Swagger enabled changes #70
Conversation
WalkthroughThe changes introduce new configuration properties across multiple environment property files to enable or toggle Springdoc API documentation and Swagger UI features. The JWT user ID validation filter was updated to exclude requests to Swagger UI, OpenAPI documentation endpoints, and the user token refresh endpoint from authentication checks, allowing unauthenticated access to API documentation and token refresh. No existing properties or exported/public entities were altered or removed. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant JwtUserIdValidationFilter
participant API Documentation (Swagger/OpenAPI)
participant Application
Client->>JwtUserIdValidationFilter: Request to /swagger-ui or /v3/api-docs or /user/refreshToken
JwtUserIdValidationFilter-->>API Documentation (Swagger/OpenAPI): Bypass JWT validation
API Documentation (Swagger/OpenAPI)-->>Client: Serve documentation or refresh token
Client->>JwtUserIdValidationFilter: Request to protected endpoint
JwtUserIdValidationFilter->>Application: Validate JWT and process request
Application-->>Client: Response
Poem
Tip ⚡💬 Agentic Chat (Pro Plan, General Availability)
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (1)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
src/main/environment/admin_ci.properties (1)
24-25: Enable togglable SpringDoc and Swagger UI viaSWAGGER_DOC_ENABLED
Consider providing a default fallback if the environment variable is unset, for example:-springdoc.api-docs.enabled=@env.SWAGGER_DOC_ENABLED@ -springdoc.swagger-ui.enabled=@env.SWAGGER_DOC_ENABLED@ +springdoc.api-docs.enabled=${SWAGGER_DOC_ENABLED:false} +springdoc.swagger-ui.enabled=${SWAGGER_DOC_ENABLED:false}This ensures the documentation is disabled by default when
SWAGGER_DOC_ENABLEDisn’t defined.src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java (2)
58-59: Consider security implications of exposed API documentation.While exposing Swagger UI and API documentation is necessary for development and testing environments, consider the security implications in production. Documentation can potentially reveal sensitive API details to unauthorized users.
You might want to implement additional security controls for production environments, such as:
- Environment-specific configuration that enables/disables these exclusions
- IP-based restrictions for documentation endpoints
- Basic authentication for documentation access
58-59: Add comments explaining the purpose of these exclusions.For better code maintainability, consider adding a brief comment explaining that these paths are excluded to enable Swagger UI and OpenAPI documentation access.
// Skip login and public endpoints if (path.equals(contextPath + "/user/userAuthenticate") || path.equalsIgnoreCase(contextPath + "/user/logOutUserFromConcurrentSession") + // Allow Swagger UI and OpenAPI documentation without authentication || path.startsWith(contextPath + "/swagger-ui") || path.startsWith(contextPath + "/v3/api-docs") || path.startsWith(contextPath + "/public")) {
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
src/main/environment/admin_ci.properties(1 hunks)src/main/environment/admin_dev.properties(1 hunks)src/main/environment/admin_example.properties(1 hunks)src/main/environment/admin_test.properties(1 hunks)src/main/environment/admin_uat.properties(1 hunks)src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Analyze (java)
🔇 Additional comments (7)
src/main/environment/admin_test.properties (1)
20-21: Enable SpringDoc and Swagger UI for test environment
These properties correctly activate the Springdoc OpenAPI docs and Swagger UI in the test profile, aligning with the change objective.src/main/environment/admin_uat.properties (1)
20-21: Enable SpringDoc and Swagger UI for UAT environment
The added settings mirror other environments and will expose the API docs and UI without authentication in UAT.src/main/environment/admin_dev.properties (1)
21-22: Enable SpringDoc and Swagger UI for dev environment
These new properties correctly activate the Springdoc API docs and Swagger UI in the development profile.src/main/environment/admin_example.properties (2)
18-18: Addcommon-urlproperty for example environment
Definingcommon-urlhere ensures consistency across all environment configs.
20-21: Enable SpringDoc and Swagger UI for example environment
These settings will expose OpenAPI docs and the Swagger UI in the example profile.src/main/environment/admin_ci.properties (1)
22-22: Addcommon-urlplaceholder for CI environment
Using the@env.COMMON_URL@placeholder keeps the common service URL configurable via environment variables.src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java (1)
58-59:Details
✅ Verification successful
Adding Swagger UI and OpenAPI docs endpoints to exclusion list is appropriate.
These changes allow the Swagger UI and OpenAPI documentation endpoints to bypass JWT authentication, which aligns with the PR objective to enable Swagger functionality. This is a standard practice for API documentation tools.
Consider whether these exclusions should be conditional based on environment configuration. Since the AI summary mentions configuration properties for enabling/disabling Swagger UI (
springdoc.swagger-ui.enabled), you might want to check if these exclusions should only apply when Swagger is enabled:
🏁 Script executed:
#!/bin/bash # Check if there's any conditional logic elsewhere that controls Swagger UI availability rg -A 3 -B 3 "springdoc\.swagger-ui\.enabled" --glob "*.java"Length of output: 63
🏁 Script executed:
#!/bin/bash # Search configuration files for springdoc.swagger‑ui.enabled property rg "springdoc\.swagger-ui\.enabled" --glob "*.yml" --glob "*.properties"Length of output: 479
Approve Swagger UI and API Docs Exclusions
I’ve confirmed that the
springdoc.swagger‑ui.enabledproperty is defined in all environment-specific config files (admin_*.properties), so the Swagger UI and OpenAPI endpoints will only be active when that flag istrue. Unconditionally excluding these paths in your JWT filter is safe—if Swagger is disabled the endpoints simply won’t exist.
If you’d rather tie the exclusions directly to the flag, you can inject thespringdoc.swagger‑ui.enabledvalue intoJwtUserIdValidationFilterand wrap thepath.startsWith(...)checks in anif (swaggerEnabled)block.
No changes required unless you want that extra configuration guard.
| spring.main.allow-bean-definition-overriding=true | ||
|
|
||
| common-url=http://localhost:8083/ | ||
| common-url=http://localhost:8083/, |
There was a problem hiding this comment.
Remove trailing comma from common-url property
Property files include commas as literal characters; the extra comma in http://localhost:8083/, will become part of the URL and may break downstream calls. Please remove it so the value reads http://localhost:8083/.
|
2 participants
📋 Description
JIRA ID: AMM-1186
Enable or dissable swagger
✅ Type of Change
ℹ️ Additional Information
Please describe how the changes were tested, and include any relevant screenshots, logs, or other information that provides additional context.
Summary by CodeRabbit