[AI-8th] add SofaDiagnosticEndpoint for runtime diagnostics

sofa-boot-project/sofa-boot-actuator-autoconfigure/pom.xml

@@ -37,6 +37,18 @@
             <optional>true</optional>
         </dependency>
 
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-config</artifactId>
+            <optional>true</optional>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-web</artifactId>
+            <optional>true</optional>
+        </dependency>
+
         <dependency>
             <groupId>com.alipay.sofa</groupId>
             <artifactId>runtime-sofa-boot</artifactId>

sofa-boot-project/sofa-boot-actuator-autoconfigure/src/main/java/com/alipay/sofa/boot/actuator/autoconfigure/diagnostic/SofaDiagnosticEndpointAutoConfiguration.java

@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alipay.sofa.boot.actuator.autoconfigure.diagnostic;
+
+import com.alipay.sofa.boot.actuator.diagnostic.SofaDiagnosticEndpoint;
+import com.alipay.sofa.boot.autoconfigure.runtime.SofaRuntimeAutoConfiguration;
+import com.alipay.sofa.common.thread.ThreadPoolGovernor;
+import com.alipay.sofa.rpc.context.RpcRuntimeContext;
+import com.alipay.sofa.runtime.spi.component.SofaRuntimeContext;
+import org.springframework.boot.actuate.autoconfigure.endpoint.condition.ConditionalOnAvailableEndpoint;
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.web.SecurityFilterChain;
+
+/**
+ * {@link EnableAutoConfiguration Auto-configuration} for {@link SofaDiagnosticEndpoint}.
+ *
+ * @author xiaosiyuan
+ * @version SofaDiagnosticEndpointAutoConfiguration.java, v 0.1 2026年04月01日 xiaosiyuan Exp $
+ */
+@AutoConfiguration(after = SofaRuntimeAutoConfiguration.class)
+@ConditionalOnClass({ SofaRuntimeContext.class, RpcRuntimeContext.class })
+@ConditionalOnBean(SofaRuntimeContext.class)
+@ConditionalOnAvailableEndpoint(endpoint = SofaDiagnosticEndpoint.class)
+public class SofaDiagnosticEndpointAutoConfiguration {
+
+    @Bean
+    @ConditionalOnMissingBean
+    @ConditionalOnProperty(prefix = "management.endpoint.sofa-diagnostic", name = "sensitive", havingValue = "false")
+    public SofaDiagnosticEndpoint publicSofaDiagnosticEndpoint(SofaRuntimeContext sofaRuntimeContext,
+                                                               ApplicationContext applicationContext) {
+        return createEndpoint(sofaRuntimeContext, applicationContext);
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    @ConditionalOnClass(SecurityFilterChain.class)
+    @ConditionalOnProperty(prefix = "management.endpoint.sofa-diagnostic", name = "sensitive", havingValue = "true", matchIfMissing = true)
+    public SofaDiagnosticEndpoint secureSofaDiagnosticEndpoint(SofaRuntimeContext sofaRuntimeContext,
+                                                               ApplicationContext applicationContext) {
+        return createEndpoint(sofaRuntimeContext, applicationContext);
+    }
+
+    private SofaDiagnosticEndpoint createEndpoint(SofaRuntimeContext sofaRuntimeContext,
+                                                  ApplicationContext applicationContext) {
+        return new SofaDiagnosticEndpoint(sofaRuntimeContext, ThreadPoolGovernor.getInstance(),
+            applicationContext);
+    }
+}

sofa-boot-project/sofa-boot-actuator-autoconfigure/src/main/java/com/alipay/sofa/boot/actuator/autoconfigure/diagnostic/SofaDiagnosticSecurityAutoConfiguration.java

@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alipay.sofa.boot.actuator.autoconfigure.diagnostic;
+
+import com.alipay.sofa.boot.actuator.diagnostic.SofaDiagnosticEndpoint;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.autoconfigure.security.ConditionalOnDefaultWebSecurity;
+import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
+import org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.web.SecurityFilterChain;
+
+/**
+ * {@link EnableAutoConfiguration Auto-configuration} for securing the
+ * {@link SofaDiagnosticEndpoint sofa-diagnostic} actuator endpoint.
+ *
+ * <p>Requires HTTP Basic authentication by default ({@code sensitive=true}).
+ * Set {@code management.endpoint.sofa-diagnostic.sensitive=false} to allow public access.
+ * Backs off when the application defines its own {@link SecurityFilterChain}.
+ *
+ * @author xiaosiyuan
+ * @version SofaDiagnosticSecurityAutoConfiguration.java, v 0.1 2026年04月03日 xiaosiyuan Exp $
+ */
+@AutoConfiguration(before = { SecurityAutoConfiguration.class,
+                             UserDetailsServiceAutoConfiguration.class,
+                             ManagementWebSecurityAutoConfiguration.class })
+@ConditionalOnDefaultWebSecurity
+@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)
+@EnableConfigurationProperties(SofaDiagnosticSecurityProperties.class)
+public class SofaDiagnosticSecurityAutoConfiguration {
+
+    /**
+     * Security filter chain for the {@code sofa-diagnostic} actuator endpoint only.
+     */
+    @Bean
+    public SecurityFilterChain sofaDiagnosticSecurityFilterChain(HttpSecurity http,
+                                                                 SofaDiagnosticSecurityProperties properties)
+                                                                                                       throws Exception {
+        http.securityMatcher(EndpointRequest.to(SofaDiagnosticEndpoint.class))
+            .authorizeHttpRequests(auth -> {
+                if (properties.isSensitive()) {
+                    auth.anyRequest().authenticated();
+                } else {
+                    auth.anyRequest().permitAll();
+                }
+            })
+            // Programmatic REST endpoint; CSRF disabled.
+            .csrf(csrf -> csrf.disable());
+        if (properties.isSensitive()) {
+            http.httpBasic(Customizer.withDefaults());
+        }
+        return http.build();
+    }
+}

