Add reactive logout handler support

security-csrf/src/main/java/io/micronaut/security/csrf/filter/CsrfFilter.java

@@ -17,13 +17,14 @@
 
 import io.micronaut.context.annotation.Requires;
 import io.micronaut.core.annotation.Internal;
-import io.micronaut.web.router.RouteAttributes;
-import org.jspecify.annotations.NonNull;
-import org.jspecify.annotations.Nullable;
 import io.micronaut.core.order.Ordered;
 import io.micronaut.core.util.PathMatcher;
 import io.micronaut.core.util.StringUtils;
-import io.micronaut.http.*;
+import io.micronaut.http.HttpMethod;
+import io.micronaut.http.HttpRequest;
+import io.micronaut.http.HttpResponse;
+import io.micronaut.http.MediaType;
+import io.micronaut.http.MutableHttpResponse;
 import io.micronaut.http.annotation.RequestFilter;
 import io.micronaut.http.annotation.ServerFilter;
 import io.micronaut.http.filter.FilterPatternStyle;
@@ -35,8 +36,11 @@
 import io.micronaut.security.csrf.resolver.FutureCsrfTokenResolver;
 import io.micronaut.security.csrf.validator.CsrfTokenValidator;
 import io.micronaut.security.context.ServerRequestContextSecurityContextSupplier;
+import io.micronaut.web.router.RouteAttributes;
 import io.micronaut.web.router.RouteMatch;
 import io.micronaut.web.router.UriRouteMatch;
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import java.util.List;

security/src/main/java/io/micronaut/security/endpoints/LogoutController.java

@@ -17,7 +17,7 @@
 
 import io.micronaut.context.annotation.Requires;
 import io.micronaut.context.event.ApplicationEventPublisher;
-import org.jspecify.annotations.Nullable;
+import io.micronaut.core.async.publisher.Publishers;
 import io.micronaut.core.util.StringUtils;
 import io.micronaut.http.HttpRequest;
 import io.micronaut.http.HttpResponse;
@@ -34,9 +34,16 @@
 import io.micronaut.security.authentication.Authentication;
 import io.micronaut.security.event.LogoutEvent;
 import io.micronaut.security.handlers.LogoutHandler;
+import io.micronaut.security.handlers.ReactiveLogoutHandler;
 import io.micronaut.security.rules.SecurityRule;
+import jakarta.inject.Inject;
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
+import org.reactivestreams.Publisher;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import reactor.core.publisher.Mono;
+
 import java.util.Optional;
 
 /**
@@ -52,6 +59,7 @@
     private static final Logger LOG = LoggerFactory.getLogger(LogoutController.class);
 
     private final LogoutHandler<HttpRequest<?>, MutableHttpResponse<?>> logoutHandler;
+    private final ReactiveLogoutHandler<HttpRequest<?>, MutableHttpResponse<?>> reactiveLogoutHandler;
     private final ApplicationEventPublisher<LogoutEvent> logoutEventPublisher;
     private final boolean getAllowed;
     private final HttpHostResolver httpHostResolver;
@@ -64,22 +72,46 @@
      * @param logoutControllerConfiguration Configuration for the Logout controller
      * @param httpHostResolver              The http host resolver
      * @param httpLocaleResolver            The http locale resolver
-     * @since 4.11.0
+     * @param reactiveLogoutHandler         A reactive collaborator which helps to build HTTP response if user logout.
+     * @since 5.1.0
      */
+    @Inject
     public LogoutController(
         LogoutHandler<HttpRequest<?>, MutableHttpResponse<?>> logoutHandler,
         ApplicationEventPublisher<LogoutEvent> logoutEventPublisher,
         LogoutControllerConfiguration logoutControllerConfiguration,
         HttpHostResolver httpHostResolver,
-        HttpLocaleResolver httpLocaleResolver) {
+        HttpLocaleResolver httpLocaleResolver,
+        @Nullable ReactiveLogoutHandler<HttpRequest<?>, MutableHttpResponse<?>> reactiveLogoutHandler) {
         this.logoutHandler = logoutHandler;
+        this.reactiveLogoutHandler = reactiveLogoutHandler == null ? new ReactiveLogoutHandlerAdapter<>(logoutHandler) : reactiveLogoutHandler;
         this.logoutEventPublisher = logoutEventPublisher;
         this.getAllowed = logoutControllerConfiguration.isGetAllowed();
         this.httpHostResolver = httpHostResolver;
         this.httpLocaleResolver = httpLocaleResolver;
         this.logoutControllerConfiguration = logoutControllerConfiguration;
     }
 
