[spring-boot]: generate PreAuthorize from OpenAPI security scopes

bin/configs/spring-boot-pre-authorize.yaml

@@ -0,0 +1,11 @@
+generatorName: spring
+outputDir: samples/server/others/springboot-pre-authorize
+library: spring-boot
+inputSpec: modules/openapi-generator/src/test/resources/3_0/spring/preauthorize-scopes.yaml
+templateDir: modules/openapi-generator/src/main/resources/JavaSpring
+additionalProperties:
+  documentationProvider: none
+  annotationLibrary: none
+  useSwaggerUI: "false"
+  useSpringSecurityPreAuthorize: "true"
+  hideGenerationTimestamp: "true"

docs/generators/java-camel.md

@@ -105,6 +105,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 |sortParamsByRequiredFlag|Sort method arguments to place required parameters before optional parameters.| |true|
 |sourceFolder|source folder for generated code| |src/main/java|
 |springApiVersion|Value for 'version' attribute in @RequestMapping (for Spring 7 and above).| |null|
+|springSecurityAuthorityPrefix|Prefix added to OAuth2/OpenID Connect scopes when generating Spring Security authorities.| |SCOPE_|
 |substituteGenericPagedModel|Detect schemas that represent paginated responses (an object with a 'content' array property and a 'page' pagination-metadata property) and replace their generated references with PagedModel<T>. By default this uses a generated type in the config package (default 'org.openapitools.configuration'), but `importMappings.PagedModel` can override it to a custom/FQCN-mapped type. The detected page schemas and the pagination metadata schema are suppressed from code generation.| |false|
 |testOutput|Set output folder for models and APIs tests| |${project.build.directory}/generated-test-sources/openapi|
 |title|server title name or client service name| |OpenAPI Spring|
@@ -127,6 +128,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 |useSpringBoot4|Generate code and provide dependencies for use with Spring Boot 4.x. (Use jakarta instead of javax in imports). Enabling this option will also enable `useJakartaEe`.| |false|
 |useSpringBuiltInValidation|Disable `@Validated` at the class level when using built-in validation.| |false|
 |useSpringController|Annotate the generated API as a Spring Controller| |false|
+|useSpringSecurityPreAuthorize|Generate Spring Security @PreAuthorize annotations from OAuth2/OpenID Connect security scopes.| |false|
 |useSwaggerUI|Open the OpenApi specification in swagger-ui. Will also import and configure needed dependencies| |true|
 |useTags|use tags for creating interface and controller classnames| |false|
 |virtualService|Generates the virtual service. For more details refer - https://github.com/virtualansoftware/virtualan/wiki| |false|

docs/generators/spring.md

@@ -98,6 +98,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 |sortParamsByRequiredFlag|Sort method arguments to place required parameters before optional parameters.| |true|
 |sourceFolder|source folder for generated code| |src/main/java|
 |springApiVersion|Value for 'version' attribute in @RequestMapping (for Spring 7 and above).| |null|
+|springSecurityAuthorityPrefix|Prefix added to OAuth2/OpenID Connect scopes when generating Spring Security authorities.| |SCOPE_|
 |substituteGenericPagedModel|Detect schemas that represent paginated responses (an object with a 'content' array property and a 'page' pagination-metadata property) and replace their generated references with PagedModel<T>. By default this uses a generated type in the config package (default 'org.openapitools.configuration'), but `importMappings.PagedModel` can override it to a custom/FQCN-mapped type. The detected page schemas and the pagination metadata schema are suppressed from code generation.| |false|
 |testOutput|Set output folder for models and APIs tests| |${project.build.directory}/generated-test-sources/openapi|
 |title|server title name or client service name| |OpenAPI Spring|
@@ -120,6 +121,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 |useSpringBoot4|Generate code and provide dependencies for use with Spring Boot 4.x. (Use jakarta instead of javax in imports). Enabling this option will also enable `useJakartaEe`.| |false|
 |useSpringBuiltInValidation|Disable `@Validated` at the class level when using built-in validation.| |false|
 |useSpringController|Annotate the generated API as a Spring Controller| |false|
+|useSpringSecurityPreAuthorize|Generate Spring Security @PreAuthorize annotations from OAuth2/OpenID Connect security scopes.| |false|
 |useSwaggerUI|Open the OpenApi specification in swagger-ui. Will also import and configure needed dependencies| |true|
 |useTags|use tags for creating interface and controller classnames| |false|
 |virtualService|Generates the virtual service. For more details refer - https://github.com/virtualansoftware/virtualan/wiki| |false|

modules/openapi-generator/src/main/java/org/openapitools/codegen/languages/SpringCodegen.java

