;
+
+/**
+ * A gateway path that {@code @ForbiddenRoute} forbids on the given border gateways.
+ */
+public record ForbiddenPath(String gatewayPath, Set gateways) {
+
+ public ForbiddenPath {
+ gatewayPath = gatewayPath.startsWith("/") ? gatewayPath : "/" + gatewayPath;
+ gateways = Set.copyOf(gateways);
+ }
+}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojo.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojo.java
index a85fa7299f..26a625baec 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojo.java
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojo.java
@@ -2,16 +2,17 @@
import org.apache.maven.plugin.AbstractMojo;
import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
import org.apache.maven.plugins.annotations.LifecyclePhase;
import org.apache.maven.plugins.annotations.Mojo;
import org.apache.maven.plugins.annotations.Parameter;
import org.apache.maven.project.MavenProject;
import java.nio.file.Files;
+import java.nio.file.Path;
import java.util.Collections;
import java.util.List;
import java.util.Map;
-import java.util.Set;
import java.util.stream.Collectors;
@Mojo(
@@ -36,17 +37,45 @@ public class GenerateRoutesMojo extends AbstractMojo {
@Parameter(defaultValue = "gateway-httproutes.yaml")
private String outputFile;
- @Parameter(defaultValue = "{{ .Values.DEPLOYMENT_RESOURCE_NAME }}")
+ @Parameter(defaultValue = "{{ .Values.SERVICE_NAME }}")
private String backendRefVal;
@Parameter
private List labels = Collections.emptyList();
+ /**
+ * Whether to generate the DENY rules that the migration needs and {@code @ForbiddenRoute} doesn't declare.
+ */
+ @Parameter(defaultValue = "false")
+ private boolean autoGenerateAuthorizationPolicies;
+
@Override
- public void execute() throws MojoExecutionException {
- RouteScanner scanner = new RouteScanner(packages, getLog());
- Set allRoutes = scanner.collectRoutes(reactorProjects);
- writeRoutesFile(allRoutes);
+ public void execute() throws MojoExecutionException, MojoFailureException {
+ execute(project.getBasedir().toPath(), scanner -> scanner.collect(reactorProjects));
+ }
+
+ /**
+ * Scans and renders the routes, and writes the output file only if there are no errors.
+ */
+ void execute(Path baseDir, Scan scan) throws MojoExecutionException, MojoFailureException {
+ RouteScanner.Declarations declarations = scan.declarations(new RouteScanner(packages, getLog()));
+ Problems problems = new Problems();
+ problems.errors().addAll(declarations.errors());
+ String yaml = new HttpRouteRenderer(backendRefVal, labelsAsMap())
+ .generateHttpRoutesYaml(servicePort, declarations.routes(), problems)
+ + new AuthorizationPolicyRenderer(labelsAsMap(), autoGenerateAuthorizationPolicies)
+ .generateAuthorizationPoliciesYaml(declarations.routes(), declarations.forbidden(), problems);
+ problems.warnings().forEach(getLog()::warn);
+ problems.errors().forEach(getLog()::error);
+ if (!problems.errors().isEmpty()) {
+ throw new MojoFailureException(problems.errors().size() + " route migration errors, see log");
+ }
+ writeRoutesFile(baseDir, yaml);
+ }
+
+ @FunctionalInterface
+ interface Scan {
+ RouteScanner.Declarations declarations(RouteScanner scanner) throws MojoExecutionException;
}
private Map labelsAsMap() {
@@ -58,14 +87,10 @@ private Map labelsAsMap() {
.collect(Collectors.toMap(Label::getKey, l -> l.getValue() != null ? l.getValue() : ""));
}
- private void writeRoutesFile(Set routes) throws MojoExecutionException {
+ private void writeRoutesFile(Path baseDir, String yaml) throws MojoExecutionException {
try {
- java.nio.file.Path file = project.getBasedir()
- .toPath()
- .resolve(outputFile);
-
+ Path file = baseDir.resolve(outputFile);
- String yaml = new HttpRouteRenderer(backendRefVal, labelsAsMap()).generateHttpRoutesYaml(servicePort, routes);
Files.createDirectories(file.getParent());
Files.writeString(file, prependYamlHeader(wrapWithEnabler(yaml)));
getLog().info(String.format("Generated gateway routes CRs at %s", outputFile));
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/HttpRouteRenderer.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/HttpRouteRenderer.java
index bbf5303b15..189a2db4e3 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/HttpRouteRenderer.java
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/HttpRouteRenderer.java
@@ -6,24 +6,24 @@
import java.util.*;
import java.util.stream.Collectors;
+import java.util.stream.Stream;
public class HttpRouteRenderer {
private static final ObjectMapper YAML_MAPPER = yamlMapper();
private static final String MATCH_TYPE_PATH_PREFIX = "PathPrefix";
- private static final String MATCH_TYPE_REGULAR_EXPRESSION = "RegularExpression";
private static final String FILTER_TYPE_URL_REWRITE = "URLRewrite";
private static final String FILTER_PATH_TYPE_REPLACE_PREFIX_MATCH = "ReplacePrefixMatch";
- private static final String REGEX_MANUAL_REVIEW_WARNING = """
- # MANUAL REVIEW REQUIRED
- # RegularExpression path matches may conflict with sibling rules with Prefix matches.
- # Also, replacePrefixMatch only works with PathPrefix matches and cannot be
- # used with RegularExpression matches. Test regex matching routes carefully.
- """;
+ private static final List RESOURCE_ORDER =
+ List.of(HttpRoute.Type.PUBLIC, HttpRoute.Type.PRIVATE, HttpRoute.Type.INTERNAL, HttpRoute.Type.FACADE);
private static final long SECOND = 1_000;
private static final long MINUTE = 60_000;
private static final long HOUR = 3_600_000;
+ /**
+ * The gateway request timeout of a route without a timeout.
+ */
+ private static final long DEFAULT_TIMEOUT = 2 * MINUTE;
public static final String PARENT_REF_KIND_SERVICE = "Service";
public static final String PARENT_REF_KIND_GATEWAY = "Gateway";
public static final String PARENT_REF_GROUP_GATEWAY = "gateway.networking.k8s.io";
@@ -91,34 +91,88 @@ public record BackendRef(String group, String kind, String name, Integer port, I
}
}
- public String generateHttpRoutesYaml(int servicePort, Set httpRoutes) {
- List routes = createHttpRoutes(servicePort, httpRoutes);
-
- return routes.stream()
- .map(HttpRouteRenderer::renderValidatedYaml)
- .collect(Collectors.joining());
+ /**
+ * One rule of the generated HTTPRoutes.
+ *
+ * @param resource resource the rule goes into; {@code FACADE} is the service-bound HTTPRoute
+ * @param value {@code PathPrefix} value
+ * @param rewrite {@code ReplacePrefixMatch} value, or {@code null} for no rewrite
+ */
+ private record PlannedRule(HttpRoute.Type resource, String value, String rewrite, long timeout) {
}
- private static HTTPRouteResource.Spec.Match.Path convertSpringPathToHttpRoutePath(String springPath) {
- if (springPath == null || springPath.isEmpty()) {
- return new HTTPRouteResource.Spec.Match.Path(MATCH_TYPE_PATH_PREFIX, "/");
+ /**
+ * Cuts every gateway path at its first variable into a {@code PathPrefix} and merges the routes cut to one
+ * prefix into one rule. Merged timeouts are reported to {@code problems}.
+ */
+ public String generateHttpRoutesYaml(int servicePort, Set httpRoutes, Problems problems) {
+ List rules = planRules(httpRoutes.stream().filter(r -> r.type() != HttpRoute.Type.FACADE), problems);
+ List facadeRules = planRules(httpRoutes.stream().filter(r -> r.type() == HttpRoute.Type.FACADE), problems);
+ if (facadeRules.stream().anyMatch(r -> r.rewrite() != null)) {
+ rules.addAll(facadeRules);
+ } else if (facadeRules.stream().anyMatch(r -> r.timeout() > 0)) {
+ problems.warn("No facade or composite route has a rewrite, so no service-bound HTTPRoute is generated, "
+ + "and the timeouts of the facade and composite routes are not applied");
}
- if (springPath.contains("{")) {
- return new HTTPRouteResource.Spec.Match.Path(MATCH_TYPE_REGULAR_EXPRESSION, normalizePath(springPath.replaceAll("\\{([^/]+?)}", "([^/]+)")));
- } else {
- return new HTTPRouteResource.Spec.Match.Path(MATCH_TYPE_PATH_PREFIX, normalizePath(springPath));
+ List resources = new ArrayList<>();
+ for (HttpRoute.Type type : RESOURCE_ORDER) {
+ List typeRules = rules.stream().filter(r -> r.resource() == type).toList();
+ if (!typeRules.isEmpty()) {
+ resources.add(toResource(type, typeRules, servicePort));
+ }
}
+ return resources.stream()
+ .map(HttpRouteRenderer::writeYaml)
+ .collect(Collectors.joining());
}
- private static String normalizePath(String path) {
- if (path == null || path.isEmpty()) {
- return "/";
- }
- if (!path.startsWith("/")) {
- return "/" + path;
+ /**
+ * Groups the routes by cut gateway path across route types, because Istio can't tell apart two rules with one
+ * {@code PathPrefix} value. A group's rule goes into the widest type's resource; DENY rules take care of the
+ * gateways the narrower routes aren't exposed on.
+ */
+ private static List planRules(Stream routes, Problems problems) {
+ Map> groups = routes
+ .sorted(Comparator.comparing(HttpRoute::gatewayPath).thenComparing(HttpRoute::path)
+ .thenComparing(HttpRoute::type).thenComparingLong(HttpRoute::timeout))
+ .collect(Collectors.groupingBy(r -> RoutePaths.cut(r.gatewayPath()), TreeMap::new, Collectors.toList()));
+ List rules = new ArrayList<>();
+ groups.forEach((match, group) -> rules.add(prefixRule(match, group, problems)));
+ return rules;
+ }
+
+ /**
+ * @return the {@code ReplacePrefixMatch} value of a route cut to {@code match}, or empty for no rewrite
+ */
+ private static Optional rewriteOf(String match, HttpRoute route) {
+ String rewrite = RoutePaths.cut(route.path());
+ return rewrite.equals(match) ? Optional.empty() : Optional.of(rewrite);
+ }
+
+ /**
+ * Merges routes into one rule with the rewrite of the first route and the largest timeout, where a route without
+ * a timeout counts as {@link #DEFAULT_TIMEOUT}, and warns if their timeouts differ.
+ */
+ private static PlannedRule prefixRule(String match, List routes, Problems problems) {
+ HttpRoute.Type widest = routes.stream().map(HttpRoute::type).max(Comparator.naturalOrder()).orElseThrow();
+ long largest = routes.stream().mapToLong(HttpRoute::timeout).max().orElse(0);
+ boolean defaultWins = largest < DEFAULT_TIMEOUT && routes.stream().anyMatch(r -> r.timeout() == 0);
+ long timeout = defaultWins ? 0 : largest;
+ if (routes.stream().mapToLong(HttpRoute::timeout).distinct().count() > 1) {
+ problems.warn("Routes " + describe(match, routes) + " are merged into one rule PathPrefix " + match
+ + " with the largest timeout" + (defaultWins ? ", the " + formatDuration(DEFAULT_TIMEOUT) + " default"
+ : " " + formatDuration(timeout)));
}
- return path;
+ return new PlannedRule(widest, match, rewriteOf(match, routes.get(0)).orElse(null), timeout);
+ }
+
+ private static String describe(String match, List routes) {
+ return routes.stream()
+ .map(r -> r.gatewayPath() + " (" + r.type() + ", "
+ + rewriteOf(match, r).map(rewrite -> "ReplacePrefixMatch " + rewrite).orElse("no rewrite")
+ + (r.timeout() > 0 ? ", timeout " + formatDuration(r.timeout()) : "") + ")")
+ .collect(Collectors.joining(", "));
}
public static String formatDuration(long ms) {
@@ -134,18 +188,7 @@ public static String formatDuration(long ms) {
return ms + "ms";
}
- private List createHttpRoutes(int servicePort, Set httpRoutes) {
- Map> routesByType = httpRoutes
- .stream()
- .collect(Collectors.groupingBy(HttpRoute::type));
-
- return routesByType.entrySet().stream()
- .map(entry -> toResource(entry.getKey(), entry.getValue(), servicePort))
- .filter(Objects::nonNull)
- .toList();
- }
-
- private HTTPRouteResource toResource(HttpRoute.Type type, List routes, int servicePort) {
+ private HTTPRouteResource toResource(HttpRoute.Type type, List rules, int servicePort) {
HTTPRouteResource.Metadata metadata =
new HTTPRouteResource.Metadata(
"{{ .Values.SERVICE_NAME }}-java-annotations-" + type.name().toLowerCase(),
@@ -155,27 +198,16 @@ private HTTPRouteResource toResource(HttpRoute.Type type, List routes
List backendRefs =
List.of(serviceBackendRef(this.backendRefVal, servicePort));
- List sortedRoutes = routes.stream()
- .sorted(pathSpecificityComparator())
+ List ruleList = rules.stream()
+ .sorted(Comparator.comparing(PlannedRule::value, pathSpecificity()))
+ .map(rule -> toRule(rule, backendRefs))
.toList();
- List ruleList = new ArrayList<>(sortedRoutes.size());
- for (HttpRoute route : sortedRoutes) {
- if (route.type() == HttpRoute.Type.FACADE && route.path().equals(route.gatewayPath())) {
- continue;
- }
- ruleList.add(toRule(route, backendRefs));
- }
-
- if (ruleList.isEmpty()) {
- return null;
- }
-
HTTPRouteResource.Spec spec = new HTTPRouteResource.Spec(getParentRefs(type), ruleList);
return new HTTPRouteResource(metadata, spec);
}
- private static Map buildRouteLabels(Map customRouteLabels) {
+ static Map buildRouteLabels(Map customRouteLabels) {
if (customRouteLabels == null || customRouteLabels.isEmpty()) {
return new TreeMap<>(DEFAULT_ROUTE_LABELS);
}
@@ -203,7 +235,7 @@ private static Set getParentRefs(HttpRoute.Typ
return parentRefs;
}
- private static HTTPRouteResource.Spec.ParentRef gatewayParentRef(String name) {
+ static HTTPRouteResource.Spec.ParentRef gatewayParentRef(String name) {
return new HTTPRouteResource.Spec.ParentRef(PARENT_REF_GROUP_GATEWAY, PARENT_REF_KIND_GATEWAY, name);
}
@@ -221,21 +253,22 @@ private static HTTPRouteResource.Spec.BackendRef serviceBackendRef(String name,
);
}
- static Comparator pathSpecificityComparator() {
+ /**
+ * More segments first, then longer path, then lexical order.
