DEV Community: Luciano Pinheiro

Custom annotation to check authorization in Spring

Luciano Pinheiro — Mon, 22 Apr 2024 06:54:01 +0000

In Spring, we have the ability to apply custom annotations to methods, classes, or fields, in order to execute specific actions before or after the annotated object. This is achieved through Aspect-Oriented Programming (AOP).

To implement this solution, we need to create both a custom annotation and a method that will be triggered when the application encounters the annotation. Annotations serve as markers, indicating a specific point in the code, and in order to perform an action, we need to associate that marker with a method from a designated class. Therefore, creating a custom annotation also involves creating an Aspect class/method.

For example, let's consider an annotation that verifies if a person has a particular role. This annotation can be used within methods in a Spring Controller.

Annotation @VerifyAuthorization

To create an annotation, you need to use the syntax below. Please notice:

Use @interface to define the annotation
Use @Retention to choose the policy (usually RUNTIME)
Use @Target to specify the element type (TYPE for class, METHOD, or FIELD)

To create an annotation with parameters, we need to define them as the syntax below.


// define annotation
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD) 
public @interface VerifyAuthorization {
    String value() default "";
}

// use in a controller method
@RestController
public class ThisController {
    @VerifyAuthorization("boss")
    public String save () {...}
}

Aspect Method

With Aspect, we can intercept virtually any call in Java. There are two frameworks for this: Spring AOP and AspectJ. While AspectJ is more flexible, it is also more complex.

To intercept the annotation and execute a specific method before (or after or around) the annotated target, we define what is called advice.

Firstly, we need to install spring-boot-starter-aop if using Spring Boot or AOP and AspectJ if using Spring. There is a trick. AspectJ doesn't search targets automatically. So, we need to enable this feature in a XML or annotation format.

After all installations and configurations are completed, we can create a method and link it to the annotation.

Notice in the syntax:

@aspect annotation for the aspect class
@Component to make it unique
@Before (or @After or @Around) annotation indicating the annotation
JoinPoint holds the method information

Inside the method, we use some objects to access the annotated method and its parameters.

@Aspect
@Component
public class VerifyAuthorizationAdvice {

    @Before("@annotation(com.example.VerifyAuthorization)") 
    public void beforeAnnotation(JoinPoint joinPoint){
        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
        VerifyAuthorization annotation = signature.getMethod().getAnnotation(VerifyAuthorization.class);
        CustomUserSecurity.hasRole(annotation.value());
    }
}

The VerifyAuthorizationAdvice class can include any necessary logic or dependency. In the example, @Before is used to run the method before the annotated one. If an exception is thrown, the original method will not be executed. Alternativelly, @After could be used to run it after the original method, or @Around to replace it. When using @Around, we can control when the original method is executed by calling joinPoint.proceed(); at some point within our advice method.

As you can see, there's a lot more to learn about it, but the main concept is that you need an annotation to mark something and an aspect to intercept it.

HTTP methods definitions

Luciano Pinheiro — Mon, 18 Mar 2024 02:48:42 +0000

For REST, we know we should use URL as endpoint and it should be consistent. It's also presented to us an structure for entities. But let's dive a little on it, ok?

First of all, HTTP standards evolve. Today, there is a lot of HTTP standards. We will concentrate our efforts on the standards that define the HTTP Methods.

The common methods are:

GET
POST
PUT
PATCH
DELETE

The methods GET, POST, PUT, and DELETE are defined in RFC 9110 (HTTP Semantics). The PATCH method is defined on RFC 5789 (Patch Method for HTTP).

Now, we see the definitions of the HTTP Methods.

GET

"The GET method requests transfer of a current selected representation for the target resource. [...] retrieving identifiable information via HTTP is usually performed by making a GET request on an identifier associated with the potential for providing that information in a 200 (OK) response." RFC 9110 section 9.3.1

So, the GET method is indeed a standard or default method to retrieve information.

