Skip to content

Commit e006507

Browse files
franticticktickfranticticktick
committed
Add AuthorizationResult support for AuthorizationManager
gh-14843
1 parent 567933d commit e006507

21 files changed

+208
-46
lines changed

‎config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -32,8 +32,8 @@
3232
import org.springframework.security.access.ConfigAttribute;
3333
import org.springframework.security.authentication.AnonymousAuthenticationToken;
3434
import org.springframework.security.authentication.TestingAuthenticationToken;
35-
import org.springframework.security.authorization.AuthorizationDecision;
3635
import org.springframework.security.authorization.AuthorizationManager;
36+
import org.springframework.security.authorization.AuthorizationResult;
3737
import org.springframework.security.core.Authentication;
3838
import org.springframework.security.web.DefaultSecurityFilterChain;
3939
import org.springframework.security.web.FilterChainProxy;
@@ -221,7 +221,8 @@ private boolean checkLoginPageIsPublic(List<Filter> filters, FilterInvocation lo
221221
AuthorizationManager<HttpServletRequest> authorizationManager = authorizationFilter
222222
.getAuthorizationManager();
223223
try {
224-
AuthorizationDecision decision = authorizationManager.check(() -> TEST, loginRequest.getHttpRequest());
224+
AuthorizationResult decision = authorizationManager.authorize(() -> TEST,
225+
loginRequest.getHttpRequest());
225226
return decision != null && decision.isGranted();
226227
}
227228
catch (Exception ex) {
@@ -252,7 +253,8 @@ private Supplier<Boolean> deriveAnonymousCheck(List<Filter> filters, FilterInvoc
252253
return () -> {
253254
AuthorizationManager<HttpServletRequest> authorizationManager = authorizationFilter
254255
.getAuthorizationManager();
255-
AuthorizationDecision decision = authorizationManager.check(() -> token, loginRequest.getHttpRequest());
256+
AuthorizationResult decision = authorizationManager.authorize(() -> token,
257+
loginRequest.getHttpRequest());
256258
return decision != null && decision.isGranted();
257259
};
258260
}

‎config/src/test/java/org/springframework/security/config/http/HttpConfigTests.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -91,6 +91,7 @@ public void getWhenUsingAuthorizationManagerThenRedirectsToLogin() throws Except
9191
AuthorizationManager<HttpServletRequest> authorizationManager = this.spring.getContext()
9292
.getBean(AuthorizationManager.class);
9393
given(authorizationManager.check(any(), any())).willReturn(new AuthorizationDecision(false));
94+
given(authorizationManager.authorize(any(), any())).willCallRealMethod();
9495
// @formatter:off
9596
this.mvc.perform(get("/"))
9697
.andExpect(status().isFound())

‎core/src/main/java/org/springframework/security/authorization/AuthorizationEventPublisher.java

+28-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -42,8 +42,35 @@ public interface AuthorizationEventPublisher {
4242
* @param object the secured object
4343
* @param decision the decision about whether the user may access the secured object
4444
* @param <T> the secured object's type
45+
* @deprecated use
46+
* {@link #publishAuthorizationEvent(Supplier, Object, AuthorizationResult)} instead
4547
*/
48+
@Deprecated
4649
<T> void publishAuthorizationEvent(Supplier<Authentication> authentication, T object,
4750
AuthorizationDecision decision);
4851

52+
/**
53+
* Publish the given details in the form of an event, typically
54+
* {@link AuthorizationGrantedEvent} or {@link AuthorizationDeniedEvent}.
55+
*
56+
* Note that success events can be very noisy if enabled by default. Because of this
57+
* implementations may choose to drop success events by default.
58+
* @param authentication a {@link Supplier} for the current user
59+
* @param object the secured object
60+
* @param decision {@link AuthorizationResult} the decision about whether the user may
61+
* access the secured object
62+
* @param <T> the secured object's type
63+
* @since 6.4
64+
*/
65+
default <T> void publishAuthorizationEvent(Supplier<Authentication> authentication, T object,
66+
AuthorizationResult decision) {
67+
if (decision == null) {
68+
return;
69+
}
70+
if (!(decision instanceof AuthorizationDecision result)) {
71+
throw new UnsupportedOperationException("Decision must be of type AuthorizationDecision");
72+
}
73+
publishAuthorizationEvent(authentication, object, result);
74+
}
75+
4976
}

