Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make AuthorizationProxyFactory#proxy Generic

Browse Source 
Closes gh-16706

Signed-off-by: dae won <eodnjs01477@gmail.com>
This commit is contained in:
dae won
2025-04-25 20:13:56 +09:00
committed by Josh Cummings
parent f4b8e2421a
commit 8612e952fe
6 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyWebConfiguration.java
View File

@@ -51,7 +51,7 @@ class AuthorizationProxyWebConfiguration {
if (target instanceof ModelAndView mav) { if (target instanceof ModelAndView mav) {
View view = mav.getView(); View view = mav.getView();
String viewName = mav.getViewName(); String viewName = mav.getViewName();
Map<String, Object> model = (Map<String, Object>) proxyFactory.proxy(mav.getModel()); Map<String, Object> model = proxyFactory.proxy(mav.getModel());
ModelAndView proxied = (view != null) ? new ModelAndView(view, model) ModelAndView proxied = (view != null) ? new ModelAndView(view, model)
: new ModelAndView(viewName, model); : new ModelAndView(viewName, model);
proxied.setStatus(mav.getStatus()); proxied.setStatus(mav.getStatus());

10
config/src/test/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyConfigurationTests.java
View File

@@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2024 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@@ -58,7 +58,7 @@ public class AuthorizationProxyConfigurationTests {
@Test @Test
public void proxyWhenNotPreAuthorizedThenDenies() { public void proxyWhenNotPreAuthorizedThenDenies() {
this.spring.register(DefaultsConfig.class).autowire(); this.spring.register(DefaultsConfig.class).autowire();
Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); Toaster toaster = this.proxyFactory.proxy(new Toaster());
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(toaster::makeToast) assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(toaster::makeToast)
.withMessage("Access Denied"); .withMessage("Access Denied");
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(toaster::extractBread) assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(toaster::extractBread)
@@ -69,7 +69,7 @@ public class AuthorizationProxyConfigurationTests {
@Test @Test
public void proxyWhenPreAuthorizedThenAllows() { public void proxyWhenPreAuthorizedThenAllows() {
this.spring.register(DefaultsConfig.class).autowire(); this.spring.register(DefaultsConfig.class).autowire();
Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); Toaster toaster = this.proxyFactory.proxy(new Toaster());
toaster.makeToast(); toaster.makeToast();
assertThat(toaster.extractBread()).isEqualTo("yummy"); assertThat(toaster.extractBread()).isEqualTo("yummy");
} }
@@ -77,7 +77,7 @@ public class AuthorizationProxyConfigurationTests {
@Test @Test
public void proxyReactiveWhenNotPreAuthorizedThenDenies() { public void proxyReactiveWhenNotPreAuthorizedThenDenies() {
this.spring.register(ReactiveDefaultsConfig.class).autowire(); this.spring.register(ReactiveDefaultsConfig.class).autowire();
Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); Toaster toaster = this.proxyFactory.proxy(new Toaster());
Authentication user = TestAuthentication.authenticatedUser(); Authentication user = TestAuthentication.authenticatedUser();
StepVerifier StepVerifier
.create(toaster.reactiveMakeToast().contextWrite(ReactiveSecurityContextHolder.withAuthentication(user))) .create(toaster.reactiveMakeToast().contextWrite(ReactiveSecurityContextHolder.withAuthentication(user)))
@@ -90,7 +90,7 @@ public class AuthorizationProxyConfigurationTests {
@Test @Test
public void proxyReactiveWhenPreAuthorizedThenAllows() { public void proxyReactiveWhenPreAuthorizedThenAllows() {
this.spring.register(ReactiveDefaultsConfig.class).autowire(); this.spring.register(ReactiveDefaultsConfig.class).autowire();
Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); Toaster toaster = this.proxyFactory.proxy(new Toaster());
Authentication admin = TestAuthentication.authenticatedAdmin(); Authentication admin = TestAuthentication.authenticatedAdmin();
StepVerifier StepVerifier
.create(toaster.reactiveMakeToast().contextWrite(ReactiveSecurityContextHolder.withAuthentication(admin))) .create(toaster.reactiveMakeToast().contextWrite(ReactiveSecurityContextHolder.withAuthentication(admin)))

2
core/src/main/java/org/springframework/security/aot/hint/AuthorizeReturnObjectHintsRegistrar.java
View File

@@ -109,7 +109,7 @@ public final class AuthorizeReturnObjectHintsRegistrar implements SecurityHintsR
} }
private void registerProxy(RuntimeHints hints, Class<?> clazz) { private void registerProxy(RuntimeHints hints, Class<?> clazz) {
Class<?> proxied = (Class<?>) this.proxyFactory.proxy(clazz); Class<?> proxied = this.proxyFactory.proxy(clazz);
if (proxied == null) { if (proxied == null) {
return; return;
} }

6
core/src/main/java/org/springframework/security/authorization/AuthorizationProxyFactory.java
View File

@@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2024 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ package org.springframework.security.authorization;
* A factory for wrapping arbitrary objects in authorization-related advice * A factory for wrapping arbitrary objects in authorization-related advice
* *
* @author Josh Cummings * @author Josh Cummings
* @author daewon kim
* @since 6.3 * @since 6.3
* @see org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory * @see org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory
*/ */
@@ -30,11 +31,12 @@ public interface AuthorizationProxyFactory {
* *
* <p> * <p>
* Please check the implementation for which kinds of objects it supports. * Please check the implementation for which kinds of objects it supports.
* @param <T> the type of the object being proxied
* @param object the object to proxy * @param object the object to proxy
* @return the proxied object * @return the proxied object
* @throws org.springframework.aop.framework.AopConfigException if a proxy cannot be * @throws org.springframework.aop.framework.AopConfigException if a proxy cannot be
* created * created
*/ */
Object proxy(Object object); <T> T proxy(T object);
} }

10
core/src/main/java/org/springframework/security/authorization/method/AuthorizationAdvisorProxyFactory.java
View File

@@ -172,16 +172,16 @@ public final class AuthorizationAdvisorProxyFactory implements AuthorizationProx
* @return the proxied instance * @return the proxied instance
*/ */
@Override @Override
public Object proxy(Object target) { public <T> T proxy(T target) {
if (target == null) { if (target == null) {
return null; return null;
} }
if (target instanceof AuthorizationProxy proxied) { if (target instanceof AuthorizationProxy proxied) {
return proxied; return (T) proxied;
} }
Object proxied = this.visitor.visit(this, target); Object proxied = this.visitor.visit(this, target);
if (proxied != null) { if (proxied != null) {
return proxied; return (T) proxied;
} }
ProxyFactory factory = new ProxyFactory(target); ProxyFactory factory = new ProxyFactory(target);
factory.addAdvisors(this.authorizationProxy); factory.addAdvisors(this.authorizationProxy);
@@ -191,7 +191,7 @@ public final class AuthorizationAdvisorProxyFactory implements AuthorizationProx
factory.addInterface(AuthorizationProxy.class); factory.addInterface(AuthorizationProxy.class);
factory.setOpaque(true); factory.setOpaque(true);
factory.setProxyTargetClass(!Modifier.isFinal(target.getClass().getModifiers())); factory.setProxyTargetClass(!Modifier.isFinal(target.getClass().getModifiers()));
return factory.getProxy(); return (T) factory.getProxy();
} }
/** /**
@@ -442,7 +442,7 @@ public final class AuthorizationAdvisorProxyFactory implements AuthorizationProx
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
private <T> T proxyCast(AuthorizationProxyFactory proxyFactory, T target) { private <T> T proxyCast(AuthorizationProxyFactory proxyFactory, T target) {
return (T) proxyFactory.proxy(target); return proxyFactory.proxy(target);
} }
private <T> Iterable<T> proxyIterable(AuthorizationProxyFactory proxyFactory, Iterable<T> iterable) { private <T> Iterable<T> proxyIterable(AuthorizationProxyFactory proxyFactory, Iterable<T> iterable) {

2
core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java
View File

@@ -335,7 +335,7 @@ public class AuthorizationAdvisorProxyFactoryTests {
@Test @Test
public void setTargetVisitorIgnoreValueTypesThenIgnores() { public void setTargetVisitorIgnoreValueTypesThenIgnores() {
AuthorizationAdvisorProxyFactory factory = AuthorizationAdvisorProxyFactory.withDefaults(); AuthorizationAdvisorProxyFactory factory = AuthorizationAdvisorProxyFactory.withDefaults();
assertThatExceptionOfType(ClassCastException.class).isThrownBy(() -> ((Integer) factory.proxy(35)).intValue()); assertThatExceptionOfType(ClassCastException.class).isThrownBy(() -> factory.proxy(35).intValue());
factory.setTargetVisitor(TargetVisitor.defaultsSkipValueTypes()); factory.setTargetVisitor(TargetVisitor.defaultsSkipValueTypes());
assertThat(factory.proxy(35)).isEqualTo(35); assertThat(factory.proxy(35)).isEqualTo(35);
} }