metrics and openapi endpoint authorized

Signed-off-by: tvallin <thibault.vallin@oracle.com>

archetypes/helidon/src/main/archetype/common/observability.xml

@@ -161,7 +161,6 @@ curl -H 'Accept: application/json' -X GET http://localhost:8080/metrics
 ]]></value>
                                     </list>
                                     <list key="Main-routing-builder" if="${flavor} == 'se'">
-                                        <value><![CDATA[.addFeature(ObserveFeature.create(MetricsObserveProvider.create(MetricsFeature.create())))]]></value>
                                         <value><![CDATA[.register("/metrics-greet", metricsService)]]></value>
                                     </list>
                                     <list key="MetricsService-imports" if="${flavor} == 'se'">

archetypes/helidon/src/main/archetype/se/custom/observability.xml

@@ -112,8 +112,20 @@
     }
 ]]></value>
             </list>
-            <list key="Observe-feature-builder">
-                <value if="${metrics}"><![CDATA[                    .addProvider(MetricsObserveProvider.create())]]></value>
+            <list key="yaml-config-entries">
+                <value if="${metrics}"><![CDATA[
+metrics:
+  permit-all: true
+                ]]></value>
+            </list>
+            <list key="config-test">
+                <value if="${metrics}"><![CDATA[
+metrics:
+  permit-all: true
+                ]]></value>
+            </list>
+            <list key="Main-routing-builder" if="${metrics}">
+                <value><![CDATA[.addFeature(ObserveFeature.create(config))]]></value>
             </list>
             <list key="Abstract-tests">
                 <value if="${metrics}"><![CDATA[

examples/cors/src/main/resources/application.yaml

@@ -20,6 +20,9 @@ app:
 server:
   port: 8080
   host: 0.0.0.0
+
+metrics:
+  permit-all: true
 
 restrictive-cors:
   allow-origins: ["http://foo.com", "http://there.com"]

examples/metrics/exemplar/src/main/resources/application.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2021, 2022 Oracle and/or its affiliates.
+# Copyright (c) 2021, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,3 +22,5 @@ server:
   host: 0.0.0.0
 tracing:
   service: "hello-world"
+metrics:
+  permit-all: true

examples/metrics/http-status-count-se/src/main/java/io/helidon/examples/se/httpstatuscount/Main.java

@@ -71,7 +71,7 @@ static void setup(WebServerConfig.Builder server) {
     static void routing(HttpRouting.Builder routing, Config config) {
         SimpleGreetService simpleGreetService = new SimpleGreetService(config);
         GreetService greetService = new GreetService(config);
-        routing.addFeature(ObserveFeature.create())
+        routing.addFeature(ObserveFeature.create(config))
                 .register(HttpStatusMetricService.create()) // no endpoint, just metrics updates
                 .register("/simple-greet", simpleGreetService)
                 .register("/greet", greetService);

examples/metrics/http-status-count-se/src/main/resources/application.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2022 Oracle and/or its affiliates.
+# Copyright (c) 2022, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -21,4 +21,7 @@ server:
 app:
   greeting: "Hello"
 
+metrics:
+  permit-all: true
+
 

examples/metrics/http-status-count-se/src/test/resources/application.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2022 Oracle and/or its affiliates.
+# Copyright (c) 2022, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -24,3 +24,5 @@ app:
 security:
   enabled: false
 
+metrics:
+  permit-all: true

examples/metrics/kpi/src/main/java/io/helidon/examples/metrics/kpi/Main.java

@@ -120,6 +120,7 @@ private static MetricsFeature metricsSupportWithoutConfig() {
         return MetricsFeature.builder()
                 .metricsConfig(MetricsConfig.builder()
                         .keyPerformanceIndicatorMetricsConfig(configBuilder))
+                .permitAll(true)
                 .build();
     }
 }

examples/metrics/kpi/src/main/resources/application.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2021 Oracle and/or its affiliates.
+# Copyright (c) 2021, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ server:
   host: 0.0.0.0
 
 metrics:
+  permit-all: true
   key-performance-indicators:
     extended: true
     long-running:

examples/microprofile/cors/src/main/resources/META-INF/microprofile-config.properties

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2020 Oracle and/or its affiliates.
+# Copyright (c) 2020, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,3 +20,5 @@ config_ordinal=1000
 # Microprofile server properties
 server.port=8080
 server.host=0.0.0.0
+
+metrics.permit-all=true

examples/microprofile/multiport/src/main/resources/application.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2021 Oracle and/or its affiliates.
+# Copyright (c) 2021, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@ server:
 
