How to expose the OpenAPI specification for a secured RESTful app?

[nedelva]

I want to generate and expose the OpenAPI specification, so I started by reading Visualize with Swagger-UI an OpenAPI specification of your Micronaut Application Guide written by @sdelamo.

I went through the steps up to the point of adding and running the OpenApiExposedTest when I got stuck, because my application is secured, and the test failed with

OpenApiExposedTest.openApi:19 Unexpected exception thrown: io.micronaut.http.client.exceptions.HttpClientResponseException: Unauthorized

I could not find a way to tell the generator that I want unrestricted access to the /swagger/** path.

Things I tried without success:

1. Adding the following section in the application.yaml file:

micronaut:
  security:
    enabled: true
    intercept-url-map:
      - pattern: /swagger/**
        http-method: GET
        access: IS_ANONYMOUS

2. Creating a custom HTTP Filter:

import io.micronaut.http.HttpRequest;
import io.micronaut.http.MutableHttpResponse;
import io.micronaut.http.annotation.Filter;
import io.micronaut.http.filter.ServerFilterChain;
import io.micronaut.security.config.SecurityConfiguration;
import io.micronaut.security.filters.AuthenticationFetcher;
import io.micronaut.security.filters.SecurityFilter;
import io.micronaut.security.rules.SecurityRule;
import org.reactivestreams.Publisher;

import java.util.Collection;

@Filter("/swagger/**") 
public class SwaggerSecurityFilter extends SecurityFilter {

    /**
     * @param securityRules          The list of security rules that will allow or reject the request
     * @param authenticationFetchers List of {@link AuthenticationFetcher} beans in the context.
     * @param securityConfiguration  The security configuration
     */
    public SwaggerSecurityFilter(Collection<SecurityRule<HttpRequest<?>>> securityRules, Collection<AuthenticationFetcher<HttpRequest<?>>> authenticationFetchers, SecurityConfiguration securityConfiguration) {
        super(securityRules, authenticationFetchers, securityConfiguration);
    }

    @Override
    public Publisher<MutableHttpResponse<?>> doFilter(HttpRequest<?> request, ServerFilterChain chain) {
        //presumably this should skip all security checks
        return chain.proceed(request);
    }
}

How can this be accomplished ?

[altro3]

@nedelva Hi! This section on GitHub is viewed very rarely. If you have questions, suggestions or problems, then it is better to write in Discord or create an issue here: https://github.com/micronaut-projects/micronaut-openapi/issues

So, I understood what you are doing, but I can immediately say that at the moment micronaut-openapi does not process filters.

I suggest doing this: Create a ticket here: https://github.com/micronaut-projects/micronaut-openapi/issues
, reformulate your question into a sentence and clearly describe what you are doing and what you expect to see.

And also: please attach a small reproducer application so that I can help you faster

[sdelamo]

@nedelva you should use intercept url map.