feat: adopt framework monitoring defaults

pom.xml

@@ -7,11 +7,11 @@
     <parent>
         <artifactId>opensabre-base-dependencies</artifactId>
         <groupId>io.github.opensabre</groupId>
-        <version>1.1.3</version>
+        <version>1.1.4</version>
     </parent>
 
     <artifactId>base-sysadmin</artifactId>
-    <version>1.1.3</version>
+    <version>1.1.4</version>
     <packaging>jar</packaging>
 
     <name>base-sysadmin</name>
@@ -65,6 +65,18 @@
             <groupId>io.github.opensabre</groupId>
             <artifactId>opensabre-starter-governance</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.github.opensabre</groupId>
+            <artifactId>opensabre-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.github.opensabre</groupId>
+            <artifactId>opensabre-starter-webmvc</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.github.opensabre</groupId>
+            <artifactId>opensabre-starter-monitoring</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.github.opensabre</groupId>
             <artifactId>opensabre-starter-eda</artifactId>
@@ -77,17 +89,6 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
         </dependency>
-        <!-- Boot 4 OpenAPI endpoints and Knife4j user interface. -->
-        <dependency>
-            <groupId>org.springdoc</groupId>
-            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-            <version>3.0.3</version>
-        </dependency>
-        <dependency>
-            <groupId>com.github.xiaoymin</groupId>
-            <artifactId>knife4j-openapi3-ui</artifactId>
-            <version>4.5.0</version>
-        </dependency>
         <!--测试框架-->
         <dependency>
             <groupId>org.springframework.boot</groupId>

src/main/java/io/github/opensabre/sysadmin/internaltoken/config/InternalTokenManagementSecurityConfiguration.java

@@ -1,5 +1,7 @@
 package io.github.opensabre.sysadmin.internaltoken.config;
 
+import io.github.opensabre.security.actuator.ActuatorMonitoringAccess;
+import io.github.opensabre.security.webmvc.InternalTokenAuthenticationFilter;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.convert.converter.Converter;
@@ -10,6 +12,7 @@
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
 import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
+import org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter;
 import org.springframework.security.web.SecurityFilterChain;
 
 /**
@@ -21,17 +24,23 @@ public class InternalTokenManagementSecurityConfiguration {
     private static final String MANAGEMENT_PATH = "/security/internal-token/keys/**";
 
     @Bean
-    public SecurityFilterChain sysadminSecurityFilterChain(HttpSecurity http)
+    public SecurityFilterChain sysadminSecurityFilterChain(
+            HttpSecurity http,
+            InternalTokenAuthenticationFilter internalTokenAuthenticationFilter)
             throws Exception {
         http
                 .csrf(csrf -> csrf.disable())
                 .sessionManagement(session ->
                         session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authorizeHttpRequests(authorize -> authorize
                         .requestMatchers(MANAGEMENT_PATH).hasAuthority("ADMIN")
+                        .requestMatchers(ActuatorMonitoringAccess.metricPathArray())
+                        .hasAuthority(ActuatorMonitoringAccess.AUTHORITY)
                         .anyRequest().permitAll())
                 .oauth2ResourceServer(resourceServer -> resourceServer
-                        .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())));
+                        .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())))
+                .addFilterBefore(internalTokenAuthenticationFilter,
+                        BearerTokenAuthenticationFilter.class);
         return http.build();
     }
 

src/main/resources/application.yml

@@ -77,7 +77,7 @@ management:
   endpoints:
     web:
       exposure:
-        include: '*'
+        include: health,info,metrics,prometheus,internalTokenKeyStatus
   tracing:
     sampling:
       probability: 1.0