Skip to content

Migrate SpringFox SecurityConfiguration bean to Springdoc properties#1012

Open
steve-aom-elliott wants to merge 1 commit intomainfrom
springfox-security-configuration-migration
Open

Migrate SpringFox SecurityConfiguration bean to Springdoc properties#1012
steve-aom-elliott wants to merge 1 commit intomainfrom
springfox-security-configuration-migration

Conversation

@steve-aom-elliott
Copy link
Copy Markdown
Contributor

Summary

Adds a new recipe MigrateSpringFoxSecurityConfiguration that translates @Bean methods returning springfox.documentation.swagger.web.SecurityConfiguration into the equivalent springdoc.swagger-ui.* configuration properties on the existing application.properties or application.yml file. The bean and its now-unused imports are removed once the properties have been written.

The recipe is wired into the SpringFoxToSpringDoc chain after SecurityContextToSecurityScheme, closing a gap where SpringFox security UI configuration beans were left behind by the migration.

Builder method to property mapping

Builder method Property
clientId springdoc.swagger-ui.oauth.client-id
clientSecret springdoc.swagger-ui.oauth.client-secret
realm springdoc.swagger-ui.oauth.realm
appName springdoc.swagger-ui.oauth.app-name
scopeSeparator springdoc.swagger-ui.oauth.scope-separator
useBasicAuthenticationWithAccessCodeGrant springdoc.swagger-ui.oauth.use-basic-authentication-with-access-code-grant
enableCsrfSupport springdoc.swagger-ui.csrf.enabled

Conservative semantics

  • Only literal builder arguments are migrated; chains with non-literal arguments are left untouched for manual review.
  • Unsupported builder methods (apiKey, apiKeyName, apiKeyVehicle, additionalQueryStringParams) cause the chain to be skipped — Springdoc has no direct property equivalents.
  • If no Spring application configuration file exists in the project, the bean is left in place rather than silently dropping configuration.

Test plan

  • New tests in MigrateSpringFoxSecurityConfigurationTest cover the enableCsrfSupport literal case, multiple builder calls, YAML output, and the three opt-out scenarios (non-literal arg, unsupported method, non-@Bean method).
  • Existing spring.doc.* and springdoc.* tests continue to pass.
  • recipes.csv regenerated via ./gradlew recipeCsvGenerate.

Replace `@Bean` methods returning `springfox.documentation.swagger.web.SecurityConfiguration`
with the equivalent `springdoc.swagger-ui.*` configuration properties on the
existing `application.properties` or `application.yml` file.

Only literal builder arguments are migrated; beans with non-literal arguments
or unsupported builder methods (`apiKey`, `apiKeyName`, `apiKeyVehicle`,
`additionalQueryStringParams`) are left untouched for manual review. If no
Spring application configuration file exists, the bean is left in place to
avoid silently dropping configuration.

The recipe is wired into the `SpringFoxToSpringDoc` chain after
`SecurityContextToSecurityScheme`.
@github-project-automation github-project-automation Bot moved this to In Progress in OpenRewrite Apr 30, 2026
@steve-aom-elliott steve-aom-elliott added enhancement New feature or request recipe Recipe requested test provided labels Apr 30, 2026
@steve-aom-elliott steve-aom-elliott marked this pull request as draft April 30, 2026 15:24
@steve-aom-elliott steve-aom-elliott marked this pull request as ready for review April 30, 2026 15:54
@steve-aom-elliott steve-aom-elliott moved this from In Progress to Ready to Review in OpenRewrite May 1, 2026
@steve-aom-elliott
Copy link
Copy Markdown
Contributor Author

Seems green now following the fix in openrewrite/rewrite

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request recipe Recipe requested test provided

Projects

Status: Ready to Review

Development

Successfully merging this pull request may close these issues.

1 participant