{"id":13788059,"url":"https://github.com/jferrater/opa-data-filter-spring-boot-starter","last_synced_at":"2025-09-11T17:36:26.919Z","repository":{"id":55877854,"uuid":"241153419","full_name":"jferrater/opa-data-filter-spring-boot-starter","owner":"jferrater","description":"Spring Boot library for enforcing authorization on Spring Data JPA and MongoDB by filtering data using the Open Policy Agent (OPA) partial evaluation feature.","archived":false,"fork":false,"pushed_at":"2023-12-20T08:49:17.000Z","size":23119,"stargazers_count":25,"open_issues_count":4,"forks_count":5,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-01-31T18:28:20.289Z","etag":null,"topics":["authorization","cloud-native","datafilter","java","java-library","mongodb","opa","opa-data-filter","openpolicyagent","spring-data-jpa","spring-data-mongo","springboot","sqldb"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jferrater.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"custom":["https://www.paypal.me/JFerrater"]}},"created_at":"2020-02-17T16:22:34.000Z","updated_at":"2024-11-20T11:20:20.000Z","dependencies_parsed_at":"2024-01-06T02:13:42.929Z","dependency_job_id":"58874744-714f-4769-89cc-05e703bc5f0e","html_url":"https://github.com/jferrater/opa-data-filter-spring-boot-starter","commit_stats":{"total_commits":223,"total_committers":5,"mean_commits":44.6,"dds":0.1659192825112108,"last_synced_commit":"70294d0221b65b99cfa57f8ba459de726540e24a"},"previous_names":["jferrater/opa-ast-to-sql-query-java"],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jferrater%2Fopa-data-filter-spring-boot-starter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jferrater%2Fopa-data-filter-spring-boot-starter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jferrater%2Fopa-data-filter-spring-boot-starter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jferrater%2Fopa-data-filter-spring-boot-starter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jferrater","download_url":"https://codeload.github.com/jferrater/opa-data-filter-spring-boot-starter/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238310345,"owners_count":19450842,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","cloud-native","datafilter","java","java-library","mongodb","opa","opa-data-filter","openpolicyagent","spring-data-jpa","spring-data-mongo","springboot","sqldb"],"created_at":"2024-08-03T21:00:35.718Z","updated_at":"2025-02-11T14:32:26.920Z","avatar_url":"https://github.com/jferrater.png","language":"Java","funding_links":["https://www.paypal.me/JFerrater"],"categories":["Datasource Integrations"],"sub_categories":["Blogs and Articles"],"readme":"# Data Filtering on Spring Data with Open Policy Agent\n[![Build Status](https://travis-ci.com/jferrater/opa-data-filter-spring-boot-starter.svg?branch=master)](https://travis-ci.com/jferrater/opa-data-filter-spring-boot-starter)\n\n### opa-datafilter-jpa-spring-boot-starter \n[![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.github.jferrater/opa-datafilter-jpa-spring-boot-starter/badge.svg)](https://search.maven.org/artifact/com.github.jferrater/opa-datafilter-jpa-spring-boot-starter/0.5.1/jar)\n[![SonarCloud Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=jferrater_opa-datafilter-jpa-spring-boot-starter\u0026metric=alert_status)](https://sonarcloud.io/dashboard?id=jferrater_opa-datafilter-jpa-spring-boot-starter)\n\n### opa-datafilter-mongo-spring-boot-starter\n[![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.github.jferrater/opa-datafilter-mongo-spring-boot-starter/badge.svg)](https://search.maven.org/artifact/com.github.jferrater/opa-datafilter-mongo-spring-boot-starter/0.5.1/jar)\n[![SonarCloud Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=jferrater_opa-datafilter-mongo-spring-boot-starter\u0026metric=alert_status)](https://sonarcloud.io/dashboard?id=jferrater_opa-datafilter-mongo-spring-boot-starter)\n\n### Pre-requisites\nThe blog posts below explain enough of the What and Why!\n- Read about Open Policy Agent Partial (OPA) Evaluation blog post [here](https://blog.openpolicyagent.org/partial-evaluation-162750eaf422)\n- Read the sample use case, [Write Policy in OPA. Enforce Policy in SQL](https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4)\n- The [OPA Compile API](https://www.openpolicyagent.org/docs/latest/rest-api/#compile-api)\n\u003cbr\u003e\n\n### The Libraries\nopa-datafilter-jpa-spring-boot-starter and opa-datafilter-mongo-spring-boot-starter are Spring Boot libraries which can be used together with Spring Data JPA and Spring Data MongoDB, respectively, to enforce authorization on data by filtering using OPA Partial Evaluation feature.\nWhen a user wants to access a protected collection of resources, the libraries create a partial request object which contains about the user and the operation a user wants to perform. The partial request object is\nsent to the OPA [compile API](https://www.openpolicyagent.org/docs/latest/rest-api/#compile-api).\nOPA evaluates the partial request and returns a new and simplified policy that can be evaluated more efficiently than the original policy. These libraries convert\nthe new policy, the OPA compile API response, into SQL or MongoDB queries. A filtered collection of data is returned to the user which a user is allowed to see.\n\n![Spring Boot App with OPA Data Filter](https://github.com/jferrater/opa-data-filter-spring-boot-starter/blob/master/diagram.png)\n\n### Open Policy Agent Supported Version\n - Tested in OPA v0.25.0 and below\n\n### Supported Spring Data `findAll` methods\nThe libraries override Spring Data methods:\n- findAll()\n- findAll(Sort sort)\n- findAll(Pageable pageable)\n\n## Installation and Usage\nSee each individual folder for installation and usage instructions.