Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add AuthorizationResult support for AuthorizationManager

Browse Source 
Closes gh-14843
This commit is contained in:
Max Batischev
2024-10-11 15:43:19 +03:00
committed by Josh Cummings
parent 702538ebce
commit e7644925f8
25 changed files with 134 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
messaging/src/main/java/org/springframework/security/messaging/access/intercept/AuthorizationChannelInterceptor.java
View File

@@ -67,7 +67,7 @@ public final class AuthorizationChannelInterceptor implements ChannelInterceptor
@Override
public Message<?> preSend(Message<?> message, MessageChannel channel) {
this.logger.debug(LogMessage.of(() -> "Authorizing message send"));
AuthorizationDecision decision = this.preSendAuthorizationManager.check(this.authentication, message);
AuthorizationResult decision = this.preSendAuthorizationManager.authorize(this.authentication, message);
this.eventPublisher.publishAuthorizationEvent(this.authentication, message, decision);
if (decision == null || !decision.isGranted()) { // default deny
this.logger.debug(LogMessage.of(() -> "Failed to authorize message with authorization manager "

3
messaging/src/test/java/org/springframework/security/messaging/access/intercept/AuthorizationChannelInterceptorTests.java
View File

@@ -84,12 +84,14 @@ public class AuthorizationChannelInterceptorTests {
@Test
public void preSendWhenAllowThenSameMessage() {
given(this.authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(true));
given(this.authorizationManager.authorize(any(), any())).willCallRealMethod();
assertThat(this.interceptor.preSend(this.message, this.channel)).isSameAs(this.message);
}
@Test
public void preSendWhenDenyThenException() {
given(this.authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(false));
given(this.authorizationManager.authorize(any(), any())).willCallRealMethod();
assertThatExceptionOfType(AccessDeniedException.class)
.isThrownBy(() -> this.interceptor.preSend(this.message, this.channel));
}
@@ -104,6 +106,7 @@ public class AuthorizationChannelInterceptorTests {
public void preSendWhenAuthorizationEventPublisherThenPublishes() {
this.interceptor.setAuthorizationEventPublisher(this.eventPublisher);
given(this.authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(true));
given(this.authorizationManager.authorize(any(), any())).willCallRealMethod();
lenient().doCallRealMethod()
.when(this.eventPublisher)
.publishAuthorizationEvent(any(), any(), any(AuthorizationResult.class));