How to implement request scoped Jackson FilterProvider in Dropwizard

Question

I have a need to filter response entity properties based on parameters provided in the request.

As an example:

GET http://example.org/api/entity/1

would respond with

{ "id": 1234, "foo": "FOO", "bar": "BAR" }

If the request contained a parameter, include=id,foo, I want to only include the properties identified by the parameter:

{ "id": 1234, "foo": "FOO" }

In general, this type of dynamic filtering appears to be possible using Jackson filters, as documented in a few places. What I can't quite figure out is a way to provide the FilterProvider with a reference to the HttpServletRequest (or anything scoped like it).

ObjectMapper mapper = ...
mapper.setFilters(new FilterProvider() {
    public BeanPropertyFilter findFilter(Object filterId) {
        // FIXME: filter out all except those in HttpServletRequest#getParameter("include")
        return SimpleBeanPropertyFilter.filterOutAllExcept(Collections.<String>emptySet());
    }
});

There is a potential solution, and example, which might work if I add a servlet or Jersey filter to configure the ObjectWriterInjector. I'm hoping there's a clearer, more direct approach.

This is all happening in a Dropwizard application, if that happens to make any difference.

Answer 1

Let me start with a disclaimer, never worked with DropWizard so I might be off the bat here. But you can do something like this:

@GET
@Path("test")
public String get(@QueryParam("include") List<String> includeList) throws JsonProcessingException {
    MyClass myClass = new MyClass("aaa");

    ObjectMapper mapper = ...;

    FilterProvider filterProvider = new SimpleFilterProvider()
            .addFilter("myFilter", SimpleBeanPropertyFilter.filterOutAllExcept(new HashSet<>(includeList)));

    mapper.setFilters(filterProvider);

    return mapper.writeValueAsString(myClass);
}

Where the request will be:

GET http://example.org/api/entity/1

You can of course keep the request as in your question and add:

@GET
@Path("test")
public String get2(@QueryParam("include") String includeList) throws JsonProcessingException {
    MyClass myClass = new MyClass("testing123");

    String[] arr = includeList.split(",");
    ObjectMapper mapper = ...;

    FilterProvider filterProvider = new SimpleFilterProvider()

            .addFilter("myFilter", SimpleBeanPropertyFilter.filterOutAllExcept(new HashSet<>(Arrays.asList(arr))));
    mapper.setFilters(filterProvider);

    return mapper.writeValueAsString(myClass);
}

The problem with this solution is your return String and not the object itself which makes testing harder.

Answer 2

Ok, hold on to your hat: this gets bit involved. :)

Jackson 2.3 added general-purpose extensions for JAX-RS provider, which allow deep customization of ObjectReader and ObjectWriter that are used for reading and writing JSON (and other formats). Addition was via this issue:

https://github.com/FasterXML/jackson-jaxrs-providers/issues/33

but the gist of it is that you can register ObjectReaderInjector and/or ObjectWriterInjector, during processing of a request: typically this is done from doFilter() method of javax.servlet.Filter, before DropWizard invokes Jackson to read request, write response. Injectors, if any registered, are then called right before read/write, to let your code make any changes it wants to. Instances of ObjectReader and ObjectWriter are used instead of ObjectMapper since they are fully thread-safe; you can not safely reconfigure ObjectMapper, but reader/writer instances are safe to reconfigure using various "withXxx()" calls (just remember that they create new instances and do NOT modify instance methods are called on!).

An example of this, via above issue:

https://github.com/FasterXML/jackson-jaxrs-providers/commit/ddf256f6aaaf1d669c1c4323c5359cc20cf40654

shows how it all ties together. Code is not as simple as one would hope, but it is general-purpose and very powerful way to customize all aspects of reading requests, writing responses.

Answer 3

You can get object mapper from environment parameter inside run method of MyApplication class:

public class MyApplication extends Application<MyApplicationConfiguration> {
    @Override
    public void run(MyApplicationConfiguration configuration, Environment environment) throws Exception {
        environment.getObjectMapper().setFilterProvider(new FilterProvider() {
            public BeanPropertyFilter findFilter(Object filterId) {
                //filter code here
            }
        });
    }
}