\n- [opa-datafilter-jpa-spring-boot-starter](opa-datafilter-jpa-spring-boot-starter/README.md)\n- [opa-datafilter-mongo-spring-boot-starter](opa-datafilter-mongo-spring-boot-starter/README.md)\n\n## Query Verification\nTo verify how the SQL or MongoDB query looks like, use the [opa-datafilter-datafilter-query-service](opa-datafilter-query-service) or the the docker image, [opa-query-service](https://hub.docker.com/r/jmferrater/opa-query-service). The service provides an API for translating OPA partial request object into a SQL or MongoDB query.\n\n## Configurations\n| Properties                                            | Type                | Default Value                    | Description                                                                                                                                                                                                                                                  | Required |\n|-------------------------------------------------------|---------------------|----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|\n| opa.authorization.url                                 | String              | http://localhost:8181/v1/compile | The OPA compile API endpoint.                                                                                                                                                                                                                                | Yes      |\n| opa.authorization.data-filter-enabled                 | Boolean             | true                             | Enable OPA data filter authorization                                                                                                                                                                                                                         | No       |\n| opa.partial-request.log-partial-request               | Boolean             | false                            | Log the partial request json which was sent to OPA on std out for debugging                                                                                                                                                                                  | No       |\n| opa.partial-request.query                             | String              |                                  | The query to partially evaluate and compile                                                                                                                                                                                                                  | Yes      |\n| opa.partial-request.unknowns                          | Set\u003cString\u003e         |                                  | The terms to treat as unknown during partial evaluation                                                                                                                                                                                                      | Yes       |\n| opa.partial-request.user-attribute-to-http-header-map | Map\u003cString, String\u003e |                                  | The mapping of user attribute to Http Header. These mappings will be added as subject attributes\u003cbr\u003ein the input of the partial request. The key will be set as the attribute name and the value \u003cbr\u003eof the Http header will be set as the value of the key. | No       |\n\n\n## Example Spring Boot Applications\nSee example Spring Boot microservice applications that use these libraries:\n - [opa-datafilter-jpa-demo](https://github.com/jferrater/opa-data-filter-jpa-demo)\n - [opa-datafilter-mongo-demo](https://github.com/jferrater/opa-data-filter-mongo-demo)\n\n## The Partial Request\n\n### Default Partial Request\n When the `findAll` method is invoked from `OpaDataFilterRepository` interface, a partial request object is sent\n to the [OPA compile API](https://www.openpolicyagent.org/docs/latest/rest-api/#compile-api) endpoint. The default partial request is the following:\n ````json\n{\n\t\"query\": \"data.petclinic.authz.allow = true\",\n\t\"input\": {\n\t\t\"path\": [\"pets\"],\n\t\t\"method\": \"GET\",\n\t\t\"subject\": {\n\t\t\t\"user\": \"alice\",\n\t\t\t\"jwt\": \"\u003cjwt token\u003e\"\n\t\t}\n\t},\n\t\"unknowns\": [\"data.pets\"]\n}\n````\nwhere: \u003cbr\u003e\n- `query` - is the value of `opa.partial-request.query` from the configuration property.\n- `input` - by default http servlet path and method are added as `path` and `method` respectively. The `subject` (the current user) by default has `user` property\nwhich is derived from Authorization Basic header if it exists and `jwt` property from the Authorization Bearer header if it exists.\n- `unknowns` - the value of `opa.partial-request.unknowns` from the configuration property.\n\n### Adding Attributes to the Default Partial Request\nIt is possible to add attributes to the `subject` property of the default partial request. This can be done by mapping the attribute to the Http header using\na configuration `opa.partial-request.user-attribute-to-http-header-map`. For example:\n````yaml\nopa:\n  partial-request:\n    log-partial-request: true\n    user-attribute-to-http-header-map:\n      organization: X-ORG-HEADER\n````\nThe `organization` is key of the attribute and the value of the `X-ORG-HEADER` http header is the value of the key. The partial request will\nlook like the following:\n````json\n{\n\t\"query\": \"data.petclinic.authz.allow = true\",\n\t\"input\": {\n\t\t\"path\": [\"pets\"],\n\t\t\"method\": \"GET\",\n\t\t\"subject\": {\n\t\t\t\"user\": \"alice\",\n\t\t\t\"attributes\": {\n\t\t\t\t\"organization\": \"SOMA\"\n\t\t\t}\n\t\t}\n\t},\n\t\"unknowns\": [\"data.pets\"]\n}\n````\n\n### Contributors\n- [Joffry Ferrater](https://github.com/jferrater)\n- [Reihmon Estremos](https://github.com/mongkoy)\n- [Jolly Jae Ompod](https://github.com/ompodjol)\n- [Alvin Difuntorum](https://github.com/alvinpd)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjferrater%2Fopa-data-filter-spring-boot-starter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjferrater%2Fopa-data-filter-spring-boot-starter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjferrater%2Fopa-data-filter-spring-boot-starter/lists"}