feat: security integration and tests

docs/modules/onecx-welcome-svc/pages/onecx-welcome-svc-docs.adoc

@@ -12,6 +12,10 @@ quarkus.datasource.db-kind=postgresql
 quarkus.datasource.jdbc.max-size=30
 quarkus.datasource.jdbc.min-size=10
 quarkus.hibernate-orm.jdbc.timezone=UTC
+quarkus.http.auth.permission.health.paths=/q/*
+quarkus.http.auth.permission.health.policy=permit
+quarkus.http.auth.permission.default.paths=/*
+quarkus.http.auth.permission.default.policy=authenticated
 quarkus.banner.enabled=false
 quarkus.hibernate-orm.database.generation=validate
 quarkus.hibernate-orm.multitenant=DISCRIMINATOR
@@ -49,5 +53,12 @@ app:
     repository: "onecx/onecx-welcome-svc"
   db:
     enabled: true
+  operator:
+    keycloak:
+      client:
+        enabled: true
+        spec:
+          kcConfig:
+            defaultClientScopes: [ ocx-wc:read ]
 ----
 

docs/modules/onecx-welcome-svc/pages/onecx-welcome-svc-extensions.adoc

@@ -11,129 +11,147 @@ h| Version
 | tkit-quarkus-jpa
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-jpa.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-jpa.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-jpa.adoc[Link]
+| 2.27.0
 
 | tkit-quarkus-log-cdi
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-log-cdi.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-cdi.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-cdi.adoc[Link]
+| 2.27.0
 
 | tkit-quarkus-log-rs
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-log-rs.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-rs.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-rs.adoc[Link]
+| 2.27.0
 
 | tkit-quarkus-log-json
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-log-json.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-json.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-json.adoc[Link]
+| 2.27.0
 
 | tkit-quarkus-rest
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-rest.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-rest.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-rest.adoc[Link]
+| 2.27.0
 
 | onecx-tenant
 
 | https://onecx.github.io/docs/onecx-quarkus/current/onecx-quarkus/onecx-tenant.html[Link]
-| https://github.com/onecx/onecx-quarkus/blob/0.18.0/docs/modules/onecx-quarkus/pages/includes/onecx-tenant.adoc[Link]
-| 0.18.0
+| https://github.com/onecx/onecx-quarkus/blob/0.22.0/docs/modules/onecx-quarkus/pages/includes/onecx-tenant.adoc[Link]
+| 0.22.0
 
 | tkit-quarkus-jpa-tenant
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-jpa-tenant.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-jpa-tenant.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-jpa-tenant.adoc[Link]
+| 2.27.0
 
 | tkit-quarkus-rest-context
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-rest-context.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.22.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-rest-context.adoc[Link]
-| 2.22.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-rest-context.adoc[Link]
+| 2.27.0
 
 | quarkus-arc
 
 | https://quarkus.io/guides/cdi-reference[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-arc.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-liquibase
 
 | https://quarkus.io/guides/liquibase[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-liquibase.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-smallrye-health
 
 | https://quarkus.io/guides/smallrye-health[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-smallrye-health.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-micrometer-registry-prometheus
 
 | https://quarkus.io/guides/telemetry-micrometer[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-micrometer-registry-prometheus.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-hibernate-orm
 
 | https://quarkus.io/guides/hibernate-orm[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-hibernate-orm.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-rest
 
 | https://quarkus.io/guides/rest[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-rest.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-rest-jackson
 
 | https://quarkus.io/guides/rest-json[Link]
 | 
-| 3.9.4
+| 3.12.0
 
 | quarkus-jdbc-postgresql
 
 | https://quarkus.io/guides/datasource[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-jdbc-postgresql.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-smallrye-openapi
 
 | https://quarkus.io/guides/openapi-swaggerui[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-smallrye-openapi.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-hibernate-validator
 
 | https://quarkus.io/guides/validation[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-hibernate-validator.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 | quarkus-opentelemetry
 
 | https://quarkus.io/guides/opentelemetry[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-opentelemetry.adoc[Link]
-| 3.9.4
+| 3.12.0
+
+| quarkus-oidc
+
+| https://quarkus.io/guides/security-oidc-bearer-token-authentication-tutorial[Link]
+| https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-oidc.adoc[Link]
+| 3.12.0
+
+| tkit-quarkus-security
+
+| https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-security.html[Link]
+| https://github.com/1000kit/tkit-quarkus/blob/2.27.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-security.adoc[Link]
+| 2.27.0
 
 | onecx-core
 
 | https://onecx.github.io/docs/onecx-quarkus/current/onecx-quarkus/onecx-core.html[Link]
 | 
-| 0.18.0
+| 0.22.0
 
 | quarkus-container-image-docker
 
 | https://quarkus.io/guides/container-image[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-container-image-docker.adoc[Link]
-| 3.9.4
+| 3.12.0
 
 
+| onecx-security
+
+| 
+| 
+| 0.22.0
+
 
 |===

pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.tkit.onecx</groupId>
         <artifactId>onecx-quarkus3-parent</artifactId>
-        <version>0.53.0</version>
+        <version>0.54.0</version>
     </parent>
 
     <artifactId>onecx-welcome-svc</artifactId>
@@ -35,6 +35,10 @@
             <groupId>org.tkit.quarkus.lib</groupId>
             <artifactId>tkit-quarkus-rest</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.tkit.onecx.quarkus</groupId>
+            <artifactId>onecx-security</artifactId>
+        </dependency>
 
         <!-- TENANT -->
         <dependency>
@@ -99,6 +103,10 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-opentelemetry</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-oidc</artifactId>
+        </dependency>
 
         <!-- OTHER -->
         <dependency>
@@ -131,6 +139,11 @@
             <artifactId>tkit-quarkus-test-db-import</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.tkit.quarkus.lib</groupId>
+            <artifactId>tkit-quarkus-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
@@ -148,6 +161,7 @@
                     <generateSupportingFiles>false</generateSupportingFiles>
                     <addCompileSourceRoot>true</addCompileSourceRoot>
                     <library>quarkus</library>
+                    <additionalProperties>onecx-scopes=true</additionalProperties>
                     <configOptions>
                         <sourceFolder>/</sourceFolder>
                         <openApiNullable>false</openApiNullable>

src/main/docker/Dockerfile.jvm

@@ -1,4 +1,4 @@
-FROM ghcr.io/onecx/docker-quarkus-jvm:0.7.0
+FROM ghcr.io/onecx/docker-quarkus-jvm:0.8.0
 
 COPY --chown=185 target/quarkus-app/lib/ /deployments/lib/
 COPY --chown=185 target/quarkus-app/*.jar /deployments/

src/main/docker/Dockerfile.native

@@ -1,3 +1,3 @@
-FROM ghcr.io/onecx/docker-quarkus-native:0.5.0
+FROM ghcr.io/onecx/docker-quarkus-native:0.6.0
 
 COPY --chown=1001:root target/*-runner /work/application

src/main/helm/values.yaml

@@ -3,4 +3,11 @@ app:
   image:
     repository: "onecx/onecx-welcome-svc"
   db:
-    enabled: true
+    enabled: true
+  operator:
+    keycloak:
+      client:
+        enabled: true
+        spec:
+          kcConfig:
+            defaultClientScopes: [ ocx-wc:read ]

src/main/openapi/onecx-welcome-internal-openapi.yaml

@@ -10,6 +10,8 @@ tags:
 paths:
   /internal/images/info/{id}:
     get:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:read ]
       tags:
         - imagesInternal
       description: get Image information by id
@@ -26,6 +28,8 @@ paths:
         "404":
           description: NOT FOUND
     put:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:write ]
       tags:
         - imagesInternal
       description: update Image information
@@ -52,6 +56,8 @@ paths:
               schema:
                 $ref: '#/components/schemas/ProblemDetailResponse'
     delete:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:delete ]
       tags:
         - imagesInternal
       description: delete image information
@@ -65,6 +71,8 @@ paths:
           description: NOT FOUND
   /internal/images/info:
     post:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:write ]
       tags:
         - imagesInternal
       description: create image info
@@ -90,6 +98,8 @@ paths:
                 $ref: '#/components/schemas/ProblemDetailResponse'
   /internal/images/{workspaceName}/info:
     get:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:read ]
       tags:
         - imagesInternal
       description: get all existing image-infos
@@ -111,6 +121,8 @@ paths:
                   $ref: '#/components/schemas/ImageInfo'
   /internal/images:
     post:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:write ]
       tags:
         - imagesInternal
       description: create image
@@ -144,6 +156,8 @@ paths:
                 $ref: '#/components/schemas/ProblemDetailResponse'
   /internal/images/{id}:
     get:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:read ]
       tags:
         - imagesInternal
       description: get Image by id
@@ -160,6 +174,8 @@ paths:
         "404":
           description: NOT FOUND
     put:
+      security:
+        - oauth2: [ ocx-wc:all, ocx-wc:write ]
       tags:
         - imagesInternal
       description: update Image by id
@@ -193,6 +209,17 @@ paths:
               schema:
                 $ref: '#/components/schemas/ProblemDetailResponse'
 components:
+  securitySchemes:
+    oauth2:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: https://oauth.simple.api/token
+          scopes:
+            ocx-wc:all: Grants access to all operations
+            ocx-wc:read: Grants read access
+            ocx-wc:write: Grants write access
+            ocx-wc:delete: Grants access to delete operations
   schemas:
     ImageDataResponse:
       type: object