Enhancing RequestMatcher building for the resource server configuration

[gorbunkov]

Issue Description

Both the Authorization Server and OpenID Connect (OIDC) add-ons configure a resource server in their auto-configurations.

At the project level, URL patterns can be defined as "protected by this resource server" in the following ways:

1. By implementing the AuthorizedUrlsProvider interface.
2. By adding the jmix.rest.authenticated-url-patterns application property.

Problems with the Current Implementation

1. Limited Functionality of AuthorizedUrlsProvider:

   • The AuthorizedUrlsProvider only returns strings with URL patterns, limiting its ability to build complex RequestMatchers (which can include HTTP methods, for example).

2. Redundant Methods in AuthorizedUrlsProvider:

   • The AuthorizedUrlsProvider has two methods: getAuthenticatedUrlPatterns and getAnonymousUrlPatterns. In most cases, users only need the getAuthenticatedUrlPatterns method. The getAnonymousUrlPatterns implementation is typically empty. Additionally, the interface name AuthorizedUrlsProvider does not imply that it configures anonymous URLs.
   • Not perfect naming: AuthorizedUrlsProvider has the getAuthenticatedUrlPatterns method.

3. Misplaced Property:

   • The jmix.rest.authenticated-url-patterns property is used by the Authorization Server and OIDC add-ons, but its property processor is located in the REST API module. This property only works if the REST API add-on is included. There is no way to configure access to endpoints using properties when you have just Authorization Server add-on in the project and don't have REST API add-on.

Suggested Improvements

We should rework the way request matchers are configured for the resource server configuration:

1. Unified Request Matcher Configuration:

   • Request matchers should be configurable for both the Authorization Server and the OIDC add-ons.

2. Support for Complex Request Matchers:

   • There should be a way to build complex RequestMatchers.

[gorbunkov]

See implementation details in the PR description: #3398

[gorbunkov]

Breaking changes:

Generic REST add-on now requires explicit endpoints security configuration:

jmix.resource-server.authenticated-url-patterns = /rest/**

Studio issue: https://youtrack.jmix.io/issue/JST-5237

[SergeiAksenov2]

Tested on:
Jmix version: 2.4.999-SNAPSHOT
Jmix Studio plugin version: 2.4.SNAPSHOT6786-242
IntelliJ version: IntelliJ IDEA 2024.2.1 (Community Edition)

Checked Url Providers and RequestMatcher Providers - Ok.