+    /**
+     * @param logoutHandler                 A collaborator which helps to build HTTP response if user logout.
+     * @param logoutEventPublisher          The application event publisher
+     * @param logoutControllerConfiguration Configuration for the Logout controller
+     * @param httpHostResolver              The http host resolver
+     * @param httpLocaleResolver            The http locale resolver
+     * @since 4.11.0
+     * @deprecated Use {@link #LogoutController(LogoutHandler, ApplicationEventPublisher, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver, ReactiveLogoutHandler)} instead
+     */
+    @Deprecated(forRemoval = true, since = "5.1.0")
+    public LogoutController(
+        LogoutHandler<HttpRequest<?>, MutableHttpResponse<?>> logoutHandler,
+        ApplicationEventPublisher<LogoutEvent> logoutEventPublisher,
+        LogoutControllerConfiguration logoutControllerConfiguration,
+        HttpHostResolver httpHostResolver,
+        HttpLocaleResolver httpLocaleResolver) {
+        this(logoutHandler, logoutEventPublisher, logoutControllerConfiguration, httpHostResolver, httpLocaleResolver,
+            (ReactiveLogoutHandler<HttpRequest<?>, MutableHttpResponse<?>>) null);
+    }
+
     /**
      * @param logoutHandler                 A collaborator which helps to build HTTP response if user logout.
      * @param logoutEventPublisher          The application event publisher
@@ -88,7 +120,7 @@
      * @param httpLocaleResolver            The http locale resolver
      * @param logoutControllerConfigurationProperties  Configuration for the Logout Controller.
      * @since 4.7.0
-     * @deprecated Use {@link #LogoutController(LogoutHandler, ApplicationEventPublisher, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver)} instead
+     * @deprecated Use {@link #LogoutController(LogoutHandler, ApplicationEventPublisher, LogoutControllerConfiguration, HttpHostResolver, HttpLocaleResolver, ReactiveLogoutHandler)} instead
      */
     @Deprecated(forRemoval = true, since = "4.11.0")
     public LogoutController(
@@ -110,7 +142,47 @@
      */
     @Consumes({MediaType.APPLICATION_FORM_URLENCODED, MediaType.APPLICATION_JSON})
     @Post
-    public MutableHttpResponse<?> index(HttpRequest<?> request, @Nullable Authentication authentication) {
+    public Publisher<MutableHttpResponse<?>> logoutPost(HttpRequest<?> request, @Nullable Authentication authentication) {
+        MutableHttpResponse<?> rsp = shouldHandleLogout(request);
+        if (rsp != null) {
+            return Publishers.just(rsp);
+        }
+        return handleLogoutReactive(request, authentication);
+    }
+
+    /**
+     * GET endpoint for Logout Controller.
+     *
+     * @param request        The {@link HttpRequest} being executed
+     * @param authentication {@link Authentication} instance for current user
+     * @return An AccessRefreshToken encapsulated in the HttpResponse or a failure indicated by the HTTP status
+     */
+    @Get
+    public Publisher<MutableHttpResponse<?>> logoutGet(HttpRequest<?> request, @Nullable Authentication authentication) {
+        if (!getAllowed) {
+            return Publishers.just(HttpResponse.status(HttpStatus.METHOD_NOT_ALLOWED));
+        }
+
+        return handleLogoutReactive(request, authentication);
+    }
+
+    /**
+     * @param request        The {@link HttpRequest} being executed
+     * @param authentication {@link Authentication} instance for current user
+     * @return An HTTP response or a failure indicated by the HTTP status
+     */
+    @NonNull
+    private Publisher<MutableHttpResponse<?>> handleLogoutReactive(@NonNull HttpRequest<?> request, @Nullable Authentication authentication) {
+        return Mono.defer(() -> {
+            if (authentication != null) {
+                publishEvent(request, authentication);
+            }
+            return Mono.from(reactiveLogoutHandler.logout(request));
+        });
+    }
+
+    @Nullable
+    private MutableHttpResponse<?> shouldHandleLogout(HttpRequest<?> request) {
         Optional<MediaType> contentTypeOptional = request.getContentType();
         if (!(contentTypeOptional.isPresent() && logoutControllerConfiguration.getPostContentTypes().contains(contentTypeOptional.get().getName()))) {
             if (LOG.isDebugEnabled()) {
@@ -120,6 +192,23 @@
             }
             return HttpResponse.status(HttpStatus.valueOf(logoutControllerConfiguration.getUnsupportedPostContentTypeStatus()));
         }
+        return null;
+    }
+
+    /**
+     * POST endpoint for Logout Controller.
+     *
+     * @param request        The {@link HttpRequest} being executed
+     * @param authentication {@link Authentication} instance for current user
+     * @return An AccessRefreshToken encapsulated in the HttpResponse or a failure indicated by the HTTP status
+     * @deprecated No longer used
+     */
+    @Deprecated(forRemoval = true, since = "5.1")
+    public MutableHttpResponse<?> index(HttpRequest<?> request, @Nullable Authentication authentication) {
+        MutableHttpResponse<?> rsp = shouldHandleLogout(request);
+        if (rsp != null) {
+            return rsp;
+        }
         return handleLogout(request, authentication);
     }
 
