How DGS address the issue SecurityContext can only be accessed in ThreadLocal.

[kxuenvoy]

Hi, experts,
What's the strategy of DGS to propagate SecurityContext into the Thread? Right now, I found I can access SecurityContext from root level thread with @DgsQuery function but not always from nested function such as @DgsData @DgsDataFetch. I believe it is related to the SecurityContext is not propagate to threads by default.
What's the strategy to access SecurityContext in DGS? I tried the spring setting (spring.security.strategy = MODE_INHERITABLETHREADLOCAL). But, it does not work. I still cannot use SecurityContextHolder function to access the authentication object.
Thanks for your attention.

[srinivasankavitha]

For any async work that you are doing inside the data fetchers, you'll need to handle this with a special task executor that propagates the context. Please refer to the Spring Security docs here: https://docs.spring.io/spring-security/reference/features/integrations/concurrency.html

[kxuenvoy]

Thanks for your quick response. But, my current issue is the data fetcher cannot access the SecurityContext. How can I handle a special task executor without being able to get the SecurityContext? I found the SecurityContext cannot be accessible as long as the data fetch happened at the 2nd level. For example,

if I run the following query,

query ($id: ID!) {
getCompany(id: $id) {
id
multiTenancyProperties {
id,
name
tenants {
id
name
visits {
id
__typename
}
__typename
}
__typename
}
__typename
}
}

and, I defined the following api.
@DgsQuery suspend fun getCompany(@InputArgument id: String, @RequestHeader("authorization") token: String?): Company = coroutineScope {...}

@DgsData(parentType = DgsConstants.COMPANY.TYPE_NAME, field = DgsConstants.COMPANY.MultiTenancyProperties)
fun multiTenancyProperties(dfe: DgsDataFetchingEnvironment): CompletableFuture<List> { ... }

@DgsData(parentType = DgsConstants.MULTITENANCYPROPERTY.TYPE_NAME, field = DgsConstants.MULTITENANCYPROPERTY.Tenants)
fun tenants(dfe: DgsDataFetchingEnvironment): CompletableFuture<List> { ... }

Then, I will find the SecurityContext is accessible till multiTenancyProperties Fetcher level, but, it is not accessible at tenants Fetcher level.

Q1. why multiTenancyProperties Fetcher level can still access SeucrityContext?
Q2. Do you mean I need to introduce special task executor for each function calls? If that is a case, would that be nice DGS can handle that in its ThreadPool management?

Thanks for your attention.