Zabezpečení GraphQL API s Netflix DGS

@DgsComponent
@RequiredArgsConstructor
public class CreateProductMutation {

    private final ProductService productService;
    private final CurrentUserProvider currentUser;

    @DgsMutation
    @PreAuthorize("hasAnyRole('MERCHANT', 'ADMIN')")
    public Mono<Product> createProduct(@InputArgument CreateProductInput input) {
        return currentUser.getUserId().flatMap(userId -> {
            return productService.create(input, userId);
        });
    }
}

@DgsMutation
@PreAuthorize("isAuthenticated()")
public Mono<Product> updateProduct(@InputArgument UpdateProductInput input) {
    return currentUser.getUserId().flatMap(userId -> {
        // userId comes from the verified JWT — never from client input
        return productService.update(input, userId);
    });
}

@DgsMutation
@PreAuthorize("isAuthenticated()")
public Mono<Order> cancelOrder(@InputArgument String orderId) {
    return currentUser.getUserId().flatMap(userId -> {
        return orderService.findById(orderId)
                .switchIfEmpty(Mono.error(new NotFoundException("Order not found")))
                .flatMap(order -> {
                    if (!userId.equals(order.getOwnerId())) {
                        return Mono.error(new AccessDeniedException("Not authorized"));
                    }
                    return orderService.cancel(orderId);
                });
    });
}

@DgsMutation
@PreAuthorize("hasRole('ADMIN') or @ownershipService.ownsOrder(#input.id, authentication.name)")
public Mono<Order> updateOrder(@InputArgument UpdateOrderInput input) {
    // ...
}

// Public — no auth required
@DgsQuery
public Mono<ProductPage> products(@InputArgument String searchText, ...) {
    return productService.search(searchText, ...);
}

// Authenticated — returns user-specific data
@DgsQuery
@PreAuthorize("isAuthenticated()")
public Mono<OrderPage> myOrders(@InputArgument Integer pageNumber, ...) {
    return currentUser.getUserId().flatMap(userId -> {
        return orderService.findByOwner(userId, pageNumber, ...);
    });
}

// Admin-only — exposes all data with optional owner filtering
@DgsQuery
@PreAuthorize("hasRole('ADMIN')")
public Mono<OrderPage> adminOrders(
        @InputArgument String ownerId,
        @InputArgument Integer pageNumber, ...) {
    return orderService.findAll(ownerId, pageNumber, ...);
}

{
    "errors": [{
        "message": "org.hibernate.ObjectDeletedException: deleted instance passed to merge: [com.example.internal.model.OrderEntity#42]",
        "path": ["order"],
        "extensions": {
            "classification": "DataFetchingException"
        }
    }]
}

@Configuration
public class GraphQLConfig {

    @Bean
    public DataFetcherExceptionHandler dataFetcherExceptionHandler() {
        return new SafeExceptionHandler();
    }
}

public class SafeExceptionHandler implements DataFetcherExceptionHandler {

    @Override
    public CompletableFuture<DataFetcherExceptionHandlerResult> handleException(
            DataFetcherExceptionHandlerParameters params) {

        Throwable exception = params.getException();
        String path = params.getPath().toString();

        // Log the full error for debugging (server-side only)
        logException(exception, path);

        // Return a sanitized error to the client
        String message = sanitize(exception);
        String code = classify(exception);

        GraphQLError error = GraphqlErrorBuilder.newError()
                .message(message)
                .path(params.getPath())
                .location(params.getSourceLocation())
                .extensions(Map.of("code", code))
                .build();

        return CompletableFuture.completedFuture(
                DataFetcherExceptionHandlerResult.newResult().error(error).build());
    }
}

private void logException(Throwable exception, String path) {
    if (exception instanceof DomainValidationException) {
        log.info("Validation error", kv("path", path), kv("message", exception.getMessage()));
    } else if (exception instanceof AccessDeniedException) {
        log.warn("SECURITY: Access denied", kv("path", path), kv("userId", getCurrentUserId()));
    } else {
        log.error("Unexpected error", kv("path", path), kv("errorType",
                exception.getClass().getSimpleName()), exception);
    }
}

private boolean isUserFacingMessage(String message) {
    if (message == null) return false;

    String lower = message.toLowerCase();

    // Block messages that reveal internals
    if (lower.contains("exception") || lower.contains("stacktrace")
            || lower.contains("null pointer") || lower.contains("class ")) {
        return false;
    }

    // Allow known safe business messages
    return lower.contains("already exists")
            || lower.contains("not found")
            || lower.contains("limit reached")
            || lower.contains("expired")
            || lower.contains("registration is closed");
}

# Malicious query — each level multiplies the work
query {
    users {
        orders {
            products {
                reviews {
                    author {
                        orders {
                            products { ... }  # Keep going...
                        }
                    }
                }
            }
        }
    }
}

@Configuration
public class GraphQLSecurityConfig {

    @Value("${graphql.security.max-depth}")
    private int maxQueryDepth;

    @Bean
    public Instrumentation maxQueryDepthInstrumentation() {
        return new MaxQueryDepthInstrumentation(maxQueryDepth);
    }
}

@Value("${graphql.security.max-complexity}")
private int maxQueryComplexity;

@Bean
public Instrumentation maxQueryComplexityInstrumentation() {
    return new MaxQueryComplexityInstrumentation(maxQueryComplexity);
}

graphql:
    security:
        max-depth: ${GRAPHQL_MAX_DEPTH}
        max-complexity: ${GRAPHQL_MAX_COMPLEXITY}