@@ -129,9 +218,10 @@
      * @param request        The {@link HttpRequest} being executed
      * @param authentication {@link Authentication} instance for current user
      * @return An AccessRefreshToken encapsulated in the HttpResponse or a failure indicated by the HTTP status
+     * @deprecated No longer used
      */
-    @Get
+    @Deprecated(forRemoval = true, since = "5.1")
     public MutableHttpResponse<?> indexGet(HttpRequest<?> request, @Nullable Authentication authentication) {
         if (!getAllowed) {
             return HttpResponse.status(HttpStatus.METHOD_NOT_ALLOWED);
         }
@@ -143,17 +233,23 @@
      * @param request        The {@link HttpRequest} being executed
      * @param authentication {@link Authentication} instance for current user
      * @return An AccessRefreshToken encapsulated in the HttpResponse or a failure indicated by the HTTP status
+     * @deprecated No longer used
      */
+    @Deprecated(forRemoval = true, since = "5.1")
     protected MutableHttpResponse<?> handleLogout(HttpRequest<?> request, @Nullable Authentication authentication) {
         if (authentication != null) {
-            logoutEventPublisher.publishEvent(
-                new LogoutEvent(
-                    authentication,
-                    httpHostResolver.resolve(request),
-                    httpLocaleResolver.resolveOrDefault(request)
-                )
-            );
+            publishEvent(request, authentication);
         }
         return logoutHandler.logout(request);
     }
+
+    private void publishEvent(@NonNull HttpRequest<?> request, @NonNull Authentication authentication) {
+        logoutEventPublisher.publishEvent(
+            new LogoutEvent(
+                authentication,
+                httpHostResolver.resolve(request),
+                httpLocaleResolver.resolveOrDefault(request)
+            )
+        );
+    }
 }

security/src/main/java/io/micronaut/security/endpoints/ReactiveLogoutHandlerAdapter.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2017-2026 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.endpoints;
+
+import io.micronaut.core.annotation.Internal;
+import io.micronaut.core.async.publisher.Publishers;
+import io.micronaut.security.handlers.LogoutHandler;
+import io.micronaut.security.handlers.ReactiveLogoutHandler;
+import org.jspecify.annotations.NonNull;
+import org.reactivestreams.Publisher;
+
+/**
+ * Adapter from {@link LogoutHandler} to {@link ReactiveLogoutHandlerAdapter}.
+ *
+ * @param <I> Request
+ * @param <O> Response
+ * @author Sergio del Amo
+ * @since 5.1.0
+ */
+@Internal
+class ReactiveLogoutHandlerAdapter<I, O> implements ReactiveLogoutHandler<I, O> {
+    private LogoutHandler<I, O> logoutHandler;
+
+    ReactiveLogoutHandlerAdapter(LogoutHandler<I, O> logoutHandler) {
+        this.logoutHandler = logoutHandler;
+    }
+
+    @Override
+    public @NonNull Publisher<O> logout(@NonNull I request) {
+        return Publishers.just(logoutHandler.logout(request));
+    }
+}

security/src/main/java/io/micronaut/security/handlers/ReactiveLogoutHandler.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2017-2026 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.handlers;
+
+import io.micronaut.core.async.annotation.SingleResult;
+import org.jspecify.annotations.NonNull;
+import org.reactivestreams.Publisher;
+
+/**
+ * Responsible for logging the user out reactively and returning
+ * an appropriate response.
+ *
+ * <p>Publishers <b>MUST be cold</b>. It is assumed no work
+ * will be done until the publisher is subscribed to.</p>
+ *
+ * @author Sergio del Amo
+ * @since 5.1.0
+ * @param <I> Request
+ * @param <O> Response
+ */
+@FunctionalInterface
+public interface ReactiveLogoutHandler<I, O> {
+
+    /**
+     * @param request The HTTP Request being executed
+     * @return A publisher that emits 0 or 1 responses built after the user logs out
+     */
+    @NonNull
+    @SingleResult
+    Publisher<O> logout(@NonNull I request);
+}