‎core/src/main/java/org/springframework/security/authorization/AuthorizationManager.java

+16-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -50,8 +50,23 @@ default void verify(Supplier<Authentication> authentication, T object) {
5050
* @param authentication the {@link Supplier} of the {@link Authentication} to check
5151
* @param object the {@link T} object to check
5252
* @return an {@link AuthorizationDecision} or null if no decision could be made
53+
* @deprecated please use {@link #authorize(Supplier, Object)} instead
5354
*/
5455
@Nullable
56+
@Deprecated
5557
AuthorizationDecision check(Supplier<Authentication> authentication, T object);
5658

59+
/**
60+
* Determines if access is granted for a specific authentication and object.
61+
* @param authentication the {@link Supplier} of the {@link Authentication} to
62+
* authorize
63+
* @param object the {@link T} object to authorize
64+
* @return an {@link AuthorizationResult}
65+
* @since 6.4
66+
*/
67+
@Nullable
68+
default AuthorizationResult authorize(Supplier<Authentication> authentication, T object) {
69+
return check(authentication, object);
70+
}
71+
5772
}

‎core/src/main/java/org/springframework/security/authorization/AuthorizationObservationContext.java

+26-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -35,6 +35,8 @@ public class AuthorizationObservationContext<T> extends Observation.Context {
3535

3636
private AuthorizationDecision decision;
3737

38+
private AuthorizationResult authorizationResult;
39+
3840
public AuthorizationObservationContext(T object) {
3941
Assert.notNull(object, "object cannot be null");
4042
this.object = object;
@@ -73,15 +75,37 @@ public T getObject() {
7375
* @return the observed {@link AuthorizationDecision}
7476
*/
7577
public AuthorizationDecision getDecision() {
76-
return this.decision;
78+
Assert.isInstanceOf(AuthorizationDecision.class,
79+
"Please call getAuthorizationResult instead. If you must call getDecision, please ensure that the result you provide is of type AuthorizationDecision");
80+
return (AuthorizationDecision) this.authorizationResult;
7781
}
7882

7983
/**
8084
* Set the observed {@link AuthorizationDecision}
8185
* @param decision the observed {@link AuthorizationDecision}
86+
* @deprecated
8287
*/
88+
@Deprecated
8389
public void setDecision(AuthorizationDecision decision) {
8490
this.decision = decision;
8591
}
8692

93+
/**
94+
* Get the observed {@link AuthorizationResult}
95+
* @return the observed {@link AuthorizationResult}
96+
* @since 6.4
97+
*/
98+
public AuthorizationResult getAuthorizationResult() {
99+
return this.authorizationResult;
100+
}
101+
102+
/**
103+
* Set the observed {@link AuthorizationResult}
104+
* @param authorizationResult the observed {@link AuthorizationResult}
105+
* @since 6.4
106+
*/
107+
public void setAuthorizationResult(AuthorizationResult authorizationResult) {
108+
this.authorizationResult = authorizationResult;
109+
}
110+
87111
}

‎core/src/main/java/org/springframework/security/authorization/AuthorizationObservationConvention.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -100,10 +100,10 @@ private String getObjectType(AuthorizationObservationContext<?> context) {
100100
}
101101

102102
private String getAuthorizationDecision(AuthorizationObservationContext<?> context) {
103-
if (context.getDecision() == null) {
103+
if (context.getAuthorizationResult() == null) {
104104
return "unknown";
105105
}
106-
return String.valueOf(context.getDecision().isGranted());
106+
return String.valueOf(context.getAuthorizationResult().isGranted());
107107
}
108108

109109
private String getAuthorities(AuthorizationObservationContext<?> context) {
@@ -114,10 +114,10 @@ private String getAuthorities(AuthorizationObservationContext<?> context) {
114114
}
115115

