IGNITE-28670 Add support for custom REST HTTP endpoint extensions

modules/core/src/main/java/org/apache/ignite/internal/processors/rest/GridRestProcessor.java

@@ -89,6 +89,7 @@
 import org.apache.ignite.plugin.security.SecurityException;
 import org.apache.ignite.plugin.security.SecurityPermission;
 import org.apache.ignite.thread.IgniteThread;
+import org.jetbrains.annotations.Nullable;
 
 import static org.apache.ignite.IgniteSystemProperties.IGNITE_REST_SECURITY_TOKEN_TIMEOUT;
 import static org.apache.ignite.IgniteSystemProperties.IGNITE_REST_SESSION_TIMEOUT;
@@ -237,6 +238,13 @@ protected IgniteInternalFuture<GridRestResponse> handleAsync0(final GridRestRequ
         }
     }
 
+    /** @return Security context for given session token, or {@code null} if none found. */
+    @Nullable public SecurityContext securityContext(UUID sesId) {
+        Session ses = sesId2Ses.get(sesId);
+
+        return ses == null ? null : ses.secCtx;
+    }
+
     /**
      * @param req Request.
      * @return Future.

modules/rest-http/pom.xml

@@ -82,6 +82,12 @@
             <version>${jetty.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-servlet</artifactId>
+            <version>${jetty.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>org.eclipse.jetty.toolchain</groupId>
             <artifactId>jetty-jakarta-servlet-api</artifactId>

modules/rest-http/src/main/java/org/apache/ignite/internal/processors/rest/protocols/http/jetty/AuthenticationFilter.java

@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.internal.processors.rest.protocols.http.jetty;
+
+import java.io.IOException;
+import java.util.UUID;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.apache.ignite.internal.GridKernalContext;
+import org.apache.ignite.internal.processors.rest.GridRestProcessor;
+import org.apache.ignite.internal.processors.security.SecurityContext;
+import org.apache.ignite.internal.thread.context.Scope;
+import org.apache.ignite.internal.util.typedef.internal.U;
+import org.jetbrains.annotations.Nullable;
+
+/**
+ * Servlet filter that authenticates REST requests via session token.
+ */
+public class AuthenticationFilter implements Filter {
+    /** */
+    private final GridKernalContext ctx;
+
+    /** */
+    public AuthenticationFilter(GridKernalContext ctx) {
+        this.ctx = ctx;
+    }
+
+    /** {@inheritDoc} */
+    @Override public void doFilter(
+        ServletRequest req,
+        ServletResponse res,
+        FilterChain chain
+    ) throws IOException, ServletException {
+        SecurityContext secCtx = resolveSession((HttpServletRequest)req);
+
+        if (secCtx == null) {
+            ((HttpServletResponse)res).sendError(HttpServletResponse.SC_UNAUTHORIZED,
+                "Missing or invalid authentication token (maybe expired session)");
+
+            return;
+        }
+
+        try (Scope ignored = ctx.security().withContext(secCtx)) {
+            chain.doFilter(req, res);
+        }
+    }
+
+    /** @return Security context for given session token, or {@code null} if none found. */
+    @Nullable private SecurityContext resolveSession(HttpServletRequest req) {
+        String token = req.getParameter("sessionToken");
+
+        if (token == null)
+            return null;
+
+        try {
+            UUID sesId = U.bytesToUuid(U.hexString2ByteArray(token), 0);
+
+            return ((GridRestProcessor)ctx.rest()).securityContext(sesId);
+        }
+        catch (Exception ignored) {
+            return null;
+        }
+    }
+}

modules/rest-http/src/main/java/org/apache/ignite/internal/processors/rest/protocols/http/jetty/GridJettyRestHandler.java

@@ -17,15 +17,9 @@
 
 package org.apache.ignite.internal.processors.rest.protocols.http.jetty;
 
-import java.io.BufferedInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.LineNumberReader;
 import java.io.OutputStream;
 import java.net.InetSocketAddress;
-import java.nio.charset.StandardCharsets;
 import java.security.cert.X509Certificate;
 import java.sql.Date;
 import java.sql.Time;
@@ -100,8 +94,8 @@
  * Jetty REST handler. The following URL format is supported: {@code /ignite?cmd=cmdName&param1=abc&param2=123}
  */
 public class GridJettyRestHandler extends AbstractHandler {
-    /** Used to sent request charset. */
-    private static final String CHARSET = StandardCharsets.UTF_8.name();
+    /** */
+    public static final String IGNITE_CMD_PATH = "/ignite";
 