+ */
+ static Comparator pathSpecificity() {
return (left, right) -> {
- int leftSegments = pathSegmentCount(left.gatewayPath());
- int rightSegments = pathSegmentCount(right.gatewayPath());
+ int leftSegments = pathSegmentCount(left);
+ int rightSegments = pathSegmentCount(right);
if (leftSegments != rightSegments) {
return Integer.compare(rightSegments, leftSegments);
}
- int leftLength = left.gatewayPath().length();
- int rightLength = right.gatewayPath().length();
- if (leftLength != rightLength) {
- return Integer.compare(rightLength, leftLength);
+ if (left.length() != right.length()) {
+ return Integer.compare(right.length(), left.length());
}
- return left.gatewayPath().compareTo(right.gatewayPath());
+ return left.compareTo(right);
};
}
@@ -252,12 +285,12 @@ static int pathSegmentCount(String path) {
return count;
}
- private static HTTPRouteResource.Spec.Rule toRule(HttpRoute route, List backendRefs) {
+ private static HTTPRouteResource.Spec.Rule toRule(PlannedRule rule, List backendRefs) {
HTTPRouteResource.Spec.Match match = new HTTPRouteResource.Spec.Match(
- convertSpringPathToHttpRoutePath(route.gatewayPath()));
+ new HTTPRouteResource.Spec.Match.Path(MATCH_TYPE_PATH_PREFIX, rule.value()));
- List filters = buildRewriteFilter(route);
- HTTPRouteResource.Spec.Rule.Timeouts timeouts = buildTimeout(route);
+ List filters = buildRewriteFilter(rule);
+ HTTPRouteResource.Spec.Rule.Timeouts timeouts = buildTimeout(rule);
return new HTTPRouteResource.Spec.Rule(
List.of(match),
@@ -267,15 +300,13 @@ private static HTTPRouteResource.Spec.Rule toRule(HttpRoute route, List buildRewriteFilter(HttpRoute route) {
- String normalizedGateway = normalizePath(route.gatewayPath());
- String normalizedService = normalizePath(route.path());
- if (normalizedGateway.equals(normalizedService)) {
+ private static List buildRewriteFilter(PlannedRule rule) {
+ if (rule.rewrite() == null) {
return List.of();
}
HTTPRouteResource.Spec.Filter.UrlRewrite.Path rewritePath =
- new HTTPRouteResource.Spec.Filter.UrlRewrite.Path(FILTER_PATH_TYPE_REPLACE_PREFIX_MATCH, normalizedService);
+ new HTTPRouteResource.Spec.Filter.UrlRewrite.Path(FILTER_PATH_TYPE_REPLACE_PREFIX_MATCH, rule.rewrite());
HTTPRouteResource.Spec.Filter.UrlRewrite urlRewrite =
new HTTPRouteResource.Spec.Filter.UrlRewrite(rewritePath);
HTTPRouteResource.Spec.Filter filter =
@@ -283,38 +314,18 @@ private static List buildRewriteFilter(HttpRoute
return List.of(filter);
}
- private static HTTPRouteResource.Spec.Rule.Timeouts buildTimeout(HttpRoute route) {
- if (route.timeout() <= 0) {
+ private static HTTPRouteResource.Spec.Rule.Timeouts buildTimeout(PlannedRule rule) {
+ if (rule.timeout() <= 0) {
return null;
}
- return new HTTPRouteResource.Spec.Rule.Timeouts(formatDuration(route.timeout()));
- }
-
- private static String renderValidatedYaml(HTTPRouteResource route) {
- String renderedYaml = writeYaml(route);
- return hasRegularExpressionMatch(route) ? REGEX_MANUAL_REVIEW_WARNING + renderedYaml : renderedYaml;
- }
-
- private static boolean hasRegularExpressionMatch(HTTPRouteResource route) {
- if (route == null || route.spec() == null || route.spec().rules() == null) {
- return false;
- }
- return route.spec().rules().stream()
- .filter(Objects::nonNull)
- .map(HTTPRouteResource.Spec.Rule::matches)
- .filter(Objects::nonNull)
- .flatMap(List::stream)
- .filter(Objects::nonNull)
- .map(HTTPRouteResource.Spec.Match::path)
- .filter(Objects::nonNull)
- .anyMatch(path -> MATCH_TYPE_REGULAR_EXPRESSION.equals(path.type()));
+ return new HTTPRouteResource.Spec.Rule.Timeouts(formatDuration(rule.timeout()));
}
- private static String writeYaml(HTTPRouteResource route) {
+ static String writeYaml(Object resource) {
try {
- return YAML_MAPPER.writeValueAsString(route);
+ return YAML_MAPPER.writeValueAsString(resource);
} catch (Exception e) {
- throw new RuntimeException("Failed to serialize HTTPRoute Resource to YAML", e);
+ throw new RuntimeException("Failed to serialize " + resource.getClass().getSimpleName() + " to YAML", e);
}
}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/Problems.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/Problems.java
new file mode 100644
index 0000000000..105a66c22e
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/Problems.java
@@ -0,0 +1,22 @@
+package com.netcracker.routes.gateway.plugin;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Errors and warnings of route migration. Any error fails the build before the output file is written.
+ */
+public record Problems(List errors, List warnings) {
+
+ public Problems() {
+ this(new ArrayList<>(), new ArrayList<>());
+ }
+
+ void error(String message) {
+ errors.add(message);
+ }
+
+ void warn(String message) {
+ warnings.add(message);
+ }
+}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RoutePaths.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RoutePaths.java
new file mode 100644
index 0000000000..3668fa512b
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RoutePaths.java
@@ -0,0 +1,128 @@
+package com.netcracker.routes.gateway.plugin;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
+/**
+ * Helpers for gateway paths with {@code {name}} variables, where a variable matches one path segment.
+ */
+final class RoutePaths {
+
+ private static final Pattern VARIABLE = Pattern.compile("\\{[^/{}]*}");
+ /**
+ * A literal that fills a variable in {@link #sample} and matches no literal of a route.
+ */
+ private static final String ANY = "~";
+
+ private RoutePaths() {
+ }
+
+ /**
+ * Cuts the path before the segment that contains the first variable, without the trailing slash.
+ *
+ * @return the cut path, or {@code /} if nothing remains
+ */
+ static String cut(String path) {
+ int variable = path.indexOf('{');
+ String prefix = variable < 0 ? path : path.substring(0, path.lastIndexOf('/', variable) + 1);
+ while (prefix.endsWith("/")) {
+ prefix = prefix.substring(0, prefix.length() - 1);
+ }
+ return prefix.isEmpty() ? "/" : prefix;
+ }
+
+ static boolean hasVariable(String path) {
+ return path.contains("{");
+ }
+
+ static List segments(String path) {
+ return Arrays.stream(path.split("/")).filter(s -> !s.isEmpty()).toList();
+ }
+
+ /**
+ * Compares the paths segment by segment, up to the shorter one: two variables always overlap,
+ * a variable overlaps a literal it matches, and two literals overlap if they are equal.
+ *
+ * @return whether some request path matches both paths
+ */
+ static boolean overlaps(String a, String b) {
+ List left = segments(a);
+ List right = segments(b);
+ for (int i = 0; i < Math.min(left.size(), right.size()); i++) {
+ if (!segmentsOverlap(left.get(i), right.get(i))) {
+ return false;
+ }
+ }
+ return true;
+ }
+
+ /**
+ * @return whether {@code route} has no more segments than {@code path} and overlaps it: for a request path, whether
+ * the {@code PathPrefix} or legacy route {@code route} matches it; for a pattern, whether it matches some request
+ * path that matches the pattern
+ */
+ static boolean covers(String route, String path) {
+ return segments(route).size() <= segments(path).size() && overlaps(route, path);
+ }
+
+ private static boolean segmentsOverlap(String a, String b) {
+ if (hasVariable(a) && hasVariable(b)) {
+ return true;
+ }
+ if (hasVariable(a) || hasVariable(b)) {
+ String variable = hasVariable(a) ? a : b;
+ String literal = hasVariable(a) ? b : a;
+ return segmentRegex(variable).matcher(literal).matches();
+ }
+ return a.equals(b);
+ }
+
+ private static Pattern segmentRegex(String segment) {
+ StringBuilder regex = new StringBuilder();
+ Matcher variables = VARIABLE.matcher(segment);
+ int last = 0;
+ while (variables.find()) {
+ regex.append(Pattern.quote(segment.substring(last, variables.start()))).append("[^/]+");
+ last = variables.end();
+ }
+ return Pattern.compile(regex.append(Pattern.quote(segment.substring(last))).toString());
+ }
+
+ /**
+ * @return a request path that matches both overlapping paths, deep as the deeper one, with {@link #ANY} for
+ * each variable that no literal of the other path fills
+ */
+ static String sample(String a, String b) {
+ List left = segments(a);
+ List right = segments(b);
+ List sample = new ArrayList<>();
+ for (int i = 0; i < Math.max(left.size(), right.size()); i++) {
+ String segment = i >= left.size() ? right.get(i)
+ : i >= right.size() || !hasVariable(left.get(i)) || VARIABLE.matcher(right.get(i)).matches()
+ ? left.get(i) : right.get(i);
+ sample.add(VARIABLE.matcher(segment).replaceAll(ANY));
+ }
+ return sample.stream().collect(Collectors.joining("/", "/", ""));
+ }
+
+ /**
+ * @return the path in AuthorizationPolicy form: each variable segment replaced with {@code {*}}, without the
+ * trailing slash
+ */
+ static String template(String path) {
+ return segments(path).stream()
+ .map(s -> VARIABLE.matcher(s).matches() ? "{*}" : s)
+ .collect(Collectors.joining("/", "/", ""));
+ }
+
+ /**
+ * @return whether {@link #template} can express the path: every variable takes up a whole segment
+ */
+ static boolean expressible(String path) {
+ return segments(path).stream().allMatch(s -> !hasVariable(s) || VARIABLE.matcher(s).matches());
+ }
+}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RouteScanner.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RouteScanner.java
index 0c1678bb87..1c79e1b705 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RouteScanner.java
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/main/java/com/netcracker/routes/gateway/plugin/RouteScanner.java
@@ -1,7 +1,12 @@
package com.netcracker.routes.gateway.plugin;
+import com.netcracker.cloud.routesregistration.common.annotation.FacadeGateway;
+import com.netcracker.cloud.routesregistration.common.annotation.FacadeRoute;
+import com.netcracker.cloud.routesregistration.common.annotation.ForbiddenRoute;
import com.netcracker.cloud.routesregistration.common.annotation.Gateway;
import com.netcracker.cloud.routesregistration.common.annotation.Route;
+import com.netcracker.cloud.routesregistration.common.annotation.Routes;
+import com.netcracker.cloud.routesregistration.common.spring.gateway.route.annotation.FacadeGatewayRequestMapping;
import com.netcracker.cloud.routesregistration.common.spring.gateway.route.annotation.GatewayRequestMapping;
import io.github.classgraph.*;
import jakarta.ws.rs.*;
@@ -12,6 +17,8 @@
import java.io.File;
import java.util.*;
+import java.util.function.Function;
+import java.util.stream.Collectors;
import java.util.stream.Stream;
public class RouteScanner {
@@ -25,9 +32,32 @@ public class RouteScanner {
GET.class, POST.class, PUT.class, DELETE.class, PATCH.class
);
+ /**
+ * The annotations that Quarkus resources inherit: {@code @Path} like in the Quarkus extension, and the HTTP methods,
+ * which the extension doesn't read.
