feat: move CORS configuration to Spring Security

.env.example

@@ -0,0 +1,9 @@
+SPRING_PROFILES_ACTIVE=dev
+
+APP_ALLOWED_ORIGINS='http://127.0.0.1:3000, http://localhost:3000'
+
+DB_NAME=EXAMPLE_DB
+DB_USER=EXAMPLE
+DB_PASSWORD=SECRET
+DB_HOST=127.0.0.1
+DB_PORT=5432

.gitignore

@@ -2,5 +2,5 @@
 *.toml
 *.db
 target
-
+.env
 Icon?

Dockerfile

@@ -0,0 +1,16 @@
+# Stage 1: Build
+FROM maven:3.9-eclipse-temurin-21-alpine AS build
+WORKDIR /app
+
+# Copiamos todo el proyecto
+COPY . .
+
+# Compilamos todo el proyecto (todos los módulos)
+RUN mvn clean package -DskipTests
+
+# Stage 2: Run
+FROM openjdk:21-jdk
+WORKDIR /app
+COPY --from=build /app/bootstrap/target/*.jar app.jar
+EXPOSE 8080
+ENTRYPOINT ["java", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005", "-Xmx512m", "-Xms256m", "-jar", "app.jar"]

bootstrap/src/main/resources/application.yml

@@ -1,3 +1,9 @@
+info:
+  app:
+    version: @project.version@
+app:
+  cors:
+    allowed-origins: ${APP_ALLOWED_ORIGINS:http://localhost:8080}
 spring:
   application:
     name: portfolio-api
@@ -5,14 +11,26 @@ spring:
     resources:
       add-mappings: false
 
+  datasource:
+    url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:portfolio}
+    username: ${DB_USER:postgres}
+    password: ${DB_PASSWORD:postgres}
+    driver-class-name: org.postgresql.Driver
+    hikari:
+      maximum-pool-size: 3
+      minimum-idle: 1
+      idle-timeout: 30000
+      connection-timeout: 10000
+      leak-detection-threshold: 10000
+
   jpa:
     hibernate:
-      ddl-auto: update
+      ddl-auto: validate
     properties:
       hibernate.transaction.jta.platform: org.hibernate.engine.transaction.jta.platform.internal.NoJtaPlatform
       hibernate:
-        dialect: org.hibernate.dialect.H2Dialect
         format_sql: true
+        dialect: org.hibernate.dialect.PostgreSQLDialect
     show-sql: true
 
   jackson:
@@ -29,38 +47,8 @@ server:
   port: 8080
   servlet:
     context-path: /api
+  forward-headers-strategy: framework
 
----
 
-spring:
-  config:
-    activate:
-      on-profile: default
 
-  datasource:
-    url: jdbc:h2:file:./portfolio-db
-    driver-class-name: org.h2.Driver
-    username: sa
-    password:
 
-  h2:
-    console:
-      enabled: true
-      path: /h2-console
-
----
-
-spring:
-  config:
-    activate:
-      on-profile: prod
-
-  datasource:
-    url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:portfolio}
-    username: ${DB_USER:postgres}
-    password: ${DB_PASSWORD:postgres}
-    driver-class-name: org.postgresql.Driver
-
-  jpa:
-    hibernate:
-      ddl-auto: validate

docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  db:
+    image: postgres:15-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${DB_NAME}
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+    ports:
+      - "5432:5432"
+    networks:
+      network:
+    volumes:
+      - db_data:/var/lib/postgresql/data
+
+  api:
+    build: .
+    restart: unless-stopped
+    ports:
+      - "8095:8080"
+    networks:
+      network:
+    environment:
+      DB_NAME: ${DB_NAME}
+      DB_HOST: ${DB_HOST}
+      DB_PORT: ${DB_PORT}
+      DB_USER: ${DB_USER}
+      DB_PASSWORD: ${DB_PASSWORD}
+      APP_ALLOWED_ORIGINS: ${APP_ALLOWED_ORIGINS}
+    depends_on:
+      - db
+
+volumes:
+  db_data:
+
+networks:
+  network:
+    driver: bridge

infrastructure/pom.xml

@@ -33,6 +33,11 @@
             <artifactId>spring-boot-starter-validation</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+
         <!-- MapStruct -->
         <dependency>
             <groupId>org.mapstruct</groupId>

infrastructure/src/main/java/com/pablotj/portfolio/infrastructure/config/CorsConfig.java

@@ -1,17 +1,34 @@
 package com.pablotj.portfolio.infrastructure.config;
 
+import java.util.Arrays;
+import java.util.List;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
 @Configuration
-public class CorsConfig implements WebMvcConfigurer {
+public class CorsConfig {
 
-    @Override
+    @Value("${app.cors.allowed-origins}")
-    public void addCorsMappings(CorsRegistry registry) {
+    private String allowedOriginsString;
-        registry.addMapping("/**") // todos los endpoints que comiencen con /api/
+
-                .allowedOrigins("http://127.0.0.1:3000", "http://localhost:3000", "https://pablotj.com")
+    @Bean
-                .allowedMethods("GET", "POST", "PUT", "DELETE")
+    public CorsConfigurationSource corsConfigurationSource() {
-                .allowedHeaders("*");
+        CorsConfiguration config = new CorsConfiguration();
+
+        List<String> allowedOrigins = Arrays.asList(allowedOriginsString.split(","));
+        config.setAllowedOriginPatterns(allowedOrigins);
+
+        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
+        config.setAllowedHeaders(List.of("*"));
+        config.setAllowCredentials(true);
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+
+        return source;
     }
 }

infrastructure/src/main/java/com/pablotj/portfolio/infrastructure/config/SecurityConfig.java

@@ -0,0 +1,31 @@
+package com.pablotj.portfolio.infrastructure.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.web.cors.CorsConfigurationSource;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    private final CorsConfigurationSource corsConfigurationSource;
+
+    public SecurityConfig(CorsConfigurationSource corsConfigurationSource) {
+        this.corsConfigurationSource = corsConfigurationSource;
+    }
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+                .csrf(AbstractHttpConfigurer::disable)
+                .cors(cors -> cors.configurationSource(corsConfigurationSource))
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()
+                );
+        return http.build();
+    }
+}