Skip to content

Commit 0a9c482

Browse files
jzheauxjzheaux
committed
Revert "Support SpEL Returning AuthorizationDecision"
This reverts commit 77f2977.
1 parent 77f2977 commit 0a9c482

File tree

28 files changed

+199
-520
lines changed

28 files changed

+199
-520
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/method/configuration/DeferringObservationAuthorizationManager.java

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,30 +19,18 @@
1919
import java.util.function.Supplier;
2020

2121
import io.micrometer.observation.ObservationRegistry;
22-
import org.aopalliance.intercept.MethodInvocation;
2322

2423
import org.springframework.beans.factory.ObjectProvider;
2524
import org.springframework.security.authorization.AuthorizationDecision;
2625
import org.springframework.security.authorization.AuthorizationManager;
27-
import org.springframework.security.authorization.AuthorizationResult;
2826
import org.springframework.security.authorization.ObservationAuthorizationManager;
29-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler;
30-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedPostProcessor;
31-
import org.springframework.security.authorization.method.MethodInvocationResult;
32-
import org.springframework.security.authorization.method.ThrowingMethodAuthorizationDeniedHandler;
33-
import org.springframework.security.authorization.method.ThrowingMethodAuthorizationDeniedPostProcessor;
3427
import org.springframework.security.core.Authentication;
3528
import org.springframework.util.function.SingletonSupplier;
3629

37-
final class DeferringObservationAuthorizationManager<T>
38-
implements AuthorizationManager<T>, MethodAuthorizationDeniedHandler, MethodAuthorizationDeniedPostProcessor {
30+
final class DeferringObservationAuthorizationManager<T> implements AuthorizationManager<T> {
3931

4032
private final Supplier<AuthorizationManager<T>> delegate;
4133

42-
private MethodAuthorizationDeniedHandler handler = new ThrowingMethodAuthorizationDeniedHandler();
43-
44-
private MethodAuthorizationDeniedPostProcessor postProcessor = new ThrowingMethodAuthorizationDeniedPostProcessor();
45-
4634
DeferringObservationAuthorizationManager(ObjectProvider<ObservationRegistry> provider,
4735
AuthorizationManager<T> delegate) {
4836
this.delegate = SingletonSupplier.of(() -> {
@@ -52,28 +40,11 @@ final class DeferringObservationAuthorizationManager<T>
5240
}
5341
return new ObservationAuthorizationManager<>(registry, delegate);
5442
});
55-
if (delegate instanceof MethodAuthorizationDeniedHandler h) {
56-
this.handler = h;
57-
}
58-
if (delegate instanceof MethodAuthorizationDeniedPostProcessor p) {
59-
this.postProcessor = p;
60-
}
6143
}
6244

6345
@Override
6446
public AuthorizationDecision check(Supplier<Authentication> authentication, T object) {
6547
return this.delegate.get().check(authentication, object);
6648
}
6749

68-
@Override
69-
public Object handle(MethodInvocation methodInvocation, AuthorizationResult authorizationResult) {
70-
return this.handler.handle(methodInvocation, authorizationResult);
71-
}
72-
73-
@Override
74-
public Object postProcessResult(MethodInvocationResult methodInvocationResult,
75-
AuthorizationResult authorizationResult) {
76-
return this.postProcessor.postProcessResult(methodInvocationResult, authorizationResult);
77-
}
78-
7950
}

‎config/src/main/java/org/springframework/security/config/annotation/method/configuration/DeferringObservationReactiveAuthorizationManager.java

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,31 +19,19 @@
1919
import java.util.function.Supplier;
2020

2121
import io.micrometer.observation.ObservationRegistry;
22-
import org.aopalliance.intercept.MethodInvocation;
2322
import reactor.core.publisher.Mono;
2423

2524
import org.springframework.beans.factory.ObjectProvider;
2625
import org.springframework.security.authorization.AuthorizationDecision;
27-
import org.springframework.security.authorization.AuthorizationResult;
2826
import org.springframework.security.authorization.ObservationReactiveAuthorizationManager;
2927
import org.springframework.security.authorization.ReactiveAuthorizationManager;
30-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler;
31-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedPostProcessor;
32-
import org.springframework.security.authorization.method.MethodInvocationResult;
33-
import org.springframework.security.authorization.method.ThrowingMethodAuthorizationDeniedHandler;
34-
import org.springframework.security.authorization.method.ThrowingMethodAuthorizationDeniedPostProcessor;
3528
import org.springframework.security.core.Authentication;
3629
import org.springframework.util.function.SingletonSupplier;
3730