     /** */
     private static final String FAILED_TO_PARSE_FORMAT = "Failed to parse parameter of %s type [%s=%s]";
@@ -148,12 +142,6 @@ public class GridJettyRestHandler extends AbstractHandler {
     /** Request handlers. */
     private GridRestProtocolHandler hnd;
 
-    /** Default page. */
-    private volatile String dfltPage;
-
-    /** Favicon. */
-    private volatile byte[] favicon;
-
     /** Mapper from Java object to JSON. */
     private final ObjectMapper jsonMapper;
 
@@ -175,27 +163,6 @@ public class GridJettyRestHandler extends AbstractHandler {
         this.authChecker = authChecker;
         this.log = ctx.log(getClass());
         this.jsonMapper = new IgniteObjectMapper(ctx);
-
-        // Init default page and favicon.
-        try {
-            initDefaultPage();
-
-            if (log.isDebugEnabled())
-                log.debug("Initialized default page.");
-        }
-        catch (IOException e) {
-            U.warn(log, "Failed to initialize default page: " + e.getMessage());
-        }
-
-        try {
-            initFavicon();
-
-            if (log.isDebugEnabled())
-                log.debug(favicon != null ? "Initialized favicon, size: " + favicon.length : "Favicon is null.");
-        }
-        catch (IOException e) {
-            U.warn(log, "Failed to initialize favicon: " + e.getMessage());
-        }
     }
 
     /**
@@ -302,113 +269,14 @@ private static int intValue(String key, Map<String, String> params, int dfltVal)
         }
     }
 
-    /**
-     * @throws IOException If failed.
-     */
-    private void initDefaultPage() throws IOException {
-        assert dfltPage == null;
-
-        InputStream in = getClass().getResourceAsStream("rest.html");
-
-        if (in != null) {
-            LineNumberReader rdr = new LineNumberReader(new InputStreamReader(in, CHARSET));
-
-            try {
-                StringBuilder buf = new StringBuilder(2048);
-
-                for (String line = rdr.readLine(); line != null; line = rdr.readLine()) {
-                    buf.append(line);
-
-                    if (!line.endsWith(" "))
-                        buf.append(' ');
-                }
-
-                dfltPage = buf.toString();
-            }
-            finally {
-                U.closeQuiet(rdr);
-            }
-        }
-    }
-
-    /**
-     * @throws IOException If failed.
-     */
-    private void initFavicon() throws IOException {
-        assert favicon == null;
-
-        InputStream in = getClass().getResourceAsStream("favicon.ico");
-
-        if (in != null) {
-            BufferedInputStream bis = new BufferedInputStream(in);
-
-            ByteArrayOutputStream bos = new ByteArrayOutputStream();
-
-            try {
-                byte[] buf = new byte[2048];
-
-                while (true) {
-                    int n = bis.read(buf);
-
-                    if (n == -1)
-                        break;
-
-                    bos.write(buf, 0, n);
-                }
-
-                favicon = bos.toByteArray();
-            }
-            finally {
-                U.closeQuiet(bis);
-            }
-        }
-    }
-
     /** {@inheritDoc} */
-    @Override public void handle(String target, Request req, HttpServletRequest srvReq, HttpServletResponse res)
-        throws IOException {
+    @Override public void handle(String target, Request req, HttpServletRequest srvReq, HttpServletResponse res) {
         if (log.isDebugEnabled())
             log.debug("Handling request [target=" + target + ", req=" + req + ", srvReq=" + srvReq + ']');
 
-        if (target.startsWith("/ignite")) {
+        if (target.startsWith(IGNITE_CMD_PATH)) {
             processRequest(target, srvReq, res);
 
-            req.setHandled(true);
-        }
-        else if (target.startsWith("/favicon.ico")) {
-            if (favicon == null) {
-                res.setStatus(HttpServletResponse.SC_NOT_FOUND);
-
-                req.setHandled(true);
-
-                return;
-            }
-
-            res.setStatus(HttpServletResponse.SC_OK);
-
-            res.setContentType("image/x-icon");
-
-            res.getOutputStream().write(favicon);
-            res.getOutputStream().flush();
-
-            req.setHandled(true);
-        }
-        else {
-            if (dfltPage == null) {
-                res.setStatus(HttpServletResponse.SC_NOT_FOUND);
-
-                req.setHandled(true);
-
-                return;
-            }
-
-            res.setStatus(HttpServletResponse.SC_OK);
-
-            res.setContentType("text/html");
-
-            res.getWriter().write(dfltPage);
-            res.getWriter().flush();
-
             req.setHandled(true);
         }
     }