Add hasAnyAuthority() and hasAnyRole() in AuthorizeExchangeSpec

Fixes gh-6306

core/src/main/java/org/springframework/security/authorization/AuthorityReactiveAuthorizationManager.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,10 @@ import org.springframework.security.core.Authentication;
 import org.springframework.util.Assert;
 import reactor.core.publisher.Mono;
 
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Stream;
+
 /**
  * A {@link ReactiveAuthorizationManager} that determines if the current user is
  * authorized by evaluating if the {@link Authentication} contains a specified authority.
@@ -29,10 +33,10 @@ import reactor.core.publisher.Mono;
  * @param <T> the type of object being authorized
  */
 public class AuthorityReactiveAuthorizationManager<T> implements ReactiveAuthorizationManager<T> {
-	private final String authority;
+	private final List<String> authorities;
 
-	private AuthorityReactiveAuthorizationManager(String authority) {
-		this.authority = authority;
+	private AuthorityReactiveAuthorizationManager(String... authorities) {
+		this.authorities = Arrays.asList(authorities);
 	}
 
 	@Override
@@ -40,8 +44,8 @@ public class AuthorityReactiveAuthorizationManager<T> implements ReactiveAuthori
 		return authentication
 			.filter(a -> a.isAuthenticated())
 			.flatMapIterable( a -> a.getAuthorities())
-			.map( g-> g.getAuthority())
-			.hasElement(this.authority)
+			.map(g -> g.getAuthority())
+			.any(a -> this.authorities.contains(a))
 			.map( hasAuthority -> new AuthorizationDecision(hasAuthority))
 			.defaultIfEmpty(new AuthorizationDecision(false));
 	}
@@ -59,6 +63,24 @@ public class AuthorityReactiveAuthorizationManager<T> implements ReactiveAuthori
 		return new AuthorityReactiveAuthorizationManager<>(authority);
 	}
 
+	/**
+	 * Creates an instance of {@link AuthorityReactiveAuthorizationManager} with the
+	 * provided authorities.
+	 *
+	 * @author Robbie Martinus
+	 * @param authorities the authorities to check for
+	 * @param <T> the type of object being authorized
+	 * @return the new instance
+	 */
+	public static <T> AuthorityReactiveAuthorizationManager<T> hasAnyAuthority(String... authorities) {
+		Assert.notNull(authorities, "authorities cannot be null");
+		for (String authority : authorities) {
+			Assert.notNull(authority, "authority cannot be null");
+		}
+
+		return new AuthorityReactiveAuthorizationManager<>(authorities);
+	}
+
 	/**
 	 * Creates an instance of {@link AuthorityReactiveAuthorizationManager} with the
 	 * provided authority.
@@ -71,4 +93,25 @@ public class AuthorityReactiveAuthorizationManager<T> implements ReactiveAuthori
 		Assert.notNull(role, "role cannot be null");
 		return hasAuthority("ROLE_" + role);
 	}
+
+	/**
+	 * Creates an instance of {@link AuthorityReactiveAuthorizationManager} with the
+	 * provided authorities.
+	 *
+	 * @author Robbie Martinus
+	 * @param roles the authorities to check for prefixed with "ROLE_"
+	 * @param <T> the type of object being authorized
+	 * @return the new instance
+	 */
+	public static <T> AuthorityReactiveAuthorizationManager<T> hasAnyRole(String... roles) {
+		Assert.notNull(roles, "roles cannot be null");
+		for (String role : roles) {
+			Assert.notNull(role, "role cannot be null");
+		}
+
+		return hasAnyAuthority(Stream.of(roles)
+				.map(r -> "ROLE_" + r)
+				.toArray(String[]::new)
+		);
+	}
 }