+ */
+ private static final Set JAX_RS_INHERITED_ANNOTATIONS = Stream.concat(Stream.of(Path.class), JAX_RS_HTTP_ANNOTATIONS.stream())
+ .map(Class::getName)
+ .collect(Collectors.toSet());
+
private static final String ROUTE_ANNOTATION = Route.class.getName();
+ private static final String ROUTES_ANNOTATION = Routes.class.getName();
+ private static final String FACADE_ROUTE_ANNOTATION = FacadeRoute.class.getName();
+ private static final String FORBIDDEN_ROUTE_ANNOTATION = ForbiddenRoute.class.getName();
+ private static final Set FORBIDDEN_GATEWAY_NAMES =
+ Set.of(HttpRoute.Type.PUBLIC.name(), HttpRoute.Type.PRIVATE.name());
private static final String GATEWAY_ANNOTATION = Gateway.class.getName();
private static final String GATEWAY_REQUEST_MAPPING = GatewayRequestMapping.class.getName();
+ private static final String FACADE_GATEWAY_ANNOTATION = FacadeGateway.class.getName();
+ private static final String FACADE_GATEWAY_REQUEST_MAPPING = FacadeGatewayRequestMapping.class.getName();
+ private static final List ROUTE_SELECTING_ANNOTATIONS = List.of(
+ ROUTE_ANNOTATION, ROUTES_ANNOTATION, FACADE_ROUTE_ANNOTATION, FORBIDDEN_ROUTE_ANNOTATION
+ );
+ private static final Map BORDER_GATEWAY_NAMES = Map.of(
+ "public-gateway-service", HttpRoute.Type.PUBLIC,
+ "private-gateway-service", HttpRoute.Type.PRIVATE,
+ "internal-gateway-service", HttpRoute.Type.INTERNAL
+ );
private final String[] packages;
private final Log log;
@@ -38,29 +68,62 @@ public RouteScanner(String[] packages, Log log) {
}
public Set collectRoutes(List reactorProjects) throws MojoExecutionException {
- Set allRoutes = new HashSet<>();
+ return collect(reactorProjects).routes();
+ }
+
+ /**
+ * @return the routes and forbidden paths of the modules, and the errors of their route annotations
+ */
+ public Declarations collect(List reactorProjects) throws MojoExecutionException {
+ Declarations declarations = new Declarations();
for (MavenProject module : reactorProjects) {
log.info("Scanning module: " + module.getArtifactId());
- allRoutes.addAll(getRoutes(module));
+ scanModule(module, declarations);
}
- return allRoutes;
+ return declarations;
+ }
+
+ Declarations collect(File classesDir) throws MojoExecutionException {
+ Declarations declarations = new Declarations();
+ scanClassesDir(classesDir, declarations);
+ return declarations;
+ }
+
+ /**
+ * @return the declarations of Spring controllers
+ */
+ Declarations collect(Collection classes) {
+ Declarations declarations = new Declarations();
+ classes.stream()
+ .filter(classInfo -> hasRoute(classInfo, FrameworkType.SPRING))
+ .forEach(classInfo -> collectClass(classInfo, FrameworkType.SPRING, declarations));
+ return declarations;
}
public Set getRoutes(MavenProject module) throws MojoExecutionException {
- File classesDir = new File(module.getBuild().getOutputDirectory());
+ Declarations declarations = new Declarations();
+ scanModule(module, declarations);
+ return declarations.routes();
+ }
+
+ private void scanModule(MavenProject module, Declarations declarations) throws MojoExecutionException {
+ scanClassesDir(new File(module.getBuild().getOutputDirectory()), declarations);
+ }
+
+ private void scanClassesDir(File classesDir, Declarations declarations) throws MojoExecutionException {
if (!classesDir.exists()) {
log.warn("No classes to scan: outputDirectory does not exist.");
- return Collections.emptySet();
+ return;
}
try (ScanResult scan = createScanResult(classesDir)) {
FrameworkType framework = detectFramework(scan);
if (framework == FrameworkType.NONE) {
log.info("No supported framework detected (Spring or Quarkus)");
- return Collections.emptySet();
+ return;
}
- return scanClassesForRoutes(scan, framework);
+ scanClassesForRoutes(scan, framework, declarations);
} catch (Exception e) {
throw new MojoExecutionException("Failed scanning annotations", e);
}
@@ -85,108 +148,213 @@ private FrameworkType detectFramework(ScanResult scan) {
return FrameworkType.NONE;
}
- private Set scanClassesForRoutes(ScanResult scan, FrameworkType framework) {
- return getAnnotatedClasses(scan, framework)
- .distinct()
- .filter(this::hasRoute)
- .flatMap(classInfo -> getRequestMappingPaths(classInfo).stream())
- .collect(java.util.stream.Collectors.toSet());
+ private void scanClassesForRoutes(ScanResult scan, FrameworkType framework, Declarations declarations) {
+ scan.getAllClasses().stream()
+ .filter(classInfo -> hasRoute(classInfo, framework))
+ .forEach(classInfo -> collectClass(classInfo, framework, declarations));
}
- private Stream getAnnotatedClasses(ScanResult scan, FrameworkType framework) {
- Set> annotations = framework == FrameworkType.SPRING
- ? SPRING_HTTP_ANNOTATIONS
- : JAX_RS_HTTP_ANNOTATIONS;
+ /**
+ * @return the routes of a Spring controller
+ */
+ public Set getRequestMappingPaths(ClassInfo classInfo) {
+ Declarations declarations = new Declarations();
+ collectClass(classInfo, FrameworkType.SPRING, declarations);
+ return declarations.routes();
+ }
- if (framework == FrameworkType.QUARKUS) {
- return Stream.concat(
- getClassesWithAnnotations(scan, Set.of(Path.class)),
- getClassesWithAnnotations(scan, annotations)
- );
+ /**
+ * Like the legacy libs, maps all methods of a Spring controller with the controller's class annotations, and only
+ * the declared methods of a Quarkus resource.
+ */
+ private void collectClass(ClassInfo classInfo, FrameworkType framework, Declarations declarations) {
+ log.info("Get Request Mappings for Class: " + classInfo.getName());
+
+ int before = declarations.routes().size();
+ ClassContext classContext = extractClassContext(classInfo, framework);
+ MethodInfoList methods = framework == FrameworkType.SPRING ? classInfo.getMethodInfo() : classInfo.getDeclaredMethodInfo();
+ for (MethodInfo methodInfo : methods) {
+ AnnotationInfoList annotations = annotations(methodInfo, framework);
+ getHttpMappingAnnotations(annotations)
+ .forEach(mappingAnn -> collectMethod(classContext, methodInfo, annotations, mappingAnn, declarations));
}
+ collectClassLevel(classContext, declarations);
- return getClassesWithAnnotations(scan, annotations);
+ log.info("Found " + (declarations.routes().size() - before) + " routes");
}
- private Stream getClassesWithAnnotations(ScanResult scan, Set> annotations) {
- return annotations.stream()
- .flatMap(annotation -> Stream.concat(
- scan.getClassesWithMethodAnnotation(annotation.getName()).stream(),
- scan.getClassesWithAnnotation(annotation.getName()).stream()
- ));
+ private ClassContext extractClassContext(ClassInfo classInfo, FrameworkType framework) {
+ AnnotationInfoList annotations = annotations(classInfo, framework);
+ return new ClassContext(
+ classInfo.getName(),
+ resolveRequestMappings(annotations),
+ resolveGatewayMappings(annotations::get, PathKind.BORDER),
+ resolveGatewayMappings(annotations::get, PathKind.FACADE),
+ readRouteEntries(annotations),
+ annotations.get(FORBIDDEN_ROUTE_ANNOTATION)
+ );
}
- public Set getRequestMappingPaths(ClassInfo classInfo) {
- log.info("Get Request Mappings for Class: " + classInfo.getName());
+ private void collectClassLevel(ClassContext classContext, Declarations declarations) {
+ for (RouteEntry entry : classContext.routes()) {
+ HttpRoute.Type type = entry.type().orElse(HttpRoute.Type.INTERNAL);
+ long timeout = entry.timeout().orElse(0L);
+ for (Target target : resolveTargets(entry, type)) {
+ classPairs(classContext, target.pathKind()).forEach(pair -> declarations.routes().add(
+ new HttpRoute(pair.servicePath(), pair.gatewayPath(), target.type(), timeout)));
+ }
+ }
+
+ readForbiddenGateways(classContext.forbiddenRoute(), classContext.name(), declarations)
+ .ifPresent(gateways -> classPairs(classContext, PathKind.BORDER).forEach(pair ->
+ declarations.forbidden().add(new ForbiddenPath(pair.gatewayPath(), gateways))));
+ }
- RouteMetadata classMetadata = extractClassMetadata(classInfo);
- Set routes = processMethodRoutes(classInfo, classMetadata);
- routes.addAll(buildClassLevelRoutes(classInfo, classMetadata));
+ /**
+ * @param annotations the annotations of the method, including the inherited ones
+ */
+ private void collectMethod(ClassContext classContext, MethodInfo methodInfo, AnnotationInfoList annotations,
+ AnnotationInfo mappingAnn, Declarations declarations) {
+ List mappingPaths = resolveMappingPaths(annotations, mappingAnn);
- if (classInfo.getSuperclass() != null) {
- routes.addAll(getRequestMappingPaths(classInfo.getSuperclass()));
+ for (RouteEntry entry : readRouteEntries(annotations)) {
+ HttpRoute.Type type = entry.type().orElse(HttpRoute.Type.INTERNAL);
+ long timeout = entry.timeout().orElse(0L);
+ for (Target target : resolveTargets(entry, type)) {
+ methodPairs(classContext, annotations, target.pathKind(), mappingPaths).forEach(pair -> declarations.routes().add(
+ new HttpRoute(pair.servicePath(), pair.gatewayPath(), target.type(), timeout)));
+ }
}
- log.info("Found " + routes.size() + " routes");
- return routes;
+ readForbiddenGateways(annotations.get(FORBIDDEN_ROUTE_ANNOTATION),
+ classContext.name() + "#" + methodInfo.getName(), declarations)
+ .ifPresent(gateways -> methodPairs(classContext, annotations, PathKind.BORDER, mappingPaths).forEach(pair ->
+ declarations.forbidden().add(new ForbiddenPath(pair.gatewayPath(), gateways))));
}
- private RouteMetadata extractClassMetadata(ClassInfo classInfo) {
- return new RouteMetadata(
- getRouteType(classInfo.getAnnotationInfo(ROUTE_ANNOTATION)),
- getRouteTimeout(classInfo.getAnnotationInfo(ROUTE_ANNOTATION)),
- resolveGatewayMappings(classInfo),
- resolveRequestMappings(classInfo)
- );
+ /**
+ * Gateway paths of the class itself: {@code @Gateway}-style mappings of the kind combined with the class request mappings.
+ */
+ private List classPairs(ClassContext classContext, PathKind kind) {
+ List gatewayMappings = classContext.gatewayMappings(kind);
+ List requestMappings = classContext.requestMappings();
+ if (requestMappings.isEmpty() && gatewayMappings.isEmpty()) {
+ return List.of();
+ }
+ if (!gatewayMappings.isEmpty()) {
+ return buildClassGatewayPairs(gatewayMappings, List.of(), requestMappings, List.of(""));
+ }
+ return requestMappings.stream().map(path -> new PathPair(path, path)).toList();
}
- private Set processMethodRoutes(ClassInfo classInfo, RouteMetadata classMetadata) {
- return classInfo.getMethodInfo().stream()
- .flatMap(methodInfo -> getHttpMappingAnnotations(methodInfo)
- .map(mappingAnn -> Map.entry(methodInfo, mappingAnn)))
- .flatMap(entry -> buildRoutesForMethod(
- entry.getKey(),
- entry.getValue(),
- classMetadata
- ).stream())
- .collect(java.util.stream.Collectors.toSet());
+ private List methodPairs(ClassContext classContext, AnnotationInfoList annotations, PathKind kind, List mappingPaths) {
+ List methodGatewayMappings = resolveGatewayMappings(annotations::get, kind);
+ if (!classContext.gatewayMappings(kind).isEmpty()) {
+ return buildClassGatewayPairs(
+ classContext.gatewayMappings(kind),
+ methodGatewayMappings,
+ classContext.requestMappings(),
+ mappingPaths
+ );
+ }
+ if (!methodGatewayMappings.isEmpty()) {
+ return buildMethodGatewayPairs(methodGatewayMappings, classContext.requestMappings(), mappingPaths);
+ }
+ return buildStandardPairs(classContext.requestMappings(), mappingPaths);
+ }
+
+ /**
+ * Legacy resolution of one route annotation into targets: empty {@code gateways} goes by type, a border gateway name
+ * gives a border route of that gateway's type, and every other name is a composite gateway.