116116
private String getDecisionDetails(AuthorizationObservationContext<?> context) {
117-
if (context.getDecision() == null) {
117+
if (context.getAuthorizationResult() == null) {
118118
return "unknown";
119119
}
120-
AuthorizationDecision decision = context.getDecision();
120+
AuthorizationResult decision = context.getAuthorizationResult();
121121
return String.valueOf(decision);
122122
}
123123

‎core/src/main/java/org/springframework/security/authorization/ReactiveAuthorizationManager.java

+14-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2017 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -36,7 +36,9 @@ public interface ReactiveAuthorizationManager<T> {
3636
* @param authentication the Authentication to check
3737
* @param object the object to check
3838
* @return an decision or empty Mono if no decision could be made.
39+
* @deprecated please use {@link #authorize(Mono, Object)} instead
3940
*/
41+
@Deprecated
4042
Mono<AuthorizationDecision> check(Mono<Authentication> authentication, T object);
4143

4244
/**
@@ -55,4 +57,15 @@ default Mono<Void> verify(Mono<Authentication> authentication, T object) {
5557
// @formatter:on
5658
}
5759

60+
/**
61+
* Determines if access is granted for a specific authentication and object.
62+
* @param authentication the Authentication to authorize
63+
* @param object the object to check
64+
* @return an decision or empty Mono if no decision could be made.
65+
* @since 6.4
66+
*/
67+
default Mono<AuthorizationResult> authorize(Mono<Authentication> authentication, T object) {
68+
return check(authentication, object).cast(AuthorizationResult.class);
69+
}
70+
5871
}

‎core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerAfterMethodInterceptor.java

+4-9
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,10 @@
2929
import org.springframework.security.access.AccessDeniedException;
3030
import org.springframework.security.access.prepost.PostAuthorize;
3131
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
32-
import org.springframework.security.authorization.AuthorizationDecision;
3332
import org.springframework.security.authorization.AuthorizationDeniedException;
3433
import org.springframework.security.authorization.AuthorizationEventPublisher;
3534
import org.springframework.security.authorization.AuthorizationManager;
35+
import org.springframework.security.authorization.AuthorizationResult;
3636
import org.springframework.security.core.Authentication;
3737
import org.springframework.security.core.context.SecurityContextHolder;
3838
import org.springframework.security.core.context.SecurityContextHolderStrategy;
@@ -60,7 +60,7 @@ public final class AuthorizationManagerAfterMethodInterceptor implements Authori
6060

6161
private int order;
6262

63-
private AuthorizationEventPublisher eventPublisher = AuthorizationManagerAfterMethodInterceptor::noPublish;
63+
private AuthorizationEventPublisher eventPublisher = new NoOpAuthorizationEventPublisher();
6464

6565
/**
6666
* Creates an instance.
@@ -182,7 +182,7 @@ public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy strat
182182
private Object attemptAuthorization(MethodInvocation mi, Object result) {
183183
this.logger.debug(LogMessage.of(() -> "Authorizing method invocation " + mi));
184184
MethodInvocationResult object = new MethodInvocationResult(mi, result);
185-
AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, object);
185+
AuthorizationResult decision = this.authorizationManager.authorize(this::getAuthentication, object);
186186
this.eventPublisher.publishAuthorizationEvent(this::getAuthentication, object, decision);
187187
if (decision != null && !decision.isGranted()) {
188188
this.logger.debug(LogMessage.of(() -> "Failed to authorize " + mi + " with authorization manager "
@@ -193,7 +193,7 @@ private Object attemptAuthorization(MethodInvocation mi, Object result) {
193193
return result;
194194
}
195195

196-
private Object handlePostInvocationDenied(MethodInvocationResult mi, AuthorizationDecision decision) {
196+
private Object handlePostInvocationDenied(MethodInvocationResult mi, AuthorizationResult decision) {
197197
if (this.authorizationManager instanceof MethodAuthorizationDeniedHandler deniedHandler) {
198198
return deniedHandler.handleDeniedInvocationResult(mi, decision);
199199
}
@@ -209,9 +209,4 @@ private Authentication getAuthentication() {
209209
return authentication;
210210
}
211211