 # Metrics and health run on admin port
 metrics:
+  permit-all: true
   routing: "admin"
 
 health:

examples/microprofile/openapi-basic/src/main/resources/META-INF/microprofile-config.properties

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2019, 2021 Oracle and/or its affiliates.
+# Copyright (c) 2019, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,3 +23,5 @@ server.host=0.0.0.0
 
 mp.openapi.filter=io.helidon.microprofile.examples.openapi.basic.internal.SimpleAPIFilter
 mp.openapi.model.reader=io.helidon.microprofile.examples.openapi.basic.internal.SimpleAPIModelReader
+
+openapi.permit-all=true

examples/microprofile/openapi-basic/src/test/resources/META-INF/microprofile-config.properties

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2019, 2021 Oracle and/or its affiliates.
+# Copyright (c) 2019, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,3 +20,5 @@ config_ordinal=1000
 # Microprofile server properties
 server.port=-1
 server.host=0.0.0.0
+
+openapi.permit-all=true

examples/openapi/src/main/resources/application.yaml

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2019, 2021 Oracle and/or its affiliates.
+# Copyright (c) 2019, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,6 +20,9 @@ app:
 server:
   port: 8080
   host: 0.0.0.0
+
+metrics:
+  permit-all: true
 
 openapi:
   filter: io.helidon.examples.openapi.internal.SimpleAPIFilter

examples/quickstarts/helidon-quickstart-mp/src/main/resources/META-INF/microprofile-config.properties

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2018, 2020 Oracle and/or its affiliates.
+# Copyright (c) 2018, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,3 +23,4 @@ server.host=0.0.0.0
 
 # Enable the optional MicroProfile Metrics REST.request metrics
 metrics.rest-request.enabled=true
+metrics.permit-all=true

examples/quickstarts/helidon-quickstart-se/src/main/java/io/helidon/examples/quickstart/se/Main.java

@@ -16,6 +16,7 @@
 
 package io.helidon.examples.quickstart.se;
 
+import io.helidon.config.Config;
 import io.helidon.logging.common.LogConfig;
 import io.helidon.openapi.OpenApiFeature;
 import io.helidon.webserver.WebServer;
@@ -42,8 +43,10 @@ public static void main(String[] args) {
         // load logging configuration
         LogConfig.configureRuntime();
 
+        Config config = Config.create();
+
         WebServer server = WebServer.builder()
-                .routing(Main::routing)
+                .routing(r -> routing(r, config))
                 .build()
                 .start();
 
@@ -53,11 +56,11 @@ public static void main(String[] args) {
     /**
      * Updates HTTP Routing and registers observe providers.
      */
-    static void routing(HttpRouting.Builder routing) {
+    static void routing(HttpRouting.Builder routing, Config config) {
         OpenApiFeature openApi = OpenApiFeature.builder().build();
         GreetService greetService = new GreetService();
         routing.addFeature(openApi)
                 .register("/greet", greetService)
-                .addFeature(ObserveFeature.create());
+                .addFeature(ObserveFeature.create(config));
     }
 }

examples/quickstarts/helidon-quickstart-se/src/main/resources/application.yaml

@@ -19,4 +19,7 @@ app:
 
 server:
   port: 8080
-  host: 0.0.0.0
+  host: 0.0.0.0
+
+metrics:
+  permit-all: true

examples/quickstarts/helidon-quickstart-se/src/test/java/io/helidon/examples/quickstart/se/MainTest.java

@@ -16,6 +16,7 @@
 
 package io.helidon.examples.quickstart.se;
 
+import io.helidon.config.Config;
 import io.helidon.http.Status;
 import io.helidon.webclient.http1.Http1Client;
 import io.helidon.webclient.http1.Http1ClientResponse;
@@ -40,7 +41,7 @@ protected MainTest(Http1Client client) {
 
     @SetUpRoute
     static void routing(HttpRouting.Builder builder) {
-        Main.routing(builder);
+        Main.routing(builder, Config.create());
     }
 
     @Test

examples/quickstarts/helidon-standalone-quickstart-mp/src/main/resources/META-INF/microprofile-config.properties

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2019, 2020 Oracle and/or its affiliates.
+# Copyright (c) 2019, 2023 Oracle and/or its affiliates.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,3 +23,4 @@ server.host=0.0.0.0
 