+ */
+ private List resolveTargets(RouteEntry entry, HttpRoute.Type type) {
+ if (entry.gateways().isEmpty()) {
+ return List.of(type == HttpRoute.Type.FACADE
+ ? new Target(HttpRoute.Type.FACADE, PathKind.FACADE)
+ : new Target(type, PathKind.BORDER));
+ }
+ return entry.gateways().stream()
+ .map(name -> Optional.ofNullable(BORDER_GATEWAY_NAMES.get(name))
+ .map(borderType -> new Target(borderType, PathKind.BORDER))
+ .orElse(new Target(HttpRoute.Type.FACADE, PathKind.BORDER)))
+ .toList();
}
- private Set buildClassLevelRoutes(ClassInfo classInfo, RouteMetadata classMetadata) {
- if (!classInfo.hasAnnotation(ROUTE_ANNOTATION)) {
- return Collections.emptySet();
+ private Optional> readForbiddenGateways(AnnotationInfo forbiddenRoute, String element, Declarations declarations) {
+ if (forbiddenRoute == null) {
+ return Optional.empty();
}
-
- if (classMetadata.requestMappings().isEmpty() && classMetadata.gatewayMappings().isEmpty()) {
- return Collections.emptySet();
+ List names = enumValueNames(forbiddenRoute.getParameterValues(false).getValue("value"));
+ if (names.isEmpty() || !FORBIDDEN_GATEWAY_NAMES.containsAll(names)) {
+ declarations.errors().add("@ForbiddenRoute of " + element + " must list PUBLIC and/or PRIVATE, found " + names);
+ return Optional.empty();
}
-
- HttpRoute.Type routeType = classMetadata.routeType().orElse(HttpRoute.Type.INTERNAL);
- long routeTimeout = classMetadata.routeTimeout().orElse(0L);
-
- if (!classMetadata.gatewayMappings().isEmpty()) {
- return buildClassGatewayRoutes(
- classMetadata.gatewayMappings(),
- List.of(),
- classMetadata.requestMappings(),
- List.of(""),
- routeType,
- routeTimeout
- );
+ return Optional.of(names.stream().map(HttpRoute.Type::valueOf).collect(Collectors.toCollection(() -> EnumSet.noneOf(HttpRoute.Type.class))));
+ }
+
+ /**
+ * Reads every route annotation of an element: each {@code @Route} (classgraph may unwrap the {@code @Routes}
+ * container into several of them), the {@code @Routes} container when it is not unwrapped, and {@code @FacadeRoute}.
+ */
+ private List readRouteEntries(AnnotationInfoList annotations) {
+ List entries = new ArrayList<>();
+ for (AnnotationInfo annotation : annotations) {
+ String name = annotation.getName();
+ if (ROUTE_ANNOTATION.equals(name)) {
+ entries.add(routeEntry(annotation));
+ } else if (ROUTES_ANNOTATION.equals(name)
+ && annotation.getParameterValues(false).getValue("value") instanceof Object[] values) {
+ Arrays.stream(values)
+ .filter(AnnotationInfo.class::isInstance)
+ .map(AnnotationInfo.class::cast)
+ .map(this::routeEntry)
+ .forEach(entries::add);
+ } else if (FACADE_ROUTE_ANNOTATION.equals(name)) {
+ entries.add(new RouteEntry(
+ Optional.of(HttpRoute.Type.FACADE),
+ getRouteTimeout(annotation),
+ stringValues(annotation.getParameterValues(false).getValue("gateways"))
+ ));
+ }
}
+ return entries;
+ }
- return classMetadata.requestMappings().stream()
- .map(path -> new HttpRoute(path, routeType, routeTimeout))
- .collect(java.util.stream.Collectors.toSet());
+ private RouteEntry routeEntry(AnnotationInfo route) {
+ AnnotationParameterValueList parameters = route.getParameterValues(false);
+ return new RouteEntry(
+ getRouteType(route),
+ getRouteTimeout(route),
+ stringValues(parameters.getValue("gateways"))
+ );
}
- private boolean hasMethodRouteAnnotation(MethodInfo methodInfo) {
- return methodInfo.hasAnnotation(ROUTE_ANNOTATION);
+ private static Stream values(Object value) {
+ return switch (value) {
+ case null -> Stream.empty();
+ case Object[] objects -> Arrays.stream(objects);
+ default -> Stream.of(value);
+ };
}
- private Stream getHttpMappingAnnotations(MethodInfo methodInfo) {
- AnnotationInfoList annotations = methodInfo.getAnnotationInfo();
+ private static List stringValues(Object value) {
+ return values(value)
+ .filter(String.class::isInstance)
+ .map(String.class::cast)
+ .filter(s -> !s.isEmpty())
+ .distinct()
+ .toList();
+ }
+ private static List enumValueNames(Object value) {
+ return values(value)
+ .filter(AnnotationEnumValue.class::isInstance)
+ .map(AnnotationEnumValue.class::cast)
+ .map(AnnotationEnumValue::getValueName)
+ .toList();
+ }
+
+ private Stream getHttpMappingAnnotations(AnnotationInfoList annotations) {
List specificMappings = annotations.stream()
.filter(this::isHttpMappingAnnotation)
.toList();
@@ -199,35 +367,92 @@ private Stream getHttpMappingAnnotations(MethodInfo methodInfo)
.filter(this::isRequestMappingAnnotation);
}
- private boolean hasRoute(ClassInfo classInfo) {
- return classInfo.hasAnnotation(Route.class) || classInfo.hasMethodAnnotation(Route.class);
+ /**
+ * Like the legacy libs: a Spring controller is a concrete class with a route annotation in its hierarchy, a Quarkus
+ * resource is a class or interface with a route annotation of its own.
+ */
+ private boolean hasRoute(ClassInfo classInfo, FrameworkType framework) {
+ if (framework == FrameworkType.QUARKUS) {
+ return hasOwnRoute(classInfo);
+ }
+ return classInfo.isStandardClass() && !classInfo.isAbstract() && hierarchy(classInfo).anyMatch(this::hasOwnRoute);
}
- private boolean isRequestMappingAnnotation(AnnotationInfo annotationInfo) {
- return RequestMapping.class.getName().equals(annotationInfo.getName());
+ private boolean hasOwnRoute(ClassInfo classInfo) {
+ return ROUTE_SELECTING_ANNOTATIONS.stream()
+ .anyMatch(annotation -> classInfo.hasAnnotation(annotation) || classInfo.hasDeclaredMethodAnnotation(annotation));
}
- private List resolveGatewayMappings(ClassInfo classInfo) {
- if (classInfo.hasAnnotation(GATEWAY_REQUEST_MAPPING)) {
- return getAnnotationPathFor(classInfo.getAnnotationInfo(GATEWAY_REQUEST_MAPPING));
- }
- return getAnnotationPathFor(classInfo.getAnnotationInfo(GATEWAY_ANNOTATION));
+ /**
+ * @return the class, then each of its interfaces with their superinterfaces, then its superclass in the same way:
+ * the order in which Spring's {@code AnnotationUtils.findAnnotation} searches
+ */
+ private static Stream hierarchy(ClassInfo classInfo) {
+ return Stream.of(
+ Stream.of(classInfo),
+ classInfo.getInterfaces().directOnly().stream().flatMap(RouteScanner::hierarchy),
+ Stream.ofNullable(classInfo.getSuperclass()).flatMap(RouteScanner::hierarchy)
+ ).flatMap(Function.identity());
+ }
+
+ private static AnnotationInfoList annotations(ClassInfo classInfo, FrameworkType framework) {
+ return inherit(hierarchy(classInfo).map(ClassInfo::getAnnotationInfo), framework);
+ }
+
+ /**
+ * @return the annotations of the method and of the methods it overrides
+ */
+ private static AnnotationInfoList annotations(MethodInfo methodInfo, FrameworkType framework) {
+ return inherit(hierarchy(methodInfo.getClassInfo())
+ .flatMap(classInfo -> classInfo.getDeclaredMethodInfo(methodInfo.getName()).stream())
+ .filter(method -> method.getTypeDescriptorStr().equals(methodInfo.getTypeDescriptorStr()))
+ .map(MethodInfo::getAnnotationInfo), framework);
+ }
+
+ /**
+ * Adds to the annotations of an element the annotations that it inherits: each annotation type comes from the
+ * first element of the hierarchy that has it, like in Spring's {@code AnnotationUtils.findAnnotation}. Spring
+ * controllers inherit every annotation, Quarkus resources only {@code JAX_RS_INHERITED_ANNOTATIONS}.
+ *
+ * @param hierarchy the annotations of the element, then of the elements it inherits from
+ */
+ private static AnnotationInfoList inherit(Stream hierarchy, FrameworkType framework) {
+ Iterator elements = hierarchy.iterator();
+ AnnotationInfoList result = new AnnotationInfoList(elements.next());
+ Set found = result.stream().map(AnnotationInfo::getName).collect(Collectors.toCollection(HashSet::new));
+ elements.forEachRemaining(annotations -> {
+ // all annotations of a type, which repeat when classgraph unwraps @Routes
+ List inherited = annotations.stream()
+ .filter(annotation -> !found.contains(annotation.getName()))
+ .filter(annotation -> framework == FrameworkType.SPRING || JAX_RS_INHERITED_ANNOTATIONS.contains(annotation.getName()))
+ .toList();
+ result.addAll(inherited);
+ inherited.forEach(annotation -> found.add(annotation.getName()));
+ });
+ return result;
}
- private List resolveGatewayMappings(MethodInfo methodInfo) {
- if (methodInfo.hasAnnotation(GATEWAY_REQUEST_MAPPING)) {
- return getAnnotationPathFor(methodInfo.getAnnotationInfo(GATEWAY_REQUEST_MAPPING));
+ private boolean isRequestMappingAnnotation(AnnotationInfo annotationInfo) {
+ return RequestMapping.class.getName().equals(annotationInfo.getName());
+ }
+
+ private List resolveGatewayMappings(Function annotations, PathKind kind) {
+ String requestMapping = kind == PathKind.BORDER ? GATEWAY_REQUEST_MAPPING : FACADE_GATEWAY_REQUEST_MAPPING;
+ String gateway = kind == PathKind.BORDER ? GATEWAY_ANNOTATION : FACADE_GATEWAY_ANNOTATION;
+ AnnotationInfo requestMappingInfo = annotations.apply(requestMapping);
+ if (requestMappingInfo != null) {
+ return getAnnotationPathFor(requestMappingInfo);
}
- return getAnnotationPathFor(methodInfo.getAnnotationInfo(GATEWAY_ANNOTATION));
+ return getAnnotationPathFor(annotations.apply(gateway));
}
- private List resolveRequestMappings(ClassInfo classInfo) {
+ private List resolveRequestMappings(AnnotationInfoList annotations) {
return Stream.of(
RequestMapping.class, GetMapping.class, PostMapping.class,
PutMapping.class, DeleteMapping.class, PatchMapping.class, Path.class
)
.map(Class::getName)
- .map(classInfo::getAnnotationInfo)
+ .map(annotations::get)
.filter(Objects::nonNull)
.findFirst()
.map(this::getAnnotationPathFor)
@@ -248,81 +473,32 @@ private boolean isHttpMappingAnnotation(AnnotationInfo annotationInfo) {
PATCH.class.getName().equals(name);
}
- private Set buildRoutesForMethod(
- MethodInfo methodInfo,
- AnnotationInfo mappingAnn,
- RouteMetadata classMetadata
- ) {
- if (!hasMethodRouteAnnotation(methodInfo)) {
- return Collections.emptySet();
- }
-
- HttpRoute.Type routeType = getRouteType(methodInfo.getAnnotationInfo(ROUTE_ANNOTATION))
- .orElse(classMetadata.routeType().orElse(HttpRoute.Type.INTERNAL));
-
- long routeTimeout = getRouteTimeout(methodInfo.getAnnotationInfo(ROUTE_ANNOTATION))
- .orElse(classMetadata.routeTimeout().orElse(0L));
-
- List methodGatewayMappings = resolveGatewayMappings(methodInfo);
- List mappingPaths = resolveMappingPaths(methodInfo, mappingAnn);
-
- if (!classMetadata.gatewayMappings().isEmpty()) {
- return buildClassGatewayRoutes(
- classMetadata.gatewayMappings(),
- methodGatewayMappings,
- classMetadata.requestMappings(),
- mappingPaths,
- routeType,
- routeTimeout
- );
- }
-
- if (!methodGatewayMappings.isEmpty()) {
- return buildMethodGatewayRoutes(
- methodGatewayMappings,
- classMetadata.requestMappings(),
- mappingPaths,
- routeType,
- routeTimeout
- );
- }
-
- return buildStandardRoutes(classMetadata.requestMappings(), mappingPaths, routeType, routeTimeout);
- }
-
- private List resolveMappingPaths(MethodInfo methodInfo, AnnotationInfo mappingAnn) {
+ private List resolveMappingPaths(AnnotationInfoList annotations, AnnotationInfo mappingAnn) {
if (JAX_RS_HTTP_ANNOTATIONS.stream().map(Class::getName).anyMatch(s -> s.equals(mappingAnn.getClassInfo().getName()))) {
- List paths = getAnnotationPathFor(methodInfo.getAnnotationInfo(Path.class.getName()));
+ List paths = getAnnotationPathFor(annotations.get(Path.class.getName()));
return paths.isEmpty() ? List.of("") : paths;
}
return getAnnotationPathFor(mappingAnn);
}
- private Set buildStandardRoutes(
- List classMappings,
- List methodMappings,
- HttpRoute.Type routeType,
- long routeTimeout
- ) {
+ private List buildStandardPairs(List classMappings, List methodMappings) {
if (classMappings.isEmpty()) {
return methodMappings.stream()
- .map(path -> new HttpRoute(path, routeType, routeTimeout))
- .collect(java.util.stream.Collectors.toSet());
+ .map(path -> new PathPair(path, path))
+ .toList();
}
return classMappings.stream()
.flatMap(classPrefix -> methodMappings.stream()
- .map(methodPath -> new HttpRoute(classPrefix + methodPath, routeType, routeTimeout)))
- .collect(java.util.stream.Collectors.toSet());
+ .map(methodPath -> new PathPair(classPrefix + methodPath, classPrefix + methodPath)))
+ .toList();
}
- private Set buildClassGatewayRoutes(
+ private List buildClassGatewayPairs(
List classGatewayMappings,
List methodGatewayMappings,
List classMappings,
- List methodMappings,
- HttpRoute.Type routeType,
- long routeTimeout
+ List methodMappings
) {
List effectiveMethodMappings = methodMappings.isEmpty() ? List.of("/") : methodMappings;
List effectiveMethodGatewayMappings = methodGatewayMappings.isEmpty()
@@ -334,37 +510,25 @@ private Set buildClassGatewayRoutes(
return classGatewayMappings.stream()
.flatMap(classPrefix -> effectiveMethodGatewayMappings.stream()
- .map(methodPath -> new HttpRoute(
- servicePrefix + mappingPath,
- classPrefix + methodPath,
- routeType,
- routeTimeout
- )))
- .collect(java.util.stream.Collectors.toSet());
+ .map(methodPath -> new PathPair(servicePrefix + mappingPath, classPrefix + methodPath)))
+ .toList();
}
- private Set buildMethodGatewayRoutes(
+ private List buildMethodGatewayPairs(
List methodGatewayMappings,
List classMappings,
- List methodMappings,
- HttpRoute.Type routeType,
- long routeTimeout
+ List methodMappings
) {
if (methodGatewayMappings.isEmpty() || methodMappings.isEmpty()) {
- return Collections.emptySet();
+ return List.of();
}
String servicePrefix = classMappings.isEmpty() ? "" : classMappings.get(0);
String mappingPath = methodMappings.get(0);
return methodGatewayMappings.stream()
- .map(methodPath -> new HttpRoute(
- servicePrefix + mappingPath,
- methodPath,
- routeType,
- routeTimeout
- ))
- .collect(java.util.stream.Collectors.toSet());
+ .map(methodPath -> new PathPair(servicePrefix + mappingPath, methodPath))
+ .toList();
}
private List getAnnotationPathFor(AnnotationInfo annotationInfo) {
@@ -433,10 +597,10 @@ private Optional getRouteTimeout(AnnotationInfo annotationInfo) {
private Optional getRouteType(AnnotationInfo annotationInfo) {
return Optional.ofNullable(annotationInfo)
.map(annInfo -> annInfo.getParameterValues(false))
- .flatMap(params ->
- Optional.ofNullable(params.getValue("type"))
- .or(() -> Optional.ofNullable(params.getValue("value")))
- )
+ .flatMap(params -> Optional.ofNullable(params.getValue("value"))
+ .filter(value -> !(value instanceof AnnotationEnumValue e
+ && e.getValueName().equals(HttpRoute.Type.INTERNAL.name())))
+ .or(() -> Optional.ofNullable(params.getValue("type"))))
.filter(AnnotationEnumValue.class::isInstance)
.map(AnnotationEnumValue.class::cast)
.map(enumVal -> HttpRoute.Type.valueOf(enumVal.getValueName()));
@@ -459,10 +623,44 @@ private enum FrameworkType {
SPRING, QUARKUS, NONE
}
- private record RouteMetadata(
- Optional routeType,
- Optional routeTimeout,
- List gatewayMappings,
- List requestMappings
+ /**
+ * Which gateway path annotations apply: {@code @Gateway}/{@code @GatewayRequestMapping} for border and composite
+ * routes, {@code @FacadeGateway}/{@code @FacadeGatewayRequestMapping} for facade routes.
+ */
+ private enum PathKind {
+ BORDER, FACADE
+ }
+
+ private record PathPair(String servicePath, String gatewayPath) {}
+
+ private record Target(HttpRoute.Type type, PathKind pathKind) {}
+
+ private record RouteEntry(
+ Optional type,
+ Optional timeout,
+ List gateways
) {}
+
+ private record ClassContext(
+ String name,
+ List requestMappings,
+ List borderGatewayMappings,
+ List facadeGatewayMappings,
+ List routes,
+ AnnotationInfo forbiddenRoute
+ ) {
+ List gatewayMappings(PathKind kind) {
+ return kind == PathKind.BORDER ? borderGatewayMappings : facadeGatewayMappings;
+ }
+ }
+
+ /**
+ * @param errors errors of the route annotations
+ */
+ public record Declarations(Set routes, Set forbidden, List errors) {
+
+ Declarations() {
+ this(new HashSet<>(), new HashSet<>(), new ArrayList<>());
+ }
+ }
}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/AuthorizationPolicyRendererTest.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/AuthorizationPolicyRendererTest.java
new file mode 100644
index 0000000000..57c5fa244d
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/AuthorizationPolicyRendererTest.java
@@ -0,0 +1,412 @@
+package com.netcracker.routes.gateway.plugin;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import static com.netcracker.routes.gateway.plugin.HttpRoute.Type.INTERNAL;
+import static com.netcracker.routes.gateway.plugin.HttpRoute.Type.PRIVATE;
+import static com.netcracker.routes.gateway.plugin.HttpRoute.Type.PUBLIC;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AuthorizationPolicyRendererTest {
+
+ private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());
+ private static final String RESOURCE = "/api/v1/svc/resource";
+ private static final String ORDER = "/api/v1/svc/order";
+
+ private static HttpRoute route(String gatewayPath, HttpRoute.Type type) {
+ return new HttpRoute(gatewayPath, gatewayPath, type);
+ }
+
+ private static ForbiddenPath forbidden(String gatewayPath, HttpRoute.Type... gateways) {
+ return new ForbiddenPath(gatewayPath, Set.of(gateways));
+ }
+
+ private static String render(boolean auto, Problems problems, Set routes, Set forbidden) {
+ return new AuthorizationPolicyRenderer(Map.of(), auto).generateAuthorizationPoliciesYaml(routes, forbidden, problems);
+ }
+
+ private static String render(boolean auto, Set routes, Set forbidden) {
+ Problems problems = new Problems();
+ String yaml = render(auto, problems, routes, forbidden);
+ assertEquals(List.of(), problems.errors());
+ return yaml;
+ }
+
+ /**
+ * @return the rules of each policy by gateway, for example {@code /a/{*} !/a/{*}/b}: the first path of the rule
+ * followed by the first path of each notPaths subtree
+ */
+ @SuppressWarnings("unchecked")
+ private static Map> rules(String yaml) throws Exception {
+ Map> result = new LinkedHashMap<>();
+ try (var values = YAML.readerFor(Map.class).readValues(yaml)) {
+ while (values.hasNext()) {
+ Map policy = (Map) values.next();
+ String name = (String) ((Map) policy.get("metadata")).get("name");
+ List rules = new ArrayList<>();
+ for (Object rule : (List) ((Map) policy.get("spec")).get("rules")) {
+ Map operation = (Map) ((Map)
+ ((List) ((Map) rule).get("to")).get(0)).get("operation");
+ assertEquals(List.of("8080"), operation.get("ports"));
+ List paths = (List) operation.get("paths");
+ List notPaths = (List) operation.getOrDefault("notPaths", List.of());
+ rules.add(paths.get(0) + notPaths.stream().filter(p -> !p.endsWith("{**}")).map(p -> " !" + p)
+ .collect(Collectors.joining()));
+ }
+ result.put(name.substring(name.lastIndexOf('-') + 1), rules);
+ }
+ }
+ return result;
+ }
+
+ @Test
+ void forbiddenOnPublicAndPrivate() {
+ String yaml = render(false, Set.of(
+ route(RESOURCE, PUBLIC),
+ route(RESOURCE + "/{id}/internal-api", INTERNAL),
+ route(RESOURCE + "/{id}/internal-api/status", PUBLIC)),
+ Set.of(forbidden(RESOURCE + "/{id}/internal-api", PUBLIC, PRIVATE)));
+
+ assertEquals("""
+ ---
+ apiVersion: "security.istio.io/v1"
+ kind: "AuthorizationPolicy"
+ metadata:
+ name: "{{ .Values.SERVICE_NAME }}-java-annotations-deny-public"
+ labels:
+ app.kubernetes.io/managed-by: "{{ .Values.MANAGED_BY }}"
+ app.kubernetes.io/name: "{{ .Values.SERVICE_NAME }}"
+ app.kubernetes.io/part-of: "{{ .Values.APPLICATION_NAME }}"
+ app.kubernetes.io/processed-by-operator: "istiod"
+ deployer.cleanup/allow: "true"
+ deployment.netcracker.com/sessionId: "{{ .Values.DEPLOYMENT_SESSION_ID }}"
+ spec:
+ targetRefs:
+ - group: "gateway.networking.k8s.io"
+ kind: "Gateway"
+ name: "public-gateway"
+ action: "DENY"
+ rules:
+ - to:
+ - operation:
+ ports:
+ - "8080"
+ paths:
+ - "/api/v1/svc/resource/{*}/internal-api"
+ - "/api/v1/svc/resource/{*}/internal-api/{**}"
+ notPaths:
+ - "/api/v1/svc/resource/{*}/internal-api/status"
+ - "/api/v1/svc/resource/{*}/internal-api/status/{**}"
+ ---
+ apiVersion: "security.istio.io/v1"
+ kind: "AuthorizationPolicy"
+ metadata:
+ name: "{{ .Values.SERVICE_NAME }}-java-annotations-deny-private"
+ labels:
+ app.kubernetes.io/managed-by: "{{ .Values.MANAGED_BY }}"
+ app.kubernetes.io/name: "{{ .Values.SERVICE_NAME }}"
+ app.kubernetes.io/part-of: "{{ .Values.APPLICATION_NAME }}"
+ app.kubernetes.io/processed-by-operator: "istiod"
+ deployer.cleanup/allow: "true"
+ deployment.netcracker.com/sessionId: "{{ .Values.DEPLOYMENT_SESSION_ID }}"
+ spec:
+ targetRefs:
+ - group: "gateway.networking.k8s.io"
+ kind: "Gateway"
+ name: "private-gateway"
+ action: "DENY"
+ rules:
+ - to:
+ - operation:
+ ports:
+ - "8080"
+ paths:
+ - "/api/v1/svc/resource/{*}/internal-api"
+ - "/api/v1/svc/resource/{*}/internal-api/{**}"
+ notPaths:
+ - "/api/v1/svc/resource/{*}/internal-api/status"
+ - "/api/v1/svc/resource/{*}/internal-api/status/{**}"
+ """, yaml);
+ assertFalse(yaml.contains("internal-gateway-service"), yaml);
+ }
+
+ @Test
+ void prefixCutFromARouteWithVariables() throws Exception {
+ String yaml = render(false, Set.of(route(ORDER + "/{id}/items", PUBLIC)), Set.of(forbidden(ORDER, PUBLIC, PRIVATE)));
+
+ List rule = List.of(ORDER + " !" + ORDER + "/{*}/items");
+ assertEquals(Map.of("public", rule, "private", rule), rules(yaml));
+ assertFalse(yaml.contains("internal-gateway-service"), yaml);
+ }
+
+ @Test
+ void missingForbiddenRouteIsAnError() {
+ Problems problems = new Problems();
+
+ String yaml = render(false, problems, Set.of(route(ORDER + "/{id}/items", PUBLIC)), Set.of(forbidden(ORDER, PUBLIC)));
+
+ assertTrue(yaml.contains("deny-public") && !yaml.contains("deny-private"), yaml);
+ assertEquals(List.of(ORDER + " is not routed by legacy, but Istio routes it by PathPrefix " + ORDER + " cut from "
+ + ORDER + "/{id}/items on private-gateway: add @ForbiddenRoute({PRIVATE}) "
+ + "to the element mapped to " + ORDER), problems.errors());
+ }
+
+ @Test
+ void missingRuleForANarrowerRouteNamesThePrefixThatRoutesIt() {
+ Problems problems = new Problems();
+
+ render(false, problems, Set.of(route(RESOURCE, PUBLIC), route(RESOURCE + "/{id}/internal-api", INTERNAL)), Set.of());
+
+ assertEquals(List.of(RESOURCE + "/{id}/internal-api is forbidden by legacy, as its route type is narrower, but Istio "
+ + "routes it by PathPrefix " + RESOURCE + " on public-gateway, private-gateway: add @ForbiddenRoute({PUBLIC, "
+ + "PRIVATE}) to the element mapped to " + RESOURCE + "/{id}/internal-api"), problems.errors());
+ }
+
+ @Test
+ void internalOnlyRoutesNeedNoRule() {
+ Set routes = Set.of(route("/api/v1/svc/{id}", INTERNAL), route("/api/v1/svc/{id}/admin", INTERNAL));
+
+ assertEquals("", render(false, routes, Set.of()));
+ assertEquals("", render(true, routes, Set.of()));
+ }
+
+ @Test
+ void internalRoutesBelowAPrivateRouteNeedRulesOnlyOnThePrivateGateway() throws Exception {
+ String x = "/api/v1/svc/x";
+ Set routes = Set.of(route(x, PRIVATE), route(x + "/admin", INTERNAL), route(x + "/{id}/sub", INTERNAL));
+ Problems problems = new Problems();
+
+ assertEquals("", render(false, problems, routes, Set.of()));
+ assertEquals(List.of(
+ x + "/admin is forbidden by legacy, as its route type is narrower, but Istio routes it by PathPrefix " + x
+ + " on private-gateway: add @ForbiddenRoute({PRIVATE}) to the element mapped to " + x + "/admin",
+ x + "/{id}/sub is forbidden by legacy, as its route type is narrower, but Istio routes it by PathPrefix " + x
+ + " on private-gateway: add @ForbiddenRoute({PRIVATE}) to the element mapped to " + x + "/{id}/sub"),
+ problems.errors());
+
+ String explicit = render(false, routes, Set.of(forbidden(x + "/admin", PRIVATE), forbidden(x + "/{id}/sub", PRIVATE)));
+ assertEquals(Map.of("private", List.of(x + "/admin", x + "/{*}/sub")), rules(explicit));
+ assertEquals(explicit, render(true, routes, Set.of()));
+ }
+
+ @Test
+ void narrowerRouteThatLegacyRoutesByALongerExposedRouteNeedsNoRule() throws Exception {
+ Set routes = Set.of(route("/api/v1/svc/{tenantIdentifier}", PUBLIC), route("/api/v1/svc/orders", INTERNAL));
+
+ String explicit = render(false, routes, Set.of(forbidden("/api/v1/svc", PUBLIC, PRIVATE)));
+
+ assertEquals(List.of("/api/v1/svc !/api/v1/svc/{*}"), rules(explicit).get("public"));
+ assertEquals(explicit, render(true, routes, Set.of()));
+ }
+
+ @Test
+ void automaticRulesMatchExplicitOnes() throws Exception {
+ Set routes = Set.of(
+ route(RESOURCE, PUBLIC),
+ route(RESOURCE + "/{id}/internal-api", INTERNAL),
+ route(RESOURCE + "/{id}/internal-api/status", PUBLIC),
+ route(ORDER + "/{id}/items", PUBLIC));
+
+ assertEquals(render(false, routes, Set.of(
+ forbidden(RESOURCE + "/{id}/internal-api", PUBLIC, PRIVATE),
+ forbidden(ORDER, PUBLIC, PRIVATE))),
+ render(true, routes, Set.of()));
+ assertEquals(List.of(ORDER + " !" + ORDER + "/{*}/items",
+ RESOURCE + "/{*}/internal-api !" + RESOURCE + "/{*}/internal-api/status"),
+ rules(render(true, routes, Set.of())).get("public"));
+ }
+
+ @Test
+ void shorterRouteExposedOnTheGatewayCoversThePrefix() {
+ assertEquals("", render(false, Set.of(route(ORDER, PUBLIC), route(ORDER + "/{id}/items", PUBLIC)), Set.of()));
+ }
+
+ @Test
+ void narrowerRouteOutsideAnyExposedPrefixNeedsNoRule() {
+ assertEquals("", render(false, Set.of(route(RESOURCE, PUBLIC), route(ORDER + "/internal", INTERNAL)), Set.of()));
+ }
+
+ @Test
+ void narrowerRouteBelowALiteralPrefixByAVariableNeedsARule() throws Exception {
+ List rule = List.of("/api/v1/svc/{*}/internal");
+ assertEquals(Map.of("public", rule, "private", rule), rules(render(true,
+ Set.of(route(ORDER, PUBLIC), route("/api/v1/svc/{entity}/internal", INTERNAL)), Set.of())));
+ }
+
+ @Test
+ void facadeRoutesNeedNoRule() {
+ assertEquals("", render(false, Set.of(route(ORDER + "/{id}", HttpRoute.Type.FACADE)), Set.of()));
+ }
+
+ @Test
+ void nestedForbiddenPaths() throws Exception {
+ String yaml = render(true, Set.of(
+ route(RESOURCE, PUBLIC),
+ route(RESOURCE + "/{id}/internal-api", INTERNAL),
+ route(RESOURCE + "/{id}/internal-api/admin", PRIVATE)), Set.of());
+
+ assertEquals(Map.of(
+ "public", List.of(RESOURCE + "/{*}/internal-api", RESOURCE + "/{*}/internal-api/admin"),
+ "private", List.of(RESOURCE + "/{*}/internal-api !" + RESOURCE + "/{*}/internal-api/admin")),
+ rules(yaml));
+ }
+
+ @Test
+ void literalSegmentBelowAVariableIsNotForbidden() throws Exception {
+ String yaml = render(true, Set.of(route(ORDER + "/{id}/items", PUBLIC), route(ORDER + "/all/items/x", PUBLIC)), Set.of());
+
+ assertEquals(List.of(ORDER + " !" + ORDER + "/all/items/x !" + ORDER + "/{*}/items"), rules(yaml).get("public"));
+ }
+
+ @Test
+ void forbiddingAnExposedPathIsAnError() {
+ Problems problems = new Problems();
+
+ render(false, problems, Set.of(route(RESOURCE, PUBLIC)), Set.of(forbidden(RESOURCE, PUBLIC)));
+
+ assertEquals(List.of("@ForbiddenRoute forbids " + RESOURCE + " on public-gateway, where a route with this gateway "
+ + "path is exposed"), problems.errors());
+ }
+
+ @Test
+ void explicitRuleDeniesItsPathBelowAWiderExposedRoute() throws Exception {
+ assertEquals(List.of("/api/v1/svc/admin"), rules(render(false,
+ Set.of(route("/api/v1/svc", PUBLIC)), Set.of(forbidden("/api/v1/svc/admin", PUBLIC)))).get("public"));
+ assertEquals(List.of("/api/v1/svc !/api/v1/svc/{*}", "/api/v1/svc/orders"), rules(render(false,
+ Set.of(route("/api/v1/svc/{tenantIdentifier}", PUBLIC)),
+ Set.of(forbidden("/api/v1/svc", PUBLIC, PRIVATE), forbidden("/api/v1/svc/orders", PUBLIC)))).get("public"));
+ }
+
+ @Test
+ void routesLegacyMatchesAForbiddenPathByAreExcluded() throws Exception {
+ assertEquals(List.of("/api/{*} !/api/v1/x/y"), rules(render(false,
+ Set.of(route("/api/v1/x/y", PUBLIC)), Set.of(forbidden("/api/{version}", PUBLIC)))).get("public"));
+ assertEquals(List.of("/api/{*} !/api/v1"), rules(render(false,
+ Set.of(route("/api/v1", PUBLIC)), Set.of(forbidden("/api/{version}", PUBLIC)))).get("public"));
+ }
+
+ @Test
+ void literalSiblingOfANarrowerVariableRouteIsExcludedIfLegacyRoutesItByItself() throws Exception {
+ String r = "/api/v1/svc/r";
+
+ assertEquals(List.of(r + "/{*} !" + r + "/list"), rules(render(true,
+ Set.of(route(r, PUBLIC), route(r + "/{i}", INTERNAL), route(r + "/list", PUBLIC)), Set.of())).get("public"));
+ assertEquals(Map.of("public", List.of(r + "/{*}"), "private", List.of(r + "/{*}")), rules(render(true,
+ Set.of(route(r, PUBLIC), route(r + "/{id}", INTERNAL), route(r + "/list", PUBLIC)), Set.of())));
+ assertEquals(List.of(r + "/{*}"), rules(render(true,
+ Set.of(route(r, PUBLIC), route(r + "/{itemId}", INTERNAL), route(r + "/list", PUBLIC)), Set.of())).get("public"));
+ }
+
+ @Test
+ void routesOfOneTemplateWithOtherVariableNamesAreOnePath() {
+ render(false, Set.of(route(ORDER, PUBLIC), route(ORDER + "/{id}", PUBLIC), route(ORDER + "/{orderId}", INTERNAL)),
+ Set.of());
+ }
+
+ @Test
+ void shortPrefixCutBeforeTheServiceSegmentIsNotChecked() throws Exception {
+ Set routes = Set.of(route("/api/{version}/svc/items", PUBLIC));
+ Problems problems = new Problems();
+
+ render(false, problems, routes, Set.of());
+
+ assertEquals(List.of("/api is not routed by legacy, but Istio routes it by PathPrefix /api cut from "
+ + "/api/{version}/svc/items on public-gateway, private-gateway: add @ForbiddenRoute({PUBLIC, PRIVATE}) "
+ + "to the element mapped to /api"), problems.errors());
+ List rule = List.of("/api !/api/{*}/svc/items");
+ assertEquals(Map.of("public", rule, "private", rule), rules(render(true, routes, Set.of())));
+ }
+
+ @Test
+ void shorterRouteLegacyMatchesACutPrefixByIsExcluded() throws Exception {
+ String order = "/api/v1/my-service/order";
+ String yaml = render(true, Set.of(route(order + "/{id}/items", PUBLIC), route("/{a}/{b}/{c}/{d}/{e}", PUBLIC)), Set.of());
+
+ assertEquals(List.of("/ !" + order + "/{*}/items !/{*}/{*}/{*}/{*}/{*}",
+ order + " !" + order + "/{*}/items !/{*}/{*}/{*}/{*}/{*}"),
+ rules(yaml).get("public"));
+ }
+
+ @Test
+ void cutMatchBelowAShorterForbiddenRouteNeedsARule() throws Exception {
+ List rule = List.of(ORDER + " !" + ORDER + "/{*}");
+ assertEquals(Map.of("public", rule, "private", rule), rules(render(true,
+ Set.of(route("/api/v1/svc", INTERNAL), route(ORDER + "/{id}", PUBLIC)), Set.of())));
+ }
+
+ @Test
+ void rootRuleDeniesItsSubtree() {
+ String yaml = render(true, Set.of(route("/{tenant}/items", PUBLIC)), Set.of());
+
+ assertTrue(yaml.contains("- \"/{**}\""), yaml);
+ assertFalse(yaml.contains("//"), yaml);
+ }
+
+ @Test
+ void pathBelowALongerForbiddenRouteKeepsItsRule() throws Exception {
+ assertEquals(List.of("/api/v1/svc/admin", "/api/v1/svc/admin/users"), rules(render(false,
+ Set.of(route("/api/v1/svc", PUBLIC), route("/api/v1/svc/admin", PRIVATE)),
+ Set.of(forbidden("/api/v1/svc/admin", PUBLIC), forbidden("/api/v1/svc/admin/users", PUBLIC)))).get("public"));
+ }
+
+ @Test
+ void partialSegmentVariableIsAnError() {
+ Problems problems = new Problems();
+
+ render(false, problems, Set.of(route("/files/{name}.txt", PUBLIC)), Set.of(forbidden("/files", PUBLIC, PRIVATE)));
+
+ assertEquals(List.of("/files/{name}.txt is a forbidden path or overlaps one, and an AuthorizationPolicy can't "
+ + "express it: variables must take up whole path segments"), problems.errors());
+ }
+
+ @Test
+ void partialSegmentVariableIsAnErrorInAutomaticMode() {
+ Problems problems = new Problems();
+
+ String yaml = render(true, problems, Set.of(route("/files/{name}.txt", PUBLIC)), Set.of());
+
+ assertEquals("", yaml);
+ assertEquals(List.of("/files/{name}.txt is a forbidden path or overlaps one, and an AuthorizationPolicy can't "
+ + "express it: variables must take up whole path segments"), problems.errors());
+ }
+
+ @Test
+ void allProblemsAreReported() {
+ Problems problems = new Problems();
+
+ render(false, problems, Set.of(
+ route(RESOURCE, PUBLIC),
+ route(RESOURCE + "/{id}/internal-api", INTERNAL),
+ route(ORDER + "/{id}/items", PUBLIC),
+ route("/files/{name}.txt", PUBLIC)),
+ Set.of(forbidden(RESOURCE, PRIVATE), forbidden("/files", PUBLIC, PRIVATE)));
+
+ List errors = problems.errors();
+ assertEquals(4, errors.size(), errors.toString());
+ assertTrue(errors.get(0).startsWith("@ForbiddenRoute forbids " + RESOURCE + " on private-gateway"), errors.toString());
+ assertTrue(errors.get(1).startsWith(ORDER + " is not routed by legacy"), errors.toString());
+ assertTrue(errors.get(2).startsWith(RESOURCE + "/{id}/internal-api is forbidden by legacy"), errors.toString());
+ assertTrue(errors.get(3).startsWith("/files/{name}.txt is a forbidden path"), errors.toString());
+ }
+
+ @Test
+ void customLabels() {
+ String yaml = new AuthorizationPolicyRenderer(Map.of("team", "platform"), false).generateAuthorizationPoliciesYaml(
+ Set.of(route(RESOURCE, PUBLIC)), Set.of(forbidden("/a", PUBLIC)), new Problems());
+
+ assertTrue(yaml.contains(" labels:\n team: \"platform\"\nspec:"), yaml);
+ assertTrue(yaml.contains("paths:\n - \"/a\"\n - \"/a/{**}\"\n"), yaml);
+ assertFalse(yaml.contains("notPaths"), yaml);
+ }
+}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoExecuteTest.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoExecuteTest.java
new file mode 100644
index 0000000000..92397b7c09
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoExecuteTest.java
@@ -0,0 +1,94 @@
+package com.netcracker.routes.gateway.plugin;
+
+import org.apache.maven.plugin.MojoFailureException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.File;
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Runs {@link GenerateRoutesMojo#execute()} on the controller sets in the {@code e2e} test packages.
+ */
+class GenerateRoutesMojoExecuteTest {
+
+ static final String E2E_PACKAGE = "com.netcracker.routes.gateway.plugin.e2e.";
+ static final String OUTPUT_FILE = "target/gateway-httproutes.yaml";
+
+ @TempDir
+ Path baseDir;
+
+ /**
+ * @return a Mojo with default parameters that scans the {@code e2e.} package
+ */
+ static GenerateRoutesMojo mojo(String controllerSet) throws Exception {
+ GenerateRoutesMojo mojo = new GenerateRoutesMojo();
+ set(mojo, "packages", new String[]{E2E_PACKAGE + controllerSet});
+ set(mojo, "servicePort", 8080);
+ set(mojo, "outputFile", OUTPUT_FILE);
+ set(mojo, "backendRefVal", "{{ .Values.SERVICE_NAME }}");
+ return mojo;
+ }
+
+ /**
+ * Runs the Mojo on the test classes directory. {@code MavenProject} can't be loaded in tests: maven-project 2.2.1
+ * needs classes that the maven-artifact version on the classpath doesn't have.
+ */
+ static void execute(GenerateRoutesMojo mojo, Path baseDir) throws Exception {
+ File classesDir = testClassesDir();
+ mojo.execute(baseDir, scanner -> scanner.collect(classesDir));
+ }
+
+ static void set(GenerateRoutesMojo mojo, String field, Object value) throws Exception {
+ Field f = GenerateRoutesMojo.class.getDeclaredField(field);
+ f.setAccessible(true);
+ f.set(mojo, value);
+ }
+
+ private static File testClassesDir() throws Exception {
+ return new File(GenerateRoutesMojoExecuteTest.class.getProtectionDomain().getCodeSource().getLocation().toURI());
+ }
+
+ static List kinds(String yaml) {
+ Matcher matcher = Pattern.compile("(?m)^kind: \"([^\"]+)\"$").matcher(yaml);
+ return matcher.results().map(m -> m.group(1)).toList();
+ }
+
+ @Test
+ void passingProjectWritesCombinedFileInOrder() throws Exception {
+ execute(mojo("forbidden"), baseDir);
+
+ String yaml = Files.readString(baseDir.resolve(OUTPUT_FILE));
+ assertTrue(yaml.startsWith("# -----"), yaml);
+ int guard = yaml.indexOf("{{- if eq .Values.SERVICE_MESH_TYPE \"Istio\" }}\n---\n");
+ assertTrue(guard > yaml.indexOf("DO NOT EDIT"), yaml);
+ assertTrue(yaml.endsWith("{{- end }}\n"), yaml);
+ assertEquals(List.of("HTTPRoute", "AuthorizationPolicy", "AuthorizationPolicy"), kinds(yaml));
+ assertTrue(yaml.indexOf("kind: \"HTTPRoute\"") < yaml.indexOf("kind: \"AuthorizationPolicy\""), yaml);
+ assertEquals(4, yaml.split("ports:\n - \"8080\"\n paths:", -1).length - 1, yaml);
+ assertFalse(yaml.contains("RegularExpression") || yaml.contains("MANUAL REVIEW"), yaml);
+ }
+
+ @Test
+ void validationFailureLeavesExistingFileUntouched() throws Exception {
+ Path file = baseDir.resolve(OUTPUT_FILE);
+ Files.createDirectories(file.getParent());
+ Files.writeString(file, "previous output\n");
+
+ // autoGenerateAuthorizationPolicies is false when it isn't configured, so the exposures are errors
+ MojoFailureException e = assertThrows(MojoFailureException.class, () -> execute(mojo("unforbidden"), baseDir));
+
+ assertEquals("2 route migration errors, see log", e.getMessage());
+ assertEquals("previous output\n", Files.readString(file));
+ }
+}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoTest.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoTest.java
index 81beca33a1..4f47e85ffb 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoTest.java
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/GenerateRoutesMojoTest.java
@@ -111,7 +111,7 @@ void testGetRequestMappingPaths_SpringTestController5() {
assertEquals(4, routes.size());
assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTES_3, HttpRoute.Type.PUBLIC)));
assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_1, RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_1, HttpRoute.Type.PUBLIC)));
- assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_2, RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_2, HttpRoute.Type.PUBLIC)));
+ assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_2, RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_2, HttpRoute.Type.INTERNAL)));
assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_3, RoutesTestConfiguration.CLASS_ROUTES_3 + RoutesTestConfiguration.METHOD_ROUTES_3, HttpRoute.Type.PRIVATE)));
}
}
@@ -225,7 +225,7 @@ void testGetRequestMappingPaths_SpringTestController8() {
assertEquals(3, routes.size());
assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTE_PATH_TO_1, RoutesTestConfiguration.CLASS_ROUTE_PATH_FROM_1, HttpRoute.Type.PUBLIC)));
- assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTE_PATH_TO_1 + RoutesTestConfiguration.METHOD_ROUTE_PATH_TO_1, RoutesTestConfiguration.CLASS_ROUTE_PATH_FROM_1 + RoutesTestConfiguration.METHOD_ROUTE_PATH_FROM_1, HttpRoute.Type.FACADE, 10_000)));
+ assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTE_PATH_TO_1 + RoutesTestConfiguration.METHOD_ROUTE_PATH_TO_1, RoutesTestConfiguration.CLASS_ROUTE_PATH_TO_1 + RoutesTestConfiguration.METHOD_ROUTE_PATH_TO_1, HttpRoute.Type.FACADE, 10_000)));
assertTrue(routes.contains(new HttpRoute(RoutesTestConfiguration.CLASS_ROUTE_PATH_TO_1 + RoutesTestConfiguration.METHOD_ROUTE_PATH_TO_2, RoutesTestConfiguration.CLASS_ROUTE_PATH_FROM_1 + RoutesTestConfiguration.METHOD_ROUTE_PATH_TO_2, HttpRoute.Type.PRIVATE, 20_000)));
}
}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/HttpRouteRendererTest.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/HttpRouteRendererTest.java
index 4c32ec5f1e..148d22bd7b 100644
--- a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/HttpRouteRendererTest.java
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/HttpRouteRendererTest.java
@@ -13,36 +13,74 @@
class HttpRouteRendererTest {
+ static HttpRoute route(String gatewayPath, String servicePath, HttpRoute.Type type, long timeout) {
+ return new HttpRoute(servicePath, gatewayPath, type, timeout);
+ }
+
+ static HttpRoute route(String gatewayPath, String servicePath, HttpRoute.Type type) {
+ return route(gatewayPath, servicePath, type, 0);
+ }
+
+ private static String render(Problems problems, HttpRoute... routes) {
+ return new HttpRouteRenderer("{{ CustomBackendRef }}").generateHttpRoutesYaml(8081, Set.of(routes), problems);
+ }
+
+ private static String render(HttpRoute... routes) {
+ Problems problems = new Problems();
+ String yaml = render(problems, routes);
+ assertEquals(List.of(), problems.errors());
+ return yaml;
+ }
+
+ /**
+ * @return the rules of the rendered HTTPRoutes, for example {@code public: PathPrefix /a -> /b 5s}
+ */
+ private static List rules(String yaml) {
+ List rules = new ArrayList<>();
+ String resource = null;
+ String rule = null;
+ for (String line : yaml.lines().map(String::trim).toList()) {
+ if (line.startsWith("name: \"{{ .Values.SERVICE_NAME }}-java-annotations-")) {
+ resource = line.substring(line.lastIndexOf('-') + 1, line.length() - 1);
+ } else if (line.startsWith("type: \"PathPrefix\"")) {
+ rule = resource + ": " + line.substring(7, line.length() - 1);
+ } else if (line.startsWith("value: ")) {
+ rule += " " + line.substring(8, line.length() - 1);
+ rules.add(rule);
+ } else if (line.startsWith("replacePrefixMatch: ")) {
+ rules.set(rules.size() - 1, rule + " -> " + line.substring(line.indexOf('"') + 1, line.length() - 1));
+ } else if (line.startsWith("request: ")) {
+ rules.set(rules.size() - 1, rules.get(rules.size() - 1) + " " + line.substring(10, line.length() - 1));
+ }
+ }
+ return rules;
+ }
+
@Test
void generatesYamlWithMatchesRewritesAndTimeouts() {
- Set routes = Set.of(
- new HttpRoute("/api", HttpRoute.Type.INTERNAL),
- new HttpRoute("/svc", "/gateway", HttpRoute.Type.PUBLIC, 5_000),
- new HttpRoute("/items/{id}", HttpRoute.Type.PRIVATE)
- );
-
- String yaml = new HttpRouteRenderer("{{ CustomBackendRef }}").generateHttpRoutesYaml(8081, routes);
+ String yaml = render(
+ route("/api", "/api", HttpRoute.Type.INTERNAL),
+ route("/gateway", "/svc", HttpRoute.Type.PUBLIC, 5_000),
+ route("/items/{id}", "/items/{id}", HttpRoute.Type.PRIVATE));
assertTrue(yaml.contains("HTTPRoute"));
assertTrue(yaml.contains("ReplacePrefixMatch"));
assertTrue(yaml.contains("request: \"5s\""));
- assertTrue(yaml.contains("RegularExpression"));
- assertTrue(yaml.contains("items/([^/]+)"));
+ assertTrue(yaml.contains("type: \"PathPrefix\"\n value: \"/items\"\n"), yaml);
+ assertFalse(yaml.contains("RegularExpression"));
assertTrue(yaml.contains("{{ CustomBackendRef }}"));
- assertTrue(yaml.contains("# MANUAL REVIEW REQUIRED"));
+ assertFalse(yaml.contains("MANUAL REVIEW"));
}
@Test
void replacesDefaultLabelsWhenCustomLabelsProvided() {
- Set routes = Set.of(new HttpRoute("/api", HttpRoute.Type.INTERNAL));
-
String yaml = new HttpRouteRenderer(
"{{ CustomBackendRef }}",
Map.of(
"team", "platform",
"app.kubernetes.io/managed-by", "custom-manager"
)
- ).generateHttpRoutesYaml(8081, routes);
+ ).generateHttpRoutesYaml(8081, Set.of(route("/api", "/api", HttpRoute.Type.INTERNAL)), new Problems());
assertTrue(yaml.contains("team:"));
assertTrue(yaml.contains("platform"));
@@ -52,33 +90,206 @@ void replacesDefaultLabelsWhenCustomLabelsProvided() {
assertFalse(yaml.contains("deployment.netcracker.com/sessionId:"));
}
+ @Test
+ void rendersOnePathPrefixRuleForRoutesCutToOnePrefix() {
+ String yaml = render(
+ route("/api/v1/svc/items", "/items", HttpRoute.Type.INTERNAL),
+ route("/api/v1/svc/items/{id}", "/items/{id}", HttpRoute.Type.INTERNAL));
+
+ assertEquals("""
+ apiVersion: "gateway.networking.k8s.io/v1"
+ kind: "HTTPRoute"
+ metadata:
+ name: "{{ .Values.SERVICE_NAME }}-java-annotations-internal"
+ labels:
+ app.kubernetes.io/managed-by: "{{ .Values.MANAGED_BY }}"
+ app.kubernetes.io/name: "{{ .Values.SERVICE_NAME }}"
+ app.kubernetes.io/part-of: "{{ .Values.APPLICATION_NAME }}"
+ app.kubernetes.io/processed-by-operator: "istiod"
+ deployer.cleanup/allow: "true"
+ deployment.netcracker.com/sessionId: "{{ .Values.DEPLOYMENT_SESSION_ID }}"
+ spec:
+ parentRefs:
+ - group: ""
+ kind: "Service"
+ name: "internal-gateway-service"
+ rules:
+ - matches:
+ - path:
+ type: "PathPrefix"
+ value: "/api/v1/svc/items"
+ filters:
+ - type: "URLRewrite"
+ urlRewrite:
+ path:
+ type: "ReplacePrefixMatch"
+ replacePrefixMatch: "/items"
+ backendRefs:
+ - group: ""
+ kind: "Service"
+ name: "{{ CustomBackendRef }}"
+ port: 8081
+ weight: 1
+ """, yaml.replace("---\n", ""));
+ }
+
+ @Test
+ void rendersResourcesInOrderPublicPrivateInternalFacade() {
+ String yaml = render(
+ route("/facade/items", "/items", HttpRoute.Type.FACADE),
+ route("/api/internal", "/api/internal", HttpRoute.Type.INTERNAL),
+ route("/api/private", "/api/private", HttpRoute.Type.PRIVATE),
+ route("/api/public", "/api/public", HttpRoute.Type.PUBLIC));
+
+ int publicAt = yaml.indexOf("-java-annotations-public\"");
+ int privateAt = yaml.indexOf("-java-annotations-private\"");
+ int internalAt = yaml.indexOf("-java-annotations-internal\"");
+ int facadeAt = yaml.indexOf("-java-annotations-facade\"");
+ assertTrue(0 <= publicAt && publicAt < privateAt && privateAt < internalAt && internalAt < facadeAt, yaml);
