Package dev.dokimos.server.filter

Class ApiKeyAuthFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.web.filter.OncePerRequestFilter
dev.dokimos.server.filter.ApiKeyAuthFilter
All Implemented Interfaces:
jakarta.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware
@Component public class ApiKeyAuthFilter extends org.springframework.web.filter.OncePerRequestFilter
Servlet filter that authenticates /api/v1/** by delegating credential resolution to an Authenticator, then enforces role-based authorization on the resolved Principal.

Authorization is additive over the existing seam. Reads pass through (the authenticator returns a principal for them). Write methods (POST, PUT, PATCH, DELETE) require Role.EDITOR or higher. The API key management endpoints under /api/v1/api-keys require Role.ADMIN. In an unauthenticated deployment the authenticator resolves every request to the system principal, which is ADMIN, so these checks are satisfied and behavior is unchanged.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    API_KEYS_PATH_PREFIX
    Path prefix for the API key management endpoints, which require ADMIN.
    static final String
    PRINCIPAL_ATTRIBUTE
    Request attribute holding the authenticated Principal.

    Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

    ALREADY_FILTERED_SUFFIX

  • Constructor Summary

    Constructors
    Constructor
    Description
    ApiKeyAuthFilter(Authenticator authenticator, com.fasterxml.jackson.databind.ObjectMapper objectMapper)
     

  • Method Summary

    Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

    doFilter

    Methods inherited from class org.springframework.web.filter.GenericFilterBean

    afterPropertiesSet, destroy, getEnvironment, getFilterConfig, init, setBeanName, setEnvironment, setServletContext

    Methods inherited from class java.lang.Object

    equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • PRINCIPAL_ATTRIBUTE

      public static final String PRINCIPAL_ATTRIBUTE
      Request attribute holding the authenticated Principal.
      See Also:

    • API_KEYS_PATH_PREFIX

      public static final String API_KEYS_PATH_PREFIX
      Path prefix for the API key management endpoints, which require ADMIN.
      See Also:

  • Constructor Details

    • ApiKeyAuthFilter

      public ApiKeyAuthFilter(Authenticator authenticator, com.fasterxml.jackson.databind.ObjectMapper objectMapper)