@@ -24,6 +24,8 @@
 import io.swagger.v3.oas.models.media.MediaType;
 import io.swagger.v3.oas.models.media.Schema;
 import io.swagger.v3.oas.models.servers.Server;
+import io.swagger.v3.oas.models.security.SecurityRequirement;
+import io.swagger.v3.oas.models.security.SecurityScheme;
 import io.swagger.v3.oas.models.tags.Tag;
 import io.swagger.v3.parser.util.SchemaTypeUtil;
 import lombok.Getter;
@@ -123,6 +125,8 @@ public class SpringCodegen extends AbstractJavaCodegen
     public static final String GENERATE_PAGEABLE_CONSTRAINT_VALIDATION = "generatePageableConstraintValidation";
     public static final String SUBSTITUTE_GENERIC_PAGED_MODEL = "substituteGenericPagedModel";
     public static final String CLIENT_REGISTRATION_ID = "clientRegistrationId";
+    public static final String USE_SPRING_SECURITY_PRE_AUTHORIZE = "useSpringSecurityPreAuthorize";
+    public static final String SPRING_SECURITY_AUTHORITY_PREFIX = "springSecurityAuthorityPrefix";
 
     @Getter
     public enum RequestMappingMode {
@@ -199,6 +203,9 @@ public enum RequestMappingMode {
     @Setter protected boolean substituteGenericPagedModel = false;
     @Getter @Setter
     protected String clientRegistrationId = null;
+    @Setter protected boolean useSpringSecurityPreAuthorize = false;
+    @Getter @Setter
+    protected String springSecurityAuthorityPrefix = "SCOPE_";
     @Setter protected boolean useEnumValueInterface = false;
     private String valuedEnumClassName = "ValuedEnum";
 
@@ -347,6 +354,12 @@ public SpringCodegen() {
         );
         cliOptions.add(CliOption.newBoolean(USE_JSPECIFY, "Use Jspecify for null checks", useJspecify));
         cliOptions.add(CliOption.newString(CLIENT_REGISTRATION_ID, "Client registration ID for OAuth2 in Spring HTTP Interface (@ClientRegistrationId annotation). Requires library=spring-http-interface and useSpringBoot4=true (Spring Security 7)."));
+        cliOptions.add(CliOption.newBoolean(USE_SPRING_SECURITY_PRE_AUTHORIZE,
+                "Generate Spring Security @PreAuthorize annotations from OAuth2/OpenID Connect security scopes.",
+                useSpringSecurityPreAuthorize));
+        cliOptions.add(CliOption.newString(SPRING_SECURITY_AUTHORITY_PREFIX,
+                "Prefix added to OAuth2/OpenID Connect scopes when generating Spring Security authorities.",
+                springSecurityAuthorityPrefix));
         supportedLibraries.put(SPRING_BOOT, "Spring-boot Server application.");
         supportedLibraries.put(SPRING_CLOUD_LIBRARY,
                 "Spring-Cloud-Feign client with Spring-Boot auto-configured settings.");
@@ -573,6 +586,8 @@ public void processOpts() {
         convertPropertyToBooleanAndWriteBack(USE_SPRING_BUILT_IN_VALIDATION, this::setUseSpringBuiltInValidation);
         convertPropertyToBooleanAndWriteBack(CodegenConstants.USE_DEDUCTION_FOR_ONE_OF_INTERFACES, this::setUseDeductionForOneOfInterfaces);
         convertPropertyToStringAndWriteBack(CLIENT_REGISTRATION_ID, this::setClientRegistrationId);
+        convertPropertyToBooleanAndWriteBack(USE_SPRING_SECURITY_PRE_AUTHORIZE, this::setUseSpringSecurityPreAuthorize);
+        convertPropertyToStringAndWriteBack(SPRING_SECURITY_AUTHORITY_PREFIX, this::setSpringSecurityAuthorityPrefix);
 
         additionalProperties.put("springHttpStatus", new SpringHttpStatusLambda());
 