38-
final class DeferringObservationReactiveAuthorizationManager<T> implements ReactiveAuthorizationManager<T>,
39-
MethodAuthorizationDeniedHandler, MethodAuthorizationDeniedPostProcessor {
31+
final class DeferringObservationReactiveAuthorizationManager<T> implements ReactiveAuthorizationManager<T> {
4032

4133
private final Supplier<ReactiveAuthorizationManager<T>> delegate;
4234

43-
private MethodAuthorizationDeniedHandler handler = new ThrowingMethodAuthorizationDeniedHandler();
44-
45-
private MethodAuthorizationDeniedPostProcessor postProcessor = new ThrowingMethodAuthorizationDeniedPostProcessor();
46-
4735
DeferringObservationReactiveAuthorizationManager(ObjectProvider<ObservationRegistry> provider,
4836
ReactiveAuthorizationManager<T> delegate) {
4937
this.delegate = SingletonSupplier.of(() -> {
@@ -53,28 +41,11 @@ final class DeferringObservationReactiveAuthorizationManager<T> implements React
5341
}
5442
return new ObservationReactiveAuthorizationManager<>(registry, delegate);
5543
});
56-
if (delegate instanceof MethodAuthorizationDeniedHandler h) {
57-
this.handler = h;
58-
}
59-
if (delegate instanceof MethodAuthorizationDeniedPostProcessor p) {
60-
this.postProcessor = p;
61-
}
6244
}
6345

6446
@Override
6547
public Mono<AuthorizationDecision> check(Mono<Authentication> authentication, T object) {
6648
return this.delegate.get().check(authentication, object);
6749
}
6850

69-
@Override
70-
public Object handle(MethodInvocation methodInvocation, AuthorizationResult authorizationResult) {
71-
return this.handler.handle(methodInvocation, authorizationResult);
72-
}
73-
74-
@Override
75-
public Object postProcessResult(MethodInvocationResult methodInvocationResult,
76-
AuthorizationResult authorizationResult) {
77-
return this.postProcessor.postProcessResult(methodInvocationResult, authorizationResult);
78-
}
79-
8051
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/Authz.java

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818

1919
import reactor.core.publisher.Mono;
2020

21-
import org.springframework.security.authorization.AuthorizationDecision;
22-
import org.springframework.security.authorization.AuthorizationResult;
2321
import org.springframework.security.core.Authentication;
2422
import org.springframework.stereotype.Component;
2523

@@ -47,20 +45,4 @@ public boolean check(Authentication authentication, String message) {
4745
return message != null && message.contains(authentication.getName());
4846
}
4947

50-
public AuthorizationResult checkResult(boolean result) {
51-
return new AuthzResult(result);
52-
}
53-
54-
public Mono<AuthorizationResult> checkReactiveResult(boolean result) {
55-
return Mono.just(checkResult(result));
56-
}
57-
58-
public static class AuthzResult extends AuthorizationDecision {
59-
60-
public AuthzResult(boolean granted) {
61-
super(granted);
62-
}
63-
64-
}
65-
6648
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityService.java

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -173,11 +173,6 @@ public interface MethodSecurityService {
173173
@PreAuthorize(value = "hasRole('ADMIN')", handlerClass = UserFallbackDeniedHandler.class)
174174
UserRecordWithEmailProtected getUserWithFallbackWhenUnauthorized();
175175

176-
@PreAuthorize(value = "@authz.checkResult(#result)", handlerClass = MethodAuthorizationDeniedHandler.class)
177-
@PostAuthorize(value = "@authz.checkResult(!#result)",
178-
postProcessorClass = MethodAuthorizationDeniedPostProcessor.class)
179-
String checkCustomResult(boolean result);
180-
181176
class StarMaskingHandler implements MethodAuthorizationDeniedHandler {
182177

183178
@Override

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityServiceConfig.java

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,4 @@ MethodSecