CoSecAutoConfiguration

Wires CoSec into the host when the application has wow-cosec and CoSec's WebFlux module: the host wires its optional integrations as it wires Kafka, and wow-cosec keeps the Spring-free part, the resolver, the authorizers and the route map. It reads wow.cosec.* once, through WowProperties.cosec, the keys' one reader and one default.

• CoSecCallerResolver is the host's CallerResolver when CoSec is on (cosec.enabled, true unless set) and the application has none: the host's development callers (DevelopmentCallerResolver) step aside. Its options are wow.tenant.default, wow.cosec.cross-scope.roles / wow.cosec.cross-scope.policies and wow.cosec.tenant-level.roles / wow.cosec.tenant-level.policies (the tenant-level callers), comma-separated or indexed lists. The caller's app and space are those of the scope CoSec resolved, behind a CoSec gateway (wow.cosec.mode=gateway) the ones the gateway forwarded. No CoSec principal is a service identity: a service names itself on the internal port.

• The CoSec request fact CoSec-Device-Id (CoSecRequestFacts) joins the edge's request-fact list (wow.http.request-facts); the app of the request's scope is the standard fact app_id.

• CoSec-Request-Id is the request id of a command without Wow-Request-Id (CoSecRequestIds), so a command a CoSec gateway sends again under the same header is answered as a duplicate.

• Where CoSec decides the requests itself, the route map CoSec's pipeline reads is the Manifest's command and service routes (CoSecRouteMapAutoConfiguration).

• CoSecCommandAuthorizer and CoSecServiceRouteAuthorizer, CoSec's decision on a command and on a service route call by the same actions, as the caller of its request, are among the node's authorizers when wow.cosec.authorizer.enabled is true and CoSec decides here (its AuthorizationChecker): asked with the application's own authorizers, each of which must allow a command too. On the public port CoSec's pipeline already decides the command routes. A request-less command (a saga's, a timer's, a scheduled job's) gets no objection from them.

Experimental as wow-cosec is, which follows CoSec 8's pre-release: the class and its constant may change within 10.x.