Refactor AdditionalWebFilter load

Signed-off-by: John Niang <[email protected]>

application/src/main/java/run/halo/app/config/WebFluxConfig.java

@@ -8,13 +8,16 @@
 import static run.halo.app.infra.utils.FileUtils.checkDirectoryTraversal;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import io.micrometer.observation.ObservationRegistry;
 import java.util.List;
 import java.util.Objects;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.autoconfigure.web.WebProperties;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.CacheControl;
 import org.springframework.http.HttpMethod;
 import org.springframework.http.MediaType;
@@ -24,6 +27,7 @@
 import org.springframework.http.codec.json.Jackson2JsonDecoder;
 import org.springframework.http.codec.json.Jackson2JsonEncoder;
 import org.springframework.lang.NonNull;
+import org.springframework.security.web.server.ObservationWebFilterChainDecorator;
 import org.springframework.web.reactive.config.ResourceHandlerRegistration;
 import org.springframework.web.reactive.config.ResourceHandlerRegistry;
 import org.springframework.web.reactive.config.WebFluxConfigurer;
@@ -40,6 +44,8 @@
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.core.extension.endpoint.CustomEndpointsBuilder;
 import run.halo.app.infra.properties.HaloProperties;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+import run.halo.app.webfilter.AdditionalWebFilterChainProxy;
 
 @Configuration
 public class WebFluxConfig implements WebFluxConfigurer {
@@ -200,4 +206,28 @@ ProxyFilter consoleProxyFilter() {
     ProxyFilter ucProxyFilter() {
         return new ProxyFilter("/uc/**", haloProp.getUc().getProxy());
     }
+
+    /**
+     * Create a WebFilterChainProxy for all AdditionalWebFilters.
+     *
+     * <p>The reason why the order is -101 is that the current
+     * AdditionalWebFilterChainProxy should be executed before WebFilterChainProxy
+     * and the order of WebFilterChainProxy is -100.
+     *
+     * <p>See {@code org.springframework.security.config.annotation.web.reactive
+     * .WebFluxSecurityConfiguration#WEB_FILTER_CHAIN_FILTER_ORDER} for more
+     *
+     * @param extensionGetter extension getter.
+     * @return additional web filter chain proxy.
+     */
+    @Bean
+    @Order(-101)
+    AdditionalWebFilterChainProxy additionalWebFilterChainProxy(ExtensionGetter extensionGetter,
+        ObjectProvider<ObservationRegistry> observationRegistry) {
+        var chainProxy = new AdditionalWebFilterChainProxy(extensionGetter);
+        observationRegistry.ifUnique(registry ->
+            chainProxy.setFilterChainDecorator(new ObservationWebFilterChainDecorator(registry))
+        );
+        return chainProxy;
+    }
 }

application/src/main/java/run/halo/app/config/WebServerSecurityConfig.java

@@ -32,7 +32,6 @@
 import run.halo.app.infra.properties.HaloProperties;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 import run.halo.app.security.DefaultUserDetailService;
-import run.halo.app.security.DynamicMatcherSecurityWebFilterChain;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.login.CryptoService;
 import run.halo.app.security.authentication.login.PublicKeyRouteBuilder;
@@ -92,7 +91,7 @@ SecurityWebFilterChain apiFilterChain(ServerHttpSecurity http,
         // Integrate with other configurers separately
         securityConfigurers.orderedStream()
             .forEach(securityConfigurer -> securityConfigurer.configure(http));
-        return new DynamicMatcherSecurityWebFilterChain(extensionGetter, http.build());
+        return http.build();
     }
 
     @Bean

application/src/main/java/run/halo/app/webfilter/AdditionalWebFilterChainProxy.java

@@ -0,0 +1,35 @@
+package run.halo.app.webfilter;
+
+import lombok.Setter;
+import org.springframework.core.annotation.AnnotationAwareOrderComparator;
+import org.springframework.security.web.server.WebFilterChainProxy;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.WebFilterChain;
+import reactor.core.publisher.Mono;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+import run.halo.app.security.AdditionalWebFilter;
+
+public class AdditionalWebFilterChainProxy implements WebFilter {
+
+    private final ExtensionGetter extensionGetter;
+
+    @Setter
+    private WebFilterChainProxy.WebFilterChainDecorator filterChainDecorator;
+
+    public AdditionalWebFilterChainProxy(ExtensionGetter extensionGetter) {
+        this.extensionGetter = extensionGetter;
+        this.filterChainDecorator = new WebFilterChainProxy.DefaultWebFilterChainDecorator();
+    }
+
+    @Override
+    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
+        return extensionGetter.getEnabledExtensionByDefinition(AdditionalWebFilter.class)
+            .sort(AnnotationAwareOrderComparator.INSTANCE)
+            .cast(WebFilter.class)
+            .collectList()
+            .map(filters -> filterChainDecorator.decorate(chain, filters))
+            .flatMap(decoratedChain -> decoratedChain.filter(exchange));
+    }
+
+}

ui/.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-cd console && pnpm exec lint-staged
+cd ui && pnpm exec lint-staged