Support complex wildcard path matching for authorization of web endpoints

[codependent]

Description
According to the documentation path matching supports wildcards at the end of the path:

Permission sets can also specify paths and methods as a comma separated list. If a path ends with * then it is considered to be a wildcard match and will match all sub paths, otherwise it is an exact match and will only match that specific path

There is a clear limitation regarding the usage of wildcards which doesn't allow us to compose complex authorization expressions.

This use case has come across in many occasions, in which I have an API which requires an authorization config like:

/api/clients/{clientid}/accounts -> needs to be private
/api/clients/{clientid}/public-profile -> needs to be public

This could be configured like this:

quarkus:
  http:
    port: 8081
    cors: false
    auth:
      permission:
        permit1:
          policy: permit
          paths: /api/clientes/*/public-profile
          methods: GET,HEAD,POST,PUT,OPTION,PATCH
        authenticated:
          policy: authenticated
          paths: /api/clientes/*/accounts
          methods: GET,HEAD,POST,PUT,OPTION,PATCH

However this isn't supported since wildcards are only allowed at the end of the path.

Could you consider supporting it?

[sberyozkin]

CC @stuartwdouglas

[promosrene]

Is there any hint as to how the requirement can be fulfilled?

[quarkus-bot]

/cc @sberyozkin

[sonnb]

I am having the same issue in which I need to use the wildcard both at the beginning and the end of the path. Sometimes it works sometimes not. I cannot make public path stable enough to be used.

[sonnb]

Our resource has something like:

@Path("{tenant}/data/resources/tenants")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public class TenantResource {

And the application.properties

#Public path
quarkus.http.auth.permission.tenants.paths=*/data/resources/tenants/*
quarkus.http.auth.permission.tenants.policy=permit
#HTTP Security Configuration
quarkus.http.auth.permission.authenticated.paths=*
quarkus.http.auth.permission.authenticated.policy=authenticated

[michalvavrik]

I am having the same issue in which I need to use the wildcard both at the beginning and the end of the path. Sometimes it works sometimes not. I cannot make public path stable enough to be used.

Hey @sonnb wildcards are only supported at the end. We should implement this issue though, I am going to have a look.