PreQuery event is not supported

[funnyleolee]

Feature description

Unable to use the preQuery event to set public parameters before the query.

[dstepanov]

Can you please describe your use-case? What do you mean by public parameters?

[funnyleolee]

All models belong to an organization, and the data is isolated by the orgId.The sample code snippet like this:

AuthenticationProvider implementation:

public Publisher<AuthenticationResponse> authenticate(Object httpRequest, AuthenticationRequest<?, ?> authenticationRequest) {
        return Flux.create(emitter -> {
            String username = (String) authenticationRequest.getIdentity();
            String password = (String) authenticationRequest.getSecret();
            UserEntity user = userService.getByUsername(username).block();
            if (user == null) {
                log.info("User {} not found, login failed!", username);
                emitter.error(AuthenticationResponse.exception(USER_NOT_FOUND));
            } else if (!DigestUtil.bcryptCheck(password, user.getPassword())) {
                log.info("User {} credentials don't match, login failed!", username);
                emitter.error(AuthenticationResponse.exception(CREDENTIALS_DO_NOT_MATCH));
            } else {
                Set<String> roles = user.getRoles().stream().map(RoleEntity::getCode).collect(Collectors.toSet());
                Map<String, Object> attr = new HashMap<>();
                attr.put("org", user.getOrgId());
                emitter.next(AuthenticationResponse.success((String) authenticationRequest.getIdentity(), roles, attr));
                emitter.complete();
            }
        }, FluxSink.OverflowStrategy.ERROR);
    }

Data Entity:

@Where("@.org_id=:orgId")
public class BrandEntity {
    ...   
    private String orgId;
    ...
}

Expected PreQuery code:

import io.micronaut.security.utils.SecurityService;
...
@Inject
private SecurityService securityService;
...
if (securityService.isAuthenticated()) {
    String orgId = (String)securityService.getAuthentication()
            .get()
            .getAttributes().get("org");
    // TODO  set orgId as global data query params
}

If it can be implemented, all query requests do not need to explicitly set orgId.This approach is useful and efficient for user or organizational data isolation

[dstepanov]

Thanks, I'm planning to support external properties

[funnyleolee]

@dstepanov Is this feature already on the development agenda?

[dstepanov]

You can try put @ParameterExpression(name = "orgId", expression = "#{orgId}") and @AnnotationExpressionContext(OrgIdContext.class) on the repository of your entity and

@Singleton
class OrgIdContext {
...
public getOrgId() { ... }

}

[funnyleolee]

You can try put @ParameterExpression(name = "orgId", expression = "#{orgId}") and @AnnotationExpressionContext(OrgIdContext.class) on the repository of your entity and

@Singleton
class OrgIdContext {
...
public getOrgId() { ... }

}

let me try. How to make orgId as a global parameter effective in findAll, findById, findOne etc.

[dstepanov]

ParameterExpression should map the @Where("@.org_id=:orgId") parameter to the context one

[funnyleolee]

That has problem with ExpressionContext. In ExpressionContext class getAuthentication result was empty. But authentication can be obtained in the controller.

@Inject
private SecurityService securityService;
...
 public String getOrgId() {
       
// securityService.getAuthentication() is empty
return securityService.getAuthentication()
               .map(authentication -> authentication.getAttributes().get("ORG_ID").toString())
               .orElse("");
}
...

[dstepanov]

What is your stack?

[funnyleolee]

micronautVersion=4.4.2

Controller method:

@Slf4j
@Secured(SecurityRule.IS_AUTHENTICATED)
@Controller("/api/brands")
public class BrandController {
  @Inject
  private BrandRepository brandRepository;
  
  @Inject
  SecurityService securityService;
  ...
  @Get("{id}")
  public Mono<BrandEntity> detail(@PathVariable Long id) {
      Optional<Authentication> optional = securityService.getAuthentication();
      log.info("Get authentication ===>>> {}", optional.isPresent()); // It's true
      return brandRepository.findById(id);
  }
...

Repository :

@R2dbcRepository(dialect = Dialect.MYSQL)
@ParameterExpression(name = "orgId", expression = "#{orgId}")
public interface BrandRepository extends ReactorPageableRepository<BrandEntity, Long> {
...
}

Entity:

@Data
@MappedEntity("t_brand")
@Where("@.org_id = :orgId")
public class BrandEntity {
...
}

CustomEvaluationContext (Register using ExpressionEvaluationContextRegistrar):

@Singleton
public class CustomEvaluationContext {

  @Inject
  private SecurityService securityService;

  public String getOrgId() {
      // securityService.getAuthentication().isPresent() is false
     return securityService.getAuthentication()
             .map(authentication -> authentication.getAttributes().get("ORG_ID").toString())
             .orElse("");
  }
}

[funnyleolee]

If PreQuery can be support, Use like PreUpdate, PreDelete etc... This will be much more elegant than the Expression Evaluation Context approach

[dstepanov]

There are some fixes in #2876 that should correct context propagation.

How would you imagine for PreQuery to work?

[funnyleolee]

Scenario of a single database we use. And org_id or tenant_id column is used to logically isolate data.Planned to use the prequery listener to uniformly add global parameters.