212-
private static <T> void noPublish(Supplier<Authentication> authentication, T object,
213-
AuthorizationDecision decision) {
214-
215-
}
216-
217212
}

‎core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerAfterReactiveMethodInterceptor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ private boolean isMultiValue(Class<?> returnType, ReactiveAdapter adapter) {
164164

165165
private Mono<Object> postAuthorize(Mono<Authentication> authentication, MethodInvocation mi, Object result) {
166166
MethodInvocationResult invocationResult = new MethodInvocationResult(mi, result);
167-
return this.authorizationManager.check(authentication, invocationResult)
167+
return this.authorizationManager.authorize(authentication, invocationResult)
168168
.switchIfEmpty(Mono.just(new AuthorizationDecision(false)))
169169
.flatMap((decision) -> postProcess(decision, invocationResult));
170170
}

‎core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerBeforeMethodInterceptor.java

+3-9
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333
import org.springframework.security.access.annotation.Secured;
3434
import org.springframework.security.access.prepost.PreAuthorize;
3535
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
36-
import org.springframework.security.authorization.AuthorizationDecision;
3736
import org.springframework.security.authorization.AuthorizationDeniedException;
3837
import org.springframework.security.authorization.AuthorizationEventPublisher;
3938
import org.springframework.security.authorization.AuthorizationManager;
@@ -65,7 +64,7 @@ public final class AuthorizationManagerBeforeMethodInterceptor implements Author
6564

6665
private int order = AuthorizationInterceptorsOrder.FIRST.getOrder();
6766

68-
private AuthorizationEventPublisher eventPublisher = AuthorizationManagerBeforeMethodInterceptor::noPublish;
67+
private AuthorizationEventPublisher eventPublisher = new NoOpAuthorizationEventPublisher();
6968

7069
/**
7170
* Creates an instance.
@@ -247,9 +246,9 @@ public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy secur
247246

248247
private Object attemptAuthorization(MethodInvocation mi) throws Throwable {
249248
this.logger.debug(LogMessage.of(() -> "Authorizing method invocation " + mi));
250-
AuthorizationDecision decision;
249+
AuthorizationResult decision;
251250
try {
252-
decision = this.authorizationManager.check(this::getAuthentication, mi);
251+
decision = this.authorizationManager.authorize(this::getAuthentication, mi);
253252
}
254253
catch (AuthorizationDeniedException denied) {
255254
return handle(mi, denied);
@@ -299,9 +298,4 @@ private Authentication getAuthentication() {
299298
return authentication;
300299
}
301300

302-
private static <T> void noPublish(Supplier<Authentication> authentication, T object,
303-
AuthorizationDecision decision) {
304-
305-
}
306-
307301
}

‎core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerBeforeReactiveMethodInterceptor.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ public Object invoke(MethodInvocation mi) throws Throwable {
140140

141141
private Flux<Object> preAuthorized(MethodInvocation mi, Flux<Object> mapping) {
142142
Mono<Authentication> authentication = ReactiveAuthenticationUtils.getAuthentication();
143-
return this.authorizationManager.check(authentication, mi)
143+
return this.authorizationManager.authorize(authentication, mi)
144144
.switchIfEmpty(Mono.just(new AuthorizationDecision(false)))
145145
.flatMapMany((decision) -> {
146146
if (decision.isGranted()) {
@@ -153,7 +153,7 @@ private Flux<Object> preAuthorized(MethodInvocation mi, Flux<Object> mapping) {
153153

154154
private Mono<Object> preAuthorized(MethodInvocation mi, Mono<Object> mapping) {
155155
Mono<Authentication> authentication = ReactiveAuthenticationUtils.getAuthentication();
156-
return this.authorizationManager.check(authentication, mi)
156+
return this.authorizationManager.authorize(authentication, mi)
157157
.switchIfEmpty(Mono.just(new AuthorizationDecision(false)))
158158
.flatMap((decision) -> {
159159
if (decision.isGranted()) {

0 commit comments

Comments
 (0)