 # Enable the optional MicroProfile Metrics REST.request metrics
 metrics.rest-request.enabled=true
+metrics.permit-all=true

examples/quickstarts/helidon-standalone-quickstart-se/src/main/java/io/helidon/examples/quickstart/se/Main.java

@@ -16,6 +16,7 @@
 
 package io.helidon.examples.quickstart.se;
 
+import io.helidon.config.Config;
 import io.helidon.logging.common.LogConfig;
 import io.helidon.webserver.WebServer;
 import io.helidon.webserver.http.HttpRouting;
@@ -41,8 +42,10 @@ public static void main(String[] args) {
         // load logging configuration
         LogConfig.configureRuntime();
 
+        Config config = Config.create();
+
         WebServer server = WebServer.builder()
-                .routing(Main::routing)
+                .routing(r -> routing(r, config))
                 .build()
                 .start();
 
@@ -52,9 +55,9 @@ public static void main(String[] args) {
     /**
      * Updates HTTP Routing and registers observe providers.
      */
-    static void routing(HttpRouting.Builder routing) {
+    static void routing(HttpRouting.Builder routing, Config config) {
         GreetService greetService = new GreetService();
         routing.register("/greet", greetService)
-                .addFeature(ObserveFeature.create());
+                .addFeature(ObserveFeature.create(config));
     }
 }

examples/quickstarts/helidon-standalone-quickstart-se/src/main/resources/application.yaml

@@ -19,4 +19,7 @@ app:
 
 server:
   port: 8080
-  host: 0.0.0.0
+  host: 0.0.0.0
+
+metrics:
+  permit-all: true

examples/quickstarts/helidon-standalone-quickstart-se/src/test/java/io/helidon/examples/quickstart/se/MainTest.java

@@ -16,6 +16,7 @@
 
 package io.helidon.examples.quickstart.se;
 
+import io.helidon.config.Config;
 import io.helidon.http.Status;
 import io.helidon.webclient.http1.Http1Client;
 import io.helidon.webclient.http1.Http1ClientResponse;
@@ -40,7 +41,7 @@ protected MainTest(Http1Client client) {
 
     @SetUpRoute
     static void routing(HttpRouting.Builder builder) {
-        Main.routing(builder);
+        Main.routing(builder, Config.create());
     }
 
     @Test

metrics/api/src/main/java/io/helidon/metrics/api/MetricsConfigBlueprint.java

@@ -129,6 +129,14 @@ static List<Tag> createTags(String pairs) {
     @ConfiguredOption("true")
     boolean enabled();
 
+    /**
+     * Whether metrics endpoint should be authorized.
+     *
+     * @return if metrics are configured to be authorized
+     */
+    @ConfiguredOption("true")
+    boolean permitAll();
+
     /**
      * Key performance indicator metrics settings.
      *

microprofile/metrics/src/test/java/io/helidon/microprofile/metrics/HelloWorldTest.java

@@ -54,6 +54,7 @@
  */
 @HelidonTest
 @AddConfig(key = "metrics." + MetricsCdiExtension.REST_ENDPOINTS_METRIC_ENABLED_PROPERTY_NAME, value = "true")
+@AddConfig(key = "metrics.permit-all", value = "true")
 class HelloWorldTest {
 
     @Inject

microprofile/openapi/src/test/java/io/helidon/microprofile/openapi/BasicServerTest.java

@@ -19,6 +19,7 @@
 
 import io.helidon.http.Status;
 import io.helidon.microprofile.tests.junit5.AddBean;
+import io.helidon.microprofile.tests.junit5.AddConfig;
 import io.helidon.microprofile.tests.junit5.HelidonTest;
 import io.helidon.openapi.OpenApiFeature;
 
@@ -39,6 +40,7 @@
 @HelidonTest
 @AddBean(TestApp.class)
 @AddBean(TestApp3.class)
+@AddConfig(key = "openapi.permit-all", value = "true")
 public class BasicServerTest {
 
     private static Map<String, Object> yaml;

microprofile/openapi/src/test/resources/serverConfig.yml

@@ -15,5 +15,6 @@
 #
 
 openapi:
+    permit-all: true
     web-context: /otheropenapi
     port: 0

microprofile/tests/tck/tck-openapi/src/test/resources/application.yaml

@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2023 Oracle and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+openapi:
+  permit-all: true