@@ -592,6 +607,10 @@ public void processOpts() {
                 throw new IllegalArgumentException(CLIENT_REGISTRATION_ID + " requires " + USE_SPRING_BOOT4 + "=true because @ClientRegistrationId is provided by Spring Security 7");
             }
         }
+        if (useSpringSecurityPreAuthorize && !SPRING_BOOT.equals(library)) {
+            throw new IllegalArgumentException(USE_SPRING_SECURITY_PRE_AUTHORIZE
+                    + " is only supported with the " + SPRING_BOOT + " library");
+        }
 
         if (isUseSpringBoot3() || isUseSpringBoot4()) {
             if (AnnotationLibrary.SWAGGER1.equals(getAnnotationLibrary())) {
@@ -1029,6 +1048,10 @@ public void setIsVoid(boolean isVoid) {
                 normalizeVendorExtensionWithStringList(operation.vendorExtensions, VendorExtension.X_OPERATION_EXTRA_ANNOTATION.getName());
                 normalizeOperationParameterVendorExtensions(operation, VendorExtension.X_FIELD_EXTRA_ANNOTATION.getName());
 
+                if (useSpringSecurityPreAuthorize) {
+                    addSpringSecurityPreAuthorize(operation);
+                }
+
                 if (isLibrary(SPRING_HTTP_INTERFACE) || isLibrary(SPRING_BOOT)) {
                     if (operation.isArray && "string".equalsIgnoreCase(operation.returnBaseType)) {
                         operation.vendorExtensions.put(VendorExtension.X_REACTIVE_RETURN_EXCEPT_LIST_OF_STRING.getName(), true);
@@ -1054,6 +1077,93 @@ public void setIsVoid(boolean isVoid) {
         return objs;
     }
 
+    /**
+     * Adds a Spring Security expression that preserves the OpenAPI security requirement semantics:
+     * entries in a {@code security} array are OR alternatives, while schemes and scopes in one
+     * entry are combined with AND.
+     */
+    private void addSpringSecurityPreAuthorize(CodegenOperation codegenOperation) {
+        String originalOperationId = codegenOperation.operationIdOriginal != null
+                ? codegenOperation.operationIdOriginal
+                : codegenOperation.operationId;
+        Operation rawOperation = findOperation(originalOperationId);
+        if (rawOperation == null) {
+            LOGGER.warn("Could not find OpenAPI operation '{}' while generating @PreAuthorize.", originalOperationId);
+            return;
+        }
+
+        List<SecurityRequirement> requirements = rawOperation.getSecurity();
+        if (requirements == null) {
+            requirements = openAPI.getSecurity();
+        }
+        if (requirements == null || requirements.isEmpty()) {
+            return;
+        }
+
+        Map<String, SecurityScheme> schemes = openAPI.getComponents() != null
+                ? openAPI.getComponents().getSecuritySchemes() : null;
+        if (schemes == null || schemes.isEmpty()) {
+            return;
+        }
+
+        List<String> alternatives = new ArrayList<>();
+        for (SecurityRequirement requirement : requirements) {
+            if (requirement.isEmpty()) {
+                return;
+            }
+            List<String> groupAuthorities = new ArrayList<>();
+            for (Map.Entry<String, List<String>> entry : requirement.entrySet()) {
+                SecurityScheme scheme = schemes.get(entry.getKey());
+                if (scheme == null || (scheme.getType() != SecurityScheme.Type.OAUTH2
+                        && scheme.getType() != SecurityScheme.Type.OPENIDCONNECT)) {
+                    return;
+                }
+                if (entry.getValue() == null || entry.getValue().isEmpty()) {
+                    groupAuthorities.add("isAuthenticated()");
+                } else {
+                    for (String scope : entry.getValue()) {
+                        groupAuthorities.add("hasAuthority('" + escapeSpelStringLiteral(springSecurityAuthorityPrefix + scope) + "')");
+                    }
+                }
+            }
+            String group = String.join(" and ", groupAuthorities);
+            alternatives.add(groupAuthorities.size() > 1 && requirements.size() > 1 ? "(" + group + ")" : group);
+        }
+
+        if (!alternatives.isEmpty()) {
+            codegenOperation.vendorExtensions.put("x-spring-security-pre-authorize",
+                    escapeJavaStringLiteral(String.join(" or ", alternatives)));
+        }
+    }
+
+    private String escapeSpelStringLiteral(String value) {
+        return value.replace("'", "''");
+    }
+
+    private String escapeJavaStringLiteral(String value) {
+        return value.replace("\\", "\\\\")
+                .replace("\"", "\\\"")
+                .replace("\r", "\\r")
+                .replace("\n", "\\n");
+    }
+
+    private Operation findOperation(String operationId) {
+        if (openAPI.getPaths() == null || operationId == null) {
+            return null;
+        }
+        for (PathItem pathItem : openAPI.getPaths().values()) {
+            if (pathItem.readOperations() == null) {
+                continue;
+            }
+            for (Operation operation : pathItem.readOperations()) {
+                if (operationId.equals(operation.getOperationId())) {
+                    return operation;
+                }
+            }
+        }
+        return null;
+    }
+
     private interface DataTypeAssigner {
         void setReturnType(String returnType);
 

