summer-security

What problem does it solve?

This Skill removes the complexity of wiring APISIX JWT forwarding, X-Userinfo decoding, and Keycloak-based role management into Summer Framework applications so endpoints can be protected by consistent, auditable resource-based roles.

Core Features & Use Cases

• APISIX integration: Decodes Base64 X-Userinfo into Member objects and enforces stateless security via SecurityWebFilterChain customizers.
• Role management & annotations: Standardizes role strings with @AuthRoles, ResourceDef and FeatureDef and enforces the seven-action convention for resources.
• Reactive Keycloak client & sync: Provides ReactiveKeycloakClient for admin operations and KeycloakRoleSynchronizer to scan @AuthRoles and sync clients, roles, features, and custom attributes at startup.
• Group-role authorization: Optional group-to-role resolution with L1/L2 caching, Redis invalidation channel, and configurable claim names for environments that require group-based access control.
• Error mapping & safety: KeycloakException-to-error-code mapping and rules that prevent leaking secrets in configuration examples.

Quick Start

Use the summer-security skill to integrate APISIX X-Userinfo decoding, configure ReactiveKeycloakClient with your Keycloak server, and run role synchronization for your @AuthRoles-protected resources.