fix(#632): propagate spring security context

Propagate the Spring Security context if on the class path.

fix #632

Author: oliemansm

gradle.properties

@@ -33,7 +33,7 @@ TARGET_COMPATIBILITY=1.8
 LIB_GRAPHQL_JAVA_VER=16.2
 LIB_EXTENDED_SCALARS_VER=16.0.1
 LIB_SPRING_BOOT_VER=2.4.5
-LIB_GRAPHQL_SERVLET_VER=11.1.1
+LIB_GRAPHQL_SERVLET_VER=11.2.0-SNAPSHOT
 LIB_GRAPHQL_JAVA_TOOLS_VER=11.0.1
 LIB_GRAPHQL_ANNOTATIONS_VER=8.3
 LIB_REFLECTIONS_VER=0.9.11

graphql-spring-boot-autoconfigure/src/main/java/graphql/kickstart/autoconfigure/web/servlet/AsyncServletProperties.java

@@ -0,0 +1,19 @@
+package graphql.kickstart.autoconfigure.web.servlet;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+@Data
+@ConfigurationProperties(prefix = "graphql.servlet.async")
+public class AsyncServletProperties {
+
+  private boolean enabled = true;
+  private long timeout = 30000;
+  private Threads threads = new Threads();
+
+  @Data
+  static class Threads {
+    private int min = 10;
+    private int max = 200;
+  }
+}

graphql-spring-boot-autoconfigure/src/main/java/graphql/kickstart/autoconfigure/web/servlet/DelegatingSecurityContextAsyncTaskDecorator.java

@@ -0,0 +1,27 @@
+package graphql.kickstart.autoconfigure.web.servlet;
+
+import graphql.kickstart.servlet.AsyncTaskDecorator;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+class DelegatingSecurityContextAsyncTaskDecorator implements AsyncTaskDecorator {
+
+  @Override
+  public Runnable decorate(Runnable runnable) {
+    SecurityContext delegateSecurityContext = SecurityContextHolder.getContext();
+    return () -> {
+      SecurityContext originalSecurityContext = SecurityContextHolder.getContext();
+      try {
+        SecurityContextHolder.setContext(delegateSecurityContext);
+        runnable.run();
+      } finally {
+        SecurityContext emptyContext = SecurityContextHolder.createEmptyContext();
+        if (emptyContext.equals(originalSecurityContext)) {
+          SecurityContextHolder.clearContext();
+        } else {
+          SecurityContextHolder.setContext(originalSecurityContext);
+        }
+      }
+    };
+  }
+}

graphql-spring-boot-autoconfigure/src/main/java/graphql/kickstart/autoconfigure/web/servlet/GraphQLWebAutoConfiguration.java

@@ -43,6 +43,7 @@
 import graphql.kickstart.execution.config.ObjectMapperProvider;
 import graphql.kickstart.execution.error.GraphQLErrorHandler;
 import graphql.kickstart.servlet.AbstractGraphQLHttpServlet;
+import graphql.kickstart.servlet.AsyncTaskDecorator;
 import graphql.kickstart.servlet.GraphQLConfiguration;
 import graphql.kickstart.servlet.GraphQLHttpServlet;
 import graphql.kickstart.servlet.cache.GraphQLResponseCacheManager;
@@ -61,6 +62,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
+import java.util.concurrent.Executor;
 import javax.servlet.MultipartConfigElement;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -101,14 +103,15 @@
     havingValue = "true",
     matchIfMissing = true)
 @AutoConfigureAfter({GraphQLJavaToolsAutoConfiguration.class, JacksonAutoConfiguration.class})
-@EnableConfigurationProperties({GraphQLServletProperties.class})
+@EnableConfigurationProperties({GraphQLServletProperties.class, AsyncServletProperties.class})
 public class GraphQLWebAutoConfiguration {
 
   public static final String QUERY_EXECUTION_STRATEGY = "queryExecutionStrategy";
   public static final String MUTATION_EXECUTION_STRATEGY = "mutationExecutionStrategy";
   public static final String SUBSCRIPTION_EXECUTION_STRATEGY = "subscriptionExecutionStrategy";
 
   private final GraphQLServletProperties graphQLServletProperties;
+  private final AsyncServletProperties asyncServletProperties;
   private final ErrorHandlerSupplier errorHandlerSupplier = new ErrorHandlerSupplier(null);
 
   @Bean
@@ -293,7 +296,9 @@ public GraphQLConfiguration graphQLServletConfiguration(
       GraphQLObjectMapper graphQLObjectMapper,
       @Autowired(required = false) List<GraphQLServletListener> listeners,
       @Autowired(required = false) BatchInputPreProcessor batchInputPreProcessor,
-      @Autowired(required = false) GraphQLResponseCacheManager responseCacheManager) {
+      @Autowired(required = false) GraphQLResponseCacheManager responseCacheManager,
+      @Autowired(required = false) AsyncTaskDecorator asyncTaskDecorator,
+      @Autowired(required = false) Executor asyncExecutor) {
     return GraphQLConfiguration.with(invocationInputFactory)
         .with(graphQLInvoker)
         .with(graphQLObjectMapper)
@@ -303,6 +308,10 @@ public GraphQLConfiguration graphQLServletConfiguration(
         .with(graphQLServletProperties.getContextSetting())
         .with(responseCacheManager)
         .asyncTimeout(graphQLServletProperties.getAsyncTimeout())
+        .with(asyncTaskDecorator)
+        .asyncCorePoolSize(asyncServletProperties.getThreads().getMin())
+        .asyncCorePoolSize(asyncServletProperties.getThreads().getMax())
+        .with(asyncExecutor)
         .build();
   }
 

graphql-spring-boot-autoconfigure/src/main/java/graphql/kickstart/autoconfigure/web/servlet/GraphQLWebSecurityAutoConfiguration.java

@@ -0,0 +1,21 @@
+package graphql.kickstart.autoconfigure.web.servlet;
+
+import graphql.kickstart.servlet.AsyncTaskDecorator;
+import org.springframework.boot.autoconfigure.AutoConfigureBefore;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
+
+@Configuration
+@AutoConfigureBefore(GraphQLWebAutoConfiguration.class)
+@ConditionalOnClass(DefaultAuthenticationEventPublisher.class)
+public class GraphQLWebSecurityAutoConfiguration {
+
+  @Bean
+  @ConditionalOnMissingBean
+  public AsyncTaskDecorator delegatingSecurityContextAsyncTaskDecorator() {
+    return new DelegatingSecurityContextAsyncTaskDecorator();
+  }
+}

graphql-spring-boot-autoconfigure/src/main/resources/META-INF/spring.factories

@@ -2,6 +2,7 @@ org.springframework.context.ApplicationContextInitializer=\
     graphql.kickstart.autoconfigure.web.servlet.GraphQLExtendedScalarsInitializer
 org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
     graphql.kickstart.autoconfigure.web.servlet.GraphQLWebAutoConfiguration,\
+    graphql.kickstart.autoconfigure.web.servlet.GraphQLWebSecurityAutoConfiguration,\
     graphql.kickstart.autoconfigure.web.servlet.GraphQLWebsocketAutoConfiguration,\
     graphql.kickstart.autoconfigure.web.servlet.GraphQLInstrumentationAutoConfiguration,\
     graphql.kickstart.autoconfigure.web.reactive.GraphQLSpringWebfluxAutoConfiguration,\