Spring boot rest ignore one class

Question

I am developing a REST API using spring-boot-starter-data-rest. One class I want to sync with JPA is the User class containing information about users, including who is allowed to access the API.

Unfortunately, having the User and the UserRepository means that my User class is exposed in my API. I was able to remove things like the Id (in the configureRepositoryRestConfiguration function) and usernames and passwords (by adding @JsonIgnore to every variable of my User class).

Unfortunately, users of the API can still ask for the users table (who returns a list with empty users). Although this is not really a problem, I would rather remove the /users endpoint.

Adding @JsonIgnore to the whole User class is not possible.

Answer 1

Exporting repositories is depend on RepositoryDetectionStrategy. The default strategy is:

Exposes all public repository interfaces but considers @(Repository)RestResource’s exported flag.

According it to disable exporting of your 'repo' you can set exported flag to false for this repo:

@RepositoryRestResource(exported = false)
public interface UserRepo extends JpaRepository<User, Integer> {
    //...
}

Another approach is to change globally the RepositoryDetectionStrategy to ANNOTATED:

Only repositories annotated with @(Repository)RestResource are exposed, unless their exported flag is set to false.

@Configuration
public class RestConfig extends RepositoryRestConfigurerAdapter {
    @Override
    public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config) {
        config.setRepositoryDetectionStrategy(RepositoryDetectionStrategy.RepositoryDetectionStrategies.ANNOTATED);
        super.configureRepositoryRestConfiguration(config);
    }
}

Then don't apply @RepositoryRestResource annotation to repos that doesn't need to be exported.

UPDATE

We can also use this application property to setup the strategy:

spring.data.rest.detection-strategy=default

Source