POST

"The POST method requests that the target resource process the representation enclosed in the request according to the resource's own specific semantics. For example, POST is used for the following functions (among others):

Providing a block of data, such as the fields entered into an HTML form, to a data-handling process;
Posting a message to a bulletin board, newsgroup, mailing list, blog, or similar group of articles;
Creating a new resource that has yet to be identified by the origin server; and
Appending data to a resource's existing representation(s)." RFC 9110 section 9.3.3

POST looks like a general function handling method. If we want to pass data to be handled by some application function, we use POST.

It's surprising that one of the purposes is to create an entity in a list. If guessing, I would say that it would be the intention of the PUT method.

PUT

"The PUT method requests that the state of the target resource be created or replaced with the state defined by the representation enclosed in the request message content." RFC 9110 section 9.3.4

If we are looking for a method that is primarily used to create entities, it's PUT! But ONLY if you have the correct address. If we must add an entity with no pre-defined URL, we must use POST.

There is one problem. HTTP recognizes endpoints as entities. For example, this is the location of user with id = 1000:

/users/1000

But it's common when we add an entity it have not an id. It's created on demand at database. So, at creation, we must visit something like this:

/users

We can't use PUT there because we are not creating an entity on /users. So, we should use POST. It seems not right for me because of the general nature of POST. So, we use PUT to creation, but only in a specific situation. The other 99% of the time we use the general Method POST.

PUT also should be used to update an entity. It allows the application to change (or replace) the entity in the current URL.

DELETE

"The DELETE method requests that the origin server remove the association between the target resource and its current functionality." RFC 9110 section 9.3.5

It's simple and direct. Although we don't have a method to delete many resources at once, relying again on POST.

PATCH

"The PATCH method requests that a set of changes described in the request entity be applied to the resource identified by the Request-URI. The set of changes is represented in a format called a 'patch document' identified by a media type. If the Request-URI does not point to an existing resource, the server MAY create a new resource, depending on the patch document type (whether it can logically modify a null resource) and permissions, etc." RFC 5789

If we need to change a piece of the resource, we can decide to send only the changed field to the entity specified. It's just a patch.

The definition also allows the application to create an non-existing entity at that location.

Meaning PATCH purpose overlaps with PUT.

Conclusion

There is no direct connection between our application entities and HTTP entities. REST try to solve this issue with standard paths (URL) to our entities, but it's not a good match.

That's why we try to use the correct methods (and returns) to handle the REST-based application. But I personally think that we should rethink the role of POST in this play.

For me it seems more natural to use:

GET: for general fetch
POST: for general function, not covered by other methods
PUT: on /collection to create
PATCH: for changing some fields
DELETE: on /collection for multiple deletion

HackerRank Hash Tables: Ice Cream Parlor solution in python

Luciano Pinheiro — Sun, 05 Nov 2023 16:02:49 +0000

This is solution for HackerRank Hash Tables: Ice Cream Parlor challenge, in python. This is a problem in the Interview Preparation Kit > Search Algorithms and is considered of medium difficulty.

The problem

The problem is simple: 2 friends want to buy ice cream and they must spend all their money each trip. some rules:

Every flavor has a different value.
They must choose the flavors (numbered) to sum up to money they have
they can't buy the same flavor
You need to return the index starting by 1 (not 0)

The naive solution

The naive solution is to traverse the entire set almost twice. Almost because for friend 2 we will traverse only the positions not chose yet

# inefficient, naive solution: O(n²)
def whatFlavors_inneficient(cost, money):
    for i1, c1 in enumerate(cost, 1):
        for i2, c2 in enumerate(cost[i1:], i1 + 1):
            if (c1 + c2) == money:
                print(i1, i2)
                return

The final solution

In the final solution, we must trade time for space, creating a dictionary. The reason is to find, after we spend the money on the first ice cream, if there is another flavor to sum up to the money we got there.

    # cost: [1, 4, 5, 3, 2]
    dcost = dict(enumerate([c for c in cost], 1))
    # {1: 1, 2: 4, 3: 5, 4: 3, 5: 2}
    dcost = {v: k for k, v in dcost.items()}
    # {1: 1, 4: 2, 5: 3, 3: 4, 2: 5}

So, we still need to traverse all the flavors, but just once.

The complete solution is as follows

def whatFlavors(cost, money):
    # inverted (v,k) dictionary of costs
    # to find easily the value that complements the first iteration
    dcost = dict(enumerate([c for c in cost], 1))
    dcost = {v: k for k, v in dcost.items()}

    # traverse once
    for i1, c1 in enumerate(cost, 1): 
        # the cost of second ice cream must be
        c2 = money - c1
        i2 = dcost.get(c2)
        # if found, return
        if i2 and (i2 != i1):
            print(i1, i2)
            return

Update plotly.js data in Angular

Luciano Pinheiro — Mon, 16 Oct 2023 00:07:26 +0000

The problem

I have data coming from a socket.io server. Every new arriving message is sent to an array. I'm using a Service to keep all my data. It allows me to share the data among components.


// app.component.ts
  constructor(
    private webSocketService: WebSocketService,
    private data: SessionDataService 
  ) {
    this.socket.on('balance', (message: any) => {
      this.data.setBalance(JSON.parse(message));
    });
  }

// session-data.service.ts
export class SessionDataService {
  setBalance(balance: any) {
    this.balance = balance;
    this.balance_history.push(balance);
  }
}

At some point, I needed a graph to plot that history. I made a new component and put my data there, but it didn't work. Why? The update happened only at beginning of the Component.

// wallet component
// doesn't work
export class WalletComponent {
  balance_history: any[] = [];
  constructor(data: SessionDataService) {
    balance_history = data.balance_history;    
  }
}

The solution

If we need to get the updated version, we need to subscribe the data through a Observer. So, it will update every time the value changes. Remember that if you leave the component, the data will be destroyed. So, we must keep all the data in the service.

The solution is something like this:

// wallet component uses service
export class WalletComponent {
  // define data that will be shown in the template
  plot_data: any[] = [];

  constructor(data: SessionDataService) {
    // subscribe to the observable
    data.wallet_history.subscribe((balance) => {
      // every time there is a new message, 
      // we update service data and local variable
      this.update_plot_data();
    });    
  }

  update_plot_data() {
    // data in format plotly will understand
    this.plot_data = {
      data: [
        {
          x: this.data.balance_history.map((_: number, index: number) => index),
          y: this.data.balance_history,
          type: 'scatter',
          mode: 'lines+points',
          marker: { color: 'red' },
        },
      ],
    };
  }
}

// service SessionDataService 
export class SessionDataService {
  wallet: any = {};
  balance_history: any = [];

  messages: string[] = [];

  // make observable
  private wallet_historySource = new BehaviorSubject({});
  public wallet_history = this.wallet_historySource.asObservable();

  // when receive a websocket message from server, 
  // 
  setWallet(wallet: any) {
    this.wallet = wallet;
    this.balance_history.push(wallet.balance);
    this.wallet_historySource.next(wallet.balance);
  }

}

A variation of this solution is to keep plot_data inside SessionDataService so you don't have to use observable. Maybe it's in fact a better solution for this case, but I could not show the subscription feature.

Receiving messages from socket.io in Angular

Luciano Pinheiro — Mon, 02 Oct 2023 23:51:14 +0000

Scenario

You have a flask server serving websocket via socket.io and need to connect from an Angular client.

Solution

In Angular:

Create a module (optional)
Create a websocket service inside that module
Inject the websocket service into the component who will handle the messages
Create the methods to handle messages inside that component

Create a module and websocket service

Create a standard module and a standard service

ng g m ws
ng g s ws/websocket

You must create a service consisting only of an instance of a socket connection. We need the service to keep only one connection to the server at the beginning of service. Don't forget to enable CORS on server. Your websocket service will look like this:

// /app/ws/web-socket.service.ts
import { Injectable } from '@angular/core';
import { io } from 'socket.io-client';

@Injectable({
  providedIn: 'root',
})
export class WebSocketService {
  private socket: any = undefined;

  constructor() {
    if (!this.socket) {
      this.socket = io('http://localhost:5000/');
    }
  }

  public getSocket() {
    return this.socket;
  }
}

Don't forget to install socket.io-client on your Angular project.

The client component

You must then inject your service into a component who will use the connection and intercept the messages.

/ //app.component.ts
import { Component } from '@angular/core';
import { WebSocketService } from './ws/web-socket.service';

@Component({
  selector: 'app-root',
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css'],
})
export class AppComponent {
  socket: any;
  messages: string[] = [];

  // Inject the service
  constructor(private webSocketService: WebSocketService) {
    this.socket = this.webSocketService.getSocket();

    // in this component you define what to do
    // with received event of type 'message'
    this.socket.on('message', (data: any) => {
      this.messages.push(data);
    });

    // when receiving a 'connect' event, send a message to server
    this.socket.on('connect', () => {
      const message = 'myevent';
      this.socket.emit(message, { data: "I'm connected!" });
    });
}

Using this approach, you can connect to a server and define what to do with the received messages, of emit new messages to the server in a simple way, separating concerns as a service and a controller.

HackerRank MaxMin

Luciano Pinheiro — Sat, 02 Sep 2023 18:48:57 +0000

This is solution for HackerRank MaxMin challenge, in python. This is a problem in the Interview Preparation Kit > Greedy Algorithms and is considered of medium difficulty.

Be a greedy algorithm means that the final solution will be taken by applying the same algorithm in a subset of the global problem, then comparing the local solution with previous solution on every iteration. If the current solution is better, then it will become the global solution.

Speaking of code, we usually need to:

prepare data (once)
run the problem in a subset
if current solution is better, we replace global solution with current solution
choose another subset and repeat

The problem states that:

we receive k (number of pairs) and arr array (initial)
there is a distracting concept of unfairness
we need to take k elements of arr and make a new array arr'
unfairness is max(arr') - min(arr')
we must find the minimum unfairness

First of all, if we sort arr, we don't need to check every k subset. We can only iterate through arr find arr' because we are interested in minimum difference between min(arr') and max(arr') only. So it doesn't make sense to make arr' with values too distant to each other.

arr = [1,4,7,2]
k = 2
arr.sort() # [1,2,4,7]
for i in range(len(arr)-k+1):
   arr2 = arr[i:i+k-1]
# len(arr)-k+1 = 3 meaning i will assume 0, 1 and 2
# i=0 arr2 = [1,2]
# i=1 arr2 = [2,4]
# i=2 arr2 = [4,7]

In the example above, we should considerate only the sorted neighbors. It is unnecessary to test the arr'=[1,7] because the unfairness would by definition the bigger than [1,2] or [4,7].

We may notice that there is an iteration in arr (global problem) to find arr' (local/partial solution). Now we must find the unfairness for each sorted arr' and compare with the last one. It the current solution is better, it will replace the global solution. After iteration we will have the best solution. This is the greedy approach.

A complete python solution is shown below. The first solution (min_unfairness) is defined as the maximum unfairness of arr. Notice that arr' is defined as arr[i + k - 1] - arr[i].

def maxMin(k, arr):
    arr.sort()
    min_unfairness = arr[k] - arr[0]
    for i in range(len(arr) - k + 1):
        curr_unfairness = arr[i + k - 1] - arr[i]
        min_unfairness = min(curr_unfairness, min_unfairness)
    return min_unfairness

This function still have room for improvement. For example, it could finish if at some point curr_unfairness = 0. It could also test unfairness before replace min_unfairness. It also could add all unfairness to an array and apply min() in the return.

HackerRank Greedy Florist

Luciano Pinheiro — Thu, 31 Aug 2023 21:47:26 +0000

This is the solution for the HackerRank Greedy Florist problem, in python. This is a problem in the Interview Preparation Kit > Greedy Algorithms and is considered medium.

The problem is as follows:

The greedy florist wants to maximize his price
He has a formula to the price: (n + 1) * original price
n is the number of flowers previously purchased

So, if you buy one flower, it will be the original price. If you buy a second flower, the price is 2 * original price.

I think that the problem never left clear that the expensive flowers must be purchased first, but that's in the answer.

Solution

The first problem we must solve is to put the array in a reverse price order.

    c.sort()
    c.reverse()

So we can traverse it and buy the flowers. For each item, we must find:

n
current cost

We can find n by integer (or floor) dividing the array position with the number of friends k

    for i in range(len(c)):
        n = i // k

So, the first round of purchases will have n = 0, the second, n = 1, and so on.

The cost is straight to the formula:

        flower_cost = c[i]
        cost = (n + 1) * flower_cost

And that's it. The complete solution is as follow:

def getMinimumCost(k, c):
    total = 0
    c.sort()
    c.reverse()

    for i in range(len(c)):
        n = i//k
        flower_cost = c[i]
        cost = (n + 1) * flower_cost
        total += cost
    return total

HackerRank Luck Balance

Luciano Pinheiro — Mon, 28 Aug 2023 03:41:42 +0000

This is the solution for the HackerRank Luck balance problem, in python. Luck Balance is a problem in the Interview Preparation Kit > Greedy Algorithms and is considered easy.

The main idea is that someone believes in the balance of luck. She needs to loose some contests to win on others. But the requirements are more complex:

There are two types of contests: important and unimportant.
The person can only lose a maximum of k important contests.
If the person loses a contest, its points of luck are added to their luck balance.
If the person wins a contest, the luck points are removed from their luck balance.
The person can choose which contests to lose.

To solve the problem, we can use the following greedy algorithm:

Sort the contests in descending order of their luck points.
For each contest:
- If the contest is important and the person has not yet lost k important contests, lose the contest.
- Otherwise, win the contest.

The catch here is to choose what to loose. For that, the person must sort the contests array in descending order. So, she will loose first the ones with more points.

For example, having

k = 3
contests = [[5, 1], [2, 1], [1, 1], [8, 1], [10, 0], [5, 0]]

she has 4 important contests (and 2 unimportant), but can loose only 3 of them. If she sort in reverse order, she will traverse first the most valuables first:

constests.sort(reverse=True)
print(contests)
# [[10, 0], [8, 1], [5, 1], [5, 0], [2, 1], [1, 1]]

Here is the complete solution in python:

def luckBalance(k, contests):
    contests.sort(reverse=True)
    balance = 0
    lost_important = 0

    for contest in contests:
        if contest[1] == 1:
            if lost_important < k:
                balance += contest[0]
                lost_important += 1
            else:
                balance -= contest[0]
        else:
            balance += contest[0]
    return balance

HackerRank Minimum Absolute Difference

Luciano Pinheiro — Sat, 26 Aug 2023 19:16:49 +0000

As you may know, HackerRank has a series of interview challenges varying from easy to hard. This challenge presented now is in the package Interview Preparation Kit > Greedy Algorithms and is considered easy.

It basically gives an array and you must check the absolute difference of every pair of numbers.

difference = []
for x in range(len(arr)):
    for y in range(x+1, len(arr)):
        difference.append(abs(arr[x], arr[y]))

But there is a catch! If you simply check all numbers, you will check unnecessary numbers. It's much better if you just check a number with the nearest neighbors of it. For example if arr is

arr = [-59, -36, -13, 1, -53, -92, -2, -96, -54, 75]

and if we sort it, we just need to check each number twice (or once in the case of extremities)

arr.sort()
print(arr) # [-96, -92, -59, -54, -53, -36, -13, -2, 1, 75]

Now we clearly see for example that we just need to test -36 with -53 and -13. It's not possible that the sub-array [-96, -92, -59, -54] have a smaller difference with -36 than -53.

The complete algorithms is this:

def minimumAbsoluteDifference(arr):
    arr.sort()
    differences = []
    for x in range(len(arr) - 1):
        differences.append(abs(arr[x] - arr[x + 1]))
    return min(differences)