Make hydra documentation respect access control #2719
Description
My api has public and private entries.
But the hydra and swagger documentations expose all of them.
As a result, a connected user that has access to only parts of the api will see the whole documentation which is not a good thing for security.
More importantly, the admin is broken in that case because it tries to fetch every resource in the hydra documentation.
Activity
teohhanhui commentedon Apr 9, 2019
The documentation should be available even for operations that require authentication. There is nothing wrong with that. "Security by obscurity" is bad.
teohhanhui commentedon Apr 9, 2019
Then that's a bug in the admin.
armellarcier commentedon Apr 9, 2019
I agree. I first created an issue in the admin repository. I ended up overriding the documentation parser.
But still, I would like the ability to hide entrypoints from the swagger ui based on access control. It’s more of a feature request
armellarcier commentedon Apr 9, 2019
Maybe it can be done in userland?
er1z commentedon May 10, 2019
Just decorate documentation normalizer.
dunglas commentedon May 10, 2019
It's a very frequent request. It would be nice to have it in core (with a flag to enable or disable this feature).
dunglas commentedon May 10, 2019
Basically it means executing the security expression in the documentation normalizers.
armellarcier commentedon May 11, 2019
I really need this and I’d need some directions to push a PR quickly. @dunglas what modifications and configuration options would you like to see?
dunglas commentedon May 17, 2019
I suggest to inject the Security Expression executor in
DocumentationNormalizer, and to security expression of every resource class before this line and of every operation here.If the security expression can be executed (it doesn't depend of the current object but only use
is_granted()for instance), then I would skip generating the documentation of not allowed operations.The same logic must be adapted for the OpenAPI
DocumentationNormalizer.gomcodoctor commentedon Nov 15, 2019
I am working on it, i wanted to decorate DocumentationNormalizer but all functions are private !
klobastov commentedon Jun 26, 2023
Is there any news on this topic?