JWT AuthZ with authorities using Vert.x-Web API Contract

[Filipe Delgado]

Hi,

can you please tell me how to perform AuthZ with specific permissions (authorities) by route, using  Vert.x-Web API Contract ? How do I mount a security handler by operation?

Thanks,

Filipe

[Francesco Guardiani]

You can use the "security scope" of openapi 3:

• https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.1.md#security-requirement-object

You define the scopes as different permissions requirements. They should be used only for OAuth, but the implementation don't care about it. Then to mount different security handlers for scope use: http://vertx.io/docs/apidocs/io/vertx/ext/web/api/contract/openapi3/OpenAPI3RouterFactory.html#addSecuritySchemaScopeValidator-java.lang.String-java.lang.String-io.vertx.core.Handler-

Give a look at test examples:

• https://github.com/vert-x3/vertx-web/blob/master/vertx-web-api-contract/src/test/resources/swaggers/router_factory_test.yaml#L83
  
• https://github.com/vert-x3/vertx-web/blob/master/vertx-web-api-contract/src/test/java/io/vertx/ext/web/api/contract/openapi3/OpenAPI3RouterFactoryTest.java#L268