Reactor - Flux and Mono can't get them to work at all

[ianmichell]

So I've been hammering away at this for a day and I can't seem to get even basic queries to work with mono or flux.

Below is an example of a query to a user profile from the identity store. If I convert this into a future it works out of the box, but the moment I use a mono i get all my fields as null

{"data":{"currentUserProfile":{"firstname":null,"lastname":null,"username":null,"emailAddress":null}}}

And the query code:

@PreAuthorize("isAuthenticated()")
    fun currentUserProfile(context: GraphQLSecurityContext): Mono<UserProfile> {
        return context.securityContext.flatMap { sc ->
            val details = sc.authentication.details as UserCredential
            userIdentityService.findById(details.id).map { UserProfile.fromUserIdentity(it) }
        }

I don't seem to have a problem generating schema with mono. I have registered a monad hook, but it seems to do nothing.

Is there something I'm doing wrong? I know it does call the query method, but I can't seem to figure out I get a null response.

[senthilsivanath]

Same here. Mutation returns following error

{
  "errors": [
    {
      "message": "Cannot return null for non-nullable type: 'String' within parent 'User' (/createUser/phoneNumber)",
      "path": [
        "createUser",
        "phoneNumber"
      ],
      "locations": null,
      "errorType": "DataFetchingException",
      "extensions": null
    }
  ]
}

Query returns Monojust to string instead of unwrapped value

{
  "data": {
    "getHello": "MonoJust"
  }
}

[senthilsivanath]

After adding KotlinDataFetcherFactoryProvider Bean explicitly. Mono started working.

@Bean
	fun schemaConfig(
			config: GraphQLConfigurationProperties,
			topLevelNames: Optional<TopLevelNames>,
			hooks: Optional<SchemaGeneratorHooks>,
			dataFetcherFactoryProvider: KotlinDataFetcherFactoryProvider,
			objectMapper: ObjectMapper,
			springDataFetcherFactory: SpringDataFetcherFactory
	): SchemaGeneratorConfig {
		return SchemaGeneratorConfig(
				supportedPackages = config.packages,
				topLevelNames = topLevelNames.orElse(TopLevelNames()),
				hooks = MonadHooks(),
				dataFetcherFactoryProvider = CustomDataFetcherFactoryProvider(springDataFetcherFactory,objectMapper),
				introspectionEnabled = config.introspection.enabled
		)
	}

After adding below mono started working.

	@Bean
	fun provideDataFetcher(	objectMapper: ObjectMapper,
							   springDataFetcherFactory: SpringDataFetcherFactory): KotlinDataFetcherFactoryProvider{
		return CustomDataFetcherFactoryProvider(springDataFetcherFactory,objectMapper)
	}

BTW, @thunderbird preAuhorize is failing for me. Any idea ?

[ianmichell]

I thought I had nailed the spring security side, but as soon as I ran some tests it failed for me as well. I don't fancy reading all the spring code, but I am looking into it once I solve the mono problem. I'm very new to graphql. I'm still a big skeptic, seems very stateful and non-scalable to me in comparison to rest (which I'd have done my api in far less time). But I am going to keep at it because apparently the benefits outweigh the negatives.

[ianmichell]

After adding KotlinDataFetcherFactoryProvider Bean explicitly. Mono started working.

@Bean
	fun schemaConfig(
			config: GraphQLConfigurationProperties,
			topLevelNames: Optional<TopLevelNames>,
			hooks: Optional<SchemaGeneratorHooks>,
			dataFetcherFactoryProvider: KotlinDataFetcherFactoryProvider,
			objectMapper: ObjectMapper,
			springDataFetcherFactory: SpringDataFetcherFactory
	): SchemaGeneratorConfig {
		return SchemaGeneratorConfig(
				supportedPackages = config.packages,
				topLevelNames = topLevelNames.orElse(TopLevelNames()),
				hooks = MonadHooks(),
				dataFetcherFactoryProvider = CustomDataFetcherFactoryProvider(springDataFetcherFactory,objectMapper),
				introspectionEnabled = config.introspection.enabled
		)
	}

After adding below mono started working.

	@Bean
	fun provideDataFetcher(	objectMapper: ObjectMapper,
							   springDataFetcherFactory: SpringDataFetcherFactory): KotlinDataFetcherFactoryProvider{
		return CustomDataFetcherFactoryProvider(springDataFetcherFactory,objectMapper)
	}

BTW, @thunderbird preAuhorize is failing for me. Any idea ?