sofa-boot-project/sofa-boot-actuator-autoconfigure/src/main/java/com/alipay/sofa/boot/actuator/autoconfigure/diagnostic/SofaDiagnosticSecurityProperties.java

@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alipay.sofa.boot.actuator.autoconfigure.diagnostic;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+/**
+ * Configuration properties for {@code sofa-diagnostic} endpoint security.
+ *
+ * @author xiaosiyuan
+ * @version SofaDiagnosticSecurityProperties.java, v 0.1 2026年04月03日 xiaosiyuan Exp $
+ */
+@ConfigurationProperties("management.endpoint.sofa-diagnostic")
+public class SofaDiagnosticSecurityProperties {
+
+    /**
+     * Whether to require HTTP Basic authentication. {@code true} (default): auth required;
+     * {@code false}: publicly accessible.
+     */
+    private boolean sensitive = true;
+
+    public boolean isSensitive() {
+        return sensitive;
+    }
+
+    public void setSensitive(boolean sensitive) {
+        this.sensitive = sensitive;
+    }
+}

sofa-boot-project/sofa-boot-actuator-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports

@@ -8,4 +8,6 @@ com.alipay.sofa.boot.actuator.autoconfigure.health.ManualReadinessCallbackEndpoi
 com.alipay.sofa.boot.actuator.autoconfigure.startup.StartupEndPointAutoConfiguration
 com.alipay.sofa.boot.actuator.autoconfigure.rpc.RpcActuatorAutoConfiguration
 com.alipay.sofa.boot.actuator.autoconfigure.isle.IsleEndpointAutoConfiguration
-com.alipay.sofa.boot.actuator.autoconfigure.threadpool.ThreadPoolEndpointAutoConfiguration
+com.alipay.sofa.boot.actuator.autoconfigure.threadpool.ThreadPoolEndpointAutoConfiguration
+com.alipay.sofa.boot.actuator.autoconfigure.diagnostic.SofaDiagnosticEndpointAutoConfiguration
+com.alipay.sofa.boot.actuator.autoconfigure.diagnostic.SofaDiagnosticSecurityAutoConfiguration

sofa-boot-project/sofa-boot-actuator-autoconfigure/src/test/java/com/alipay/sofa/boot/actuator/autoconfigure/diagnostic/SofaDiagnosticEndpointAutoConfigurationTests.java

@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alipay.sofa.boot.actuator.autoconfigure.diagnostic;
+
+import com.alipay.sofa.boot.actuator.diagnostic.SofaDiagnosticEndpoint;
+import com.alipay.sofa.boot.autoconfigure.runtime.SofaRuntimeAutoConfiguration;
+import com.alipay.sofa.rpc.context.RpcRuntimeContext;
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.test.context.FilteredClassLoader;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link SofaDiagnosticEndpointAutoConfiguration}.
+ *
+ * @author xiaosiyuan
+ * @version SofaDiagnosticEndpointAutoConfigurationTests.java, v 0.1 2026年04月02日 xiaosiyuan Exp $
+ */
+public class SofaDiagnosticEndpointAutoConfigurationTests {
+
+    private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()
+                                                             .withConfiguration(AutoConfigurations
+                                                                 .of(SofaDiagnosticEndpointAutoConfiguration.class,
+                                                                     SofaRuntimeAutoConfiguration.class));
+
+    @Test
+    void runShouldHaveEndpointBean() {
+        this.contextRunner.withPropertyValues(
+            "management.endpoints.web.exposure.include=sofa-diagnostic")
+            .run((context) -> assertThat(context).hasSingleBean(SofaDiagnosticEndpoint.class));
+    }
+
+    @Test
+    void runWhenNotExposedShouldNotHaveEndpointBean() {
+        this.contextRunner
+            .run((context) -> assertThat(context).doesNotHaveBean(SofaDiagnosticEndpoint.class));
+    }
+
+    @Test
+    void runWhenRpcRuntimeContextClassMissingShouldNotHaveEndpointBean() {
+        this.contextRunner.withClassLoader(new FilteredClassLoader(RpcRuntimeContext.class))
+            .withPropertyValues("management.endpoints.web.exposure.include=*")
+            .run((context) -> assertThat(context).doesNotHaveBean(SofaDiagnosticEndpoint.class));
+    }
+
+    @Test
+    void runWhenEnabledPropertyIsFalseShouldNotHaveEndpointBean() {
+        this.contextRunner.withPropertyValues("management.endpoint.sofa-diagnostic.enabled:false")
+            .withPropertyValues("management.endpoints.web.exposure.include=*")
+            .run((context) -> assertThat(context).doesNotHaveBean(SofaDiagnosticEndpoint.class));
+    }
+}