+ }
+
+ @Test
+ void serviceBoundRouteHasAllFacadeRulesAndOnlyTheServiceParentRef() {
+ String yaml = render(
+ route("/facade/items", "/items", HttpRoute.Type.FACADE),
+ route("/orders", "/orders", HttpRoute.Type.FACADE));
+
+ assertTrue(yaml.startsWith("---\napiVersion: \"gateway.networking.k8s.io/v1\"\nkind: \"HTTPRoute\"\nmetadata:\n"
+ + " name: \"{{ .Values.SERVICE_NAME }}-java-annotations-facade\"\n"), yaml);
+ assertTrue(yaml.contains("""
+ parentRefs:
+ - group: ""
+ kind: "Service"
+ name: "{{ .Values.SERVICE_NAME }}"
+ rules:
+ """), yaml);
+ assertEquals(1, yaml.split("kind: \"HTTPRoute\"", -1).length - 1, yaml);
+ assertTrue(yaml.contains("value: \"/facade/items\"") && yaml.contains("replacePrefixMatch: \"/items\""), yaml);
+ assertTrue(yaml.contains("value: \"/orders\"\n filters: []\n"), yaml);
+ }
+
+ @Test
+ void noServiceBoundRouteWithoutRewrite() {
+ String yaml = render(
+ route("/items", "/items", HttpRoute.Type.FACADE),
+ route("/api/public", "/api/public", HttpRoute.Type.PUBLIC));
+
+ assertFalse(yaml.contains("-facade"), yaml);
+ assertTrue(yaml.contains("-java-annotations-public"), yaml);
+ }
+
+ @Test
+ void renderingTwiceGivesIdenticalOutput() {
+ HttpRoute[] routes = {
+ route("/facade/items", "/items", HttpRoute.Type.FACADE),
+ route("/api/v1/svc/items", "/v1/items", HttpRoute.Type.PUBLIC),
+ route("/api/v1/svc/items/{id}", "/v2/items/{id}", HttpRoute.Type.PUBLIC),
+ route("/api/v1/svc/orders/{id}", "/orders/{id}", HttpRoute.Type.INTERNAL, 5_000),
+ route("/api/v1/svc/admin", "/admin", HttpRoute.Type.PRIVATE)};
+
+ assertEquals(render(routes), render(routes));
+ }
+
@Test
void sortsRulesByPathSpecificity() {
- List routes = new ArrayList<>(List.of(
- new HttpRoute("/alpha", HttpRoute.Type.INTERNAL),
- new HttpRoute("/alpha/bravo", HttpRoute.Type.INTERNAL),
- new HttpRoute("/alpha/bravo/charlie", HttpRoute.Type.INTERNAL)
- ));
+ List paths = new ArrayList<>(List.of("/alpha", "/alpha/bravo", "/alpha/bravo/charlie"));
- routes.sort(HttpRouteRenderer.pathSpecificityComparator());
+ paths.sort(HttpRouteRenderer.pathSpecificity());
- assertEquals("/alpha/bravo/charlie", routes.get(0).gatewayPath());
- assertEquals("/alpha/bravo", routes.get(1).gatewayPath());
- assertEquals("/alpha", routes.get(2).gatewayPath());
+ assertEquals(List.of("/alpha/bravo/charlie", "/alpha/bravo", "/alpha"), paths);
}
@Test
void sortsByLengthThenLexicalWhenSegmentsEqual() {
- List routes = new ArrayList<>(List.of(
- new HttpRoute("/aa/za", HttpRoute.Type.INTERNAL),
- new HttpRoute("/aa/ab", HttpRoute.Type.INTERNAL),
- new HttpRoute("/aa/abcd", HttpRoute.Type.INTERNAL)
- ));
+ List paths = new ArrayList<>(List.of("/aa/za", "/aa/ab", "/aa/abcd"));
+
+ paths.sort(HttpRouteRenderer.pathSpecificity());
+
+ assertEquals(List.of("/aa/abcd", "/aa/ab", "/aa/za"), paths);
+ }
+
+ @Test
+ void cutsGatewayAndServicePathsAtTheFirstVariable() {
+ assertEquals(List.of(
+ "public: PathPrefix /api",
+ "private: PathPrefix /api/v1/svc/items -> /items",
+ "private: PathPrefix /api/v1/svc -> /svc",
+ "internal: PathPrefix /files",
+ "internal: PathPrefix /"),
+ rules(render(
+ route("/api/{version}/svc/items", "/api/{version}/svc/items", HttpRoute.Type.PUBLIC),
+ route("/api/v1/svc/items/{id}/details", "/items/{id}/details", HttpRoute.Type.PRIVATE),
+ route("/api/v1/svc/{tenant}/x", "/svc/{tenant}/x", HttpRoute.Type.PRIVATE),
+ route("/files/{name}.txt", "/files/{name}.txt", HttpRoute.Type.INTERNAL),
+ route("/{id}", "/{id}", HttpRoute.Type.INTERNAL))));
+ }
+
+ @Test
+ void mergesRoutesCutToOnePrefixIntoTheWidestResource() {
+ Problems problems = new Problems();
+
+ String yaml = render(problems,
+ route("/api/v1/svc/resource", "/resource", HttpRoute.Type.PUBLIC),
+ route("/api/v1/svc/resource/{id}", "/resource/{id}", HttpRoute.Type.PRIVATE, 5_000),
+ route("/api/v1/svc/resource/{id}/internal-api/", "/resource/{id}/internal-api/", HttpRoute.Type.INTERNAL, 10_000),
+ route("/api/v1/svc/order/", "/order", HttpRoute.Type.INTERNAL),
+ route("/api/v1/svc/order/{id}", "/order/{id}", HttpRoute.Type.INTERNAL));
+
+ assertEquals(List.of(
+ "public: PathPrefix /api/v1/svc/resource -> /resource",
+ "internal: PathPrefix /api/v1/svc/order -> /order"),
+ rules(yaml));
+ assertEquals(List.of(), problems.errors());
+ assertEquals(List.of("Routes /api/v1/svc/resource (PUBLIC, ReplacePrefixMatch /resource), "
+ + "/api/v1/svc/resource/{id} (PRIVATE, ReplacePrefixMatch /resource, timeout 5s), "
+ + "/api/v1/svc/resource/{id}/internal-api/ (INTERNAL, ReplacePrefixMatch /resource, timeout 10s) "
+ + "are merged into one rule PathPrefix /api/v1/svc/resource with the largest timeout, the 2m default"),
+ problems.warnings());
+ }
+
+ @Test
+ void largestExplicitTimeoutWinsWhenNoRouteHasTheDefault() {
+ Problems problems = new Problems();
+
+ String yaml = render(problems,
+ route("/a", "/b", HttpRoute.Type.PUBLIC, 5_000),
+ route("/a/{id}", "/b/{id}", HttpRoute.Type.PUBLIC, 10_000));
+
+ assertEquals(List.of("public: PathPrefix /a -> /b 10s"), rules(yaml));
+ assertEquals(List.of("Routes /a (PUBLIC, ReplacePrefixMatch /b, timeout 5s), /a/{id} (PUBLIC, ReplacePrefixMatch /b, "
+ + "timeout 10s) are merged into one rule PathPrefix /a with the largest timeout 10s"), problems.warnings());
+ }
+
+ @Test
+ void explicitTimeoutFromTheDefaultUpWinsOverTheDefault() {
+ assertEquals(List.of("public: PathPrefix /a -> /b 5m"), rules(render(
+ route("/a", "/b", HttpRoute.Type.PUBLIC),
+ route("/a/{id}", "/b/{id}", HttpRoute.Type.PUBLIC, 300_000))));
+ assertEquals(List.of("public: PathPrefix /a -> /b 2m"), rules(render(
+ route("/a", "/b", HttpRoute.Type.PUBLIC),
+ route("/a/{id}", "/b/{id}", HttpRoute.Type.PUBLIC, 120_000))));
+ }
+
+ @Test
+ void differentRewritesForOnePrefixAreNotChecked() {
+ Problems problems = new Problems();
+
+ String yaml = render(problems,
+ route("/api/v1/svc/items/{id}", "/v1/items/{id}", HttpRoute.Type.PUBLIC),
+ route("/api/v1/svc/items/{id}/details", "/v2/items/{id}/details", HttpRoute.Type.INTERNAL));
+
+ assertEquals(List.of("public: PathPrefix /api/v1/svc/items -> /v1/items"), rules(yaml));
+ assertEquals(List.of(), problems.errors());
+ }
+
+ @Test
+ void facadeTimeoutsWithoutRewriteAreAWarning() {
+ Problems problems = new Problems();
- routes.sort(HttpRouteRenderer.pathSpecificityComparator());
+ String yaml = render(problems, route("/items", "/items", HttpRoute.Type.FACADE, 5_000));
- assertEquals("/aa/abcd", routes.get(0).gatewayPath());
- assertEquals("/aa/ab", routes.get(1).gatewayPath());
- assertEquals("/aa/za", routes.get(2).gatewayPath());
+ assertEquals("", yaml);
+ assertEquals(List.of("No facade or composite route has a rewrite, so no service-bound HTTPRoute is generated, "
+ + "and the timeouts of the facade and composite routes are not applied"), problems.warnings());
}
}
diff --git a/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/RouteMigrationE2ETest.java b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/RouteMigrationE2ETest.java
new file mode 100644
index 0000000000..30f63e42fa
--- /dev/null
+++ b/core-maven-plugins/httproutes-generator-maven-plugin/src/test/java/com/netcracker/routes/gateway/plugin/RouteMigrationE2ETest.java
@@ -0,0 +1,196 @@
+package com.netcracker.routes.gateway.plugin;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+import org.apache.maven.plugin.MojoFailureException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static com.netcracker.routes.gateway.plugin.GenerateRoutesMojoExecuteTest.OUTPUT_FILE;
+import static com.netcracker.routes.gateway.plugin.GenerateRoutesMojoExecuteTest.execute;
+import static com.netcracker.routes.gateway.plugin.GenerateRoutesMojoExecuteTest.mojo;
+import static com.netcracker.routes.gateway.plugin.GenerateRoutesMojoExecuteTest.set;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * End-to-end tests of the controller sets in the {@code e2e} test packages: the {@code @ForbiddenRoute} example of the
+ * plugin README with and without {@code @ForbiddenRoute}, and facade and composite routes.
+ */
+class RouteMigrationE2ETest {
+
+ private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());
+ private static final String RESOURCE = "/api/v1/my-service/resource";
+ private static final String ORDER = "/api/v1/my-service/order";
+
+ @TempDir
+ Path baseDir;
+
+ private String generate(String controllerSet, boolean auto) throws Exception {
+ GenerateRoutesMojo mojo = mojo(controllerSet);
+ set(mojo, "autoGenerateAuthorizationPolicies", auto);
+ execute(mojo, baseDir);
+ return Files.readString(baseDir.resolve(OUTPUT_FILE));
+ }
+
+ /**
+ * @return the YAML documents of the output file, without the header and the Helm guard
+ */
+ @SuppressWarnings("unchecked")
+ private static List> documents(String yaml) throws Exception {
+ String body = yaml.lines().filter(l -> !l.startsWith("#") && !l.startsWith("{{-")).collect(Collectors.joining("\n"));
+ List> documents = new ArrayList<>();
+ try (var values = YAML.readerFor(Map.class).readValues(body)) {
+ while (values.hasNext()) {
+ documents.add((Map) values.next());
+ }
+ }
+ return documents;
+ }
+
+ @SuppressWarnings("unchecked")
+ private static T at(Object node, Object... path) {
+ Object current = node;
+ for (Object key : path) {
+ current = key instanceof Integer i ? ((List) current).get(i) : ((Map) current).get(key);
+ }
+ return (T) current;
+ }
+
+ private static Map> byName(List> documents) {
+ Map> result = new LinkedHashMap<>();
+ documents.forEach(d -> result.put(at(d, "metadata", "name"), d));
+ return result;
+ }
+
+ /**
+ * @return the rules of an HTTPRoute, for example {@code PathPrefix /a -> ReplacePrefixMatch /b}
+ */
+ private static List httpRouteRules(Map route) {
+ List> rules = at(route, "spec", "rules");
+ return rules.stream().map(rule -> {
+ String match = at(rule, "matches", 0, "path", "type") + " " + at(rule, "matches", 0, "path", "value");
+ List> filters = at(rule, "filters");
+ if (filters.isEmpty()) {
+ return match;
+ }
+ Map rewrite = at(filters.get(0), "urlRewrite", "path");
+ return match + " -> " + rewrite.get("type") + " " + rewrite.get("replacePrefixMatch");
+ }).toList();
+ }
+
+ /**
+ * @return the paths and notPaths of each rule of an AuthorizationPolicy
+ */
+ private static List>> policyRules(Map policy) {
+ List> rules = at(policy, "spec", "rules");
+ return rules.stream().map(rule -> {
+ Map operation = at(rule, "to", 0, "operation");
+ List notPaths = operation.containsKey("notPaths") ? at(operation, "notPaths") : List.of();
+ return List.of(at(operation, "paths"), notPaths);
+ }).toList();
+ }
+
+ private static final String NAME = "{{ .Values.SERVICE_NAME }}-java-annotations-";
+
+ private static List>> expectedOrderRule() {
+ return List.of(List.of(List.of(ORDER, ORDER + "/{**}"), List.of(ORDER + "/{*}/items", ORDER + "/{*}/items/{**}")));
+ }
+
+ private static List