modules/openapi-generator/src/main/resources/JavaSpring/api.mustache

@@ -40,6 +40,9 @@ import org.springframework.http.HttpStatus;
 {{#useResponseEntity}}
 import org.springframework.http.ResponseEntity;
 {{/useResponseEntity}}
+{{#useSpringSecurityPreAuthorize}}
+import org.springframework.security.access.prepost.PreAuthorize;
+{{/useSpringSecurityPreAuthorize}}
 {{#useBeanValidation}}{{^useSpringBuiltInValidation}}import org.springframework.validation.annotation.Validated;{{/useSpringBuiltInValidation}}{{/useBeanValidation}}
 {{#useSpringController}}
 {{#useResponseEntity}}
@@ -272,6 +275,9 @@ public interface {{classname}} {
     {{#vendorExtensions.x-operation-extra-annotation}}
     {{{.}}}
     {{/vendorExtensions.x-operation-extra-annotation}}
+    {{#vendorExtensions.x-spring-security-pre-authorize}}
+    @PreAuthorize("{{{.}}}")
+    {{/vendorExtensions.x-spring-security-pre-authorize}}
     {{#vendorExtensions.x-sse}}
     @ResponseBody
     {{/vendorExtensions.x-sse}}

modules/openapi-generator/src/main/resources/JavaSpring/libraries/spring-boot/openapi2SpringBoot.mustache

@@ -6,6 +6,13 @@ import org.openapitools.jackson.nullable.JsonNullableModule;
 {{/openApiNullable}}
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+{{#useSpringSecurityPreAuthorize}}
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.web.SecurityFilterChain;
+{{/useSpringSecurityPreAuthorize}}
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.FilterType;
@@ -18,8 +25,22 @@ import org.springframework.context.annotation.FullyQualifiedAnnotationBeanNameGe
     basePackages = {"{{basePackage}}", "{{apiPackage}}" , "{{configPackage}}"},
     nameGenerator = FullyQualifiedAnnotationBeanNameGenerator.class
 )
+{{#useSpringSecurityPreAuthorize}}
+@EnableMethodSecurity
+{{/useSpringSecurityPreAuthorize}}
 public class OpenApiGeneratorApplication {
 
+{{#useSpringSecurityPreAuthorize}}
+    @Bean
+    @ConditionalOnMissingBean(SecurityFilterChain.class)
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        return http
+            .csrf(AbstractHttpConfigurer::disable)
+            .authorizeHttpRequests(authorize -> authorize.anyRequest().permitAll())
+            .build();
+    }
+
+{{/useSpringSecurityPreAuthorize}}
     public static void main(String[] args) {
         SpringApplication.run(OpenApiGeneratorApplication.class, args);
     }

modules/openapi-generator/src/main/resources/JavaSpring/libraries/spring-boot/pom-sb3.mustache

@@ -111,6 +111,12 @@
         </plugins>
     </build>
     <dependencies>
+        {{#useSpringSecurityPreAuthorize}}
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        {{/useSpringSecurityPreAuthorize}}
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web{{#reactive}}flux{{/reactive}}</artifactId>

modules/openapi-generator/src/main/resources/JavaSpring/libraries/spring-boot/pom-sb4.mustache

@@ -111,6 +111,12 @@
         </plugins>
     </build>
     <dependencies>
+        {{#useSpringSecurityPreAuthorize}}
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        {{/useSpringSecurityPreAuthorize}}
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web{{#reactive}}flux{{/reactive}}{{^reactive}}mvc{{/reactive}}</artifactId>

modules/openapi-generator/src/main/resources/JavaSpring/libraries/spring-boot/pom.mustache

@@ -119,6 +119,12 @@
         </plugins>
     </build>
     <dependencies>
+        {{#useSpringSecurityPreAuthorize}}
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        {{/useSpringSecurityPreAuthorize}}
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web{{#reactive}}flux{{/reactive}}</artifactId>