So having a look at the code here, the only reason it starts working is the fact that the data loader converts a mono to a completable future.

I suppose it works.

[senthilsivanath]

@thunderbird
Auth isn't working, PrePostAdviceReactiveMethodInterceptor is getting anonymous user but when i add custom MyGraphQLContext it gets the actual user from JWT.

Have similar requirements, trying to keep parity b/w REST and Graphql QL.

[ianmichell]

At the moment, this is what I am using:

@Component
class ReactiveSecurityContextFactory: GraphQLContextFactory<GraphQLSecurityContext> {

    @ExperimentalCoroutinesApi
    override suspend fun generateContext(request: ServerHttpRequest, response: ServerHttpResponse): GraphQLSecurityContext {
        val reactorContext = coroutineContext[ReactorContext]?.context ?: throw RuntimeException("reactor context unavailable")
        val securityContext = reactorContext.getOrDefault<Mono<SecurityContext>>(SecurityContext::class.java, Mono.empty())
        return GraphQLSecurityContext(securityContext = securityContext)
    }
}

And

class GraphQLSecurityContext(val securityContext: Mono<SecurityContext>) : GraphQLContext

[ianmichell]

Surprisingly given that expedia are maintaining the library, I would have thought a ton of wiring for reactive security, but maybe that is just not incorporated into the library.

I'm bundling everything I learn / write to fix my issues into an auto configuration library. I'll look at publishing it on my repo in case it helps anyone. Does seem like a LOT of faffing to get this working. It's a young library though I suppose.

[senthilsivanath]

@thunderbird
No luck. Only REST path seems to be working, Graphql security context is working in MyGraphQLContextFactory but not in PreAuthorize. PreAuthorize method is some how getting anonymous user.

Yes sharing the whole repo would help, if you have customized some parts on security config towards JWT validation.

[ianmichell]

I’m getting there. Will require a directive. Not intuitive. If I can’t sort it. I’m going back to rest. I’ll have an update tonight. Will need to separate the module out of my project though.

[ianmichell]

Problem is here in PrePostAdviceReactiveMethodInterceptor:

@Override
	public Object invoke(final MethodInvocation invocation) {
		Method method = invocation.getMethod();
		Class<?> returnType = method.getReturnType();
		if (!Publisher.class.isAssignableFrom(returnType)) {
			throw new IllegalStateException("The returnType " + returnType + " on " + method + " must return an instance of org.reactivestreams.Publisher (i.e. Mono / Flux) in order to support Reactor Context");
		}
		Class<?> targetClass = invocation.getThis().getClass();
		Collection<ConfigAttribute> attributes = this.attributeSource
			.getAttributes(method, targetClass);

		PreInvocationAttribute preAttr = findPreInvocationAttribute(attributes);
		Mono<Authentication> toInvoke = ReactiveSecurityContextHolder.getContext()
			.map(SecurityContext::getAuthentication)
			.defaultIfEmpty(this.anonymous)
			.filter( auth -> this.preInvocationAdvice.before(auth, invocation, preAttr))
			.switchIfEmpty(Mono.defer(() -> Mono.error(new AccessDeniedException("Denied"))));

Specifically: ReactiveSecurityContextHolder.getContext() <- this is not going to have anything in it. So there are two choices. 1. Try and figure out how to populate it within the current context. Or go another route and use a directive with a custom "authorised" annotation. Which appears at first glance to be the way forward as I've spent enough time on it. I'm not sure what it's going to break, but hey.

[ianmichell]

Another way is to override replace or wrap this: ContextWebFilter which has an order value of 0 and and spit a security context into the mono subscriber context

[smyrick]

Hello @thunderbird and @senthilsivanath.

This library tries to take a generic approach to the implementation details, so out of the box we do not handle Mono or any other async wrapper for you (other than coroutines and CompletableFuture). See the docs: https://expediagroup.github.io/graphql-kotlin/docs/execution/async-models

However these can easily be supported using two approaches:

• Using Kotlin coroutines with Reactor
• Unwrapping the classes with hooks and custom data fetcher

We recommend using coroutines where needed and then calling the functions with proper await or blocking calls so you can convert back to regular functions as having suspend functions in every part of your schema does add a very small amount of overhead.

---

As for webfilter ordering, we have set the ContextWebFilter to 0 so if you need to run a different web filter before that you can set a higher priority like -1 or even Ordered.HIGHEST_PRECEDENCE

[smyrick]

It looks like you may need to set the config for the security web filter order: spring-projects/spring-boot#1640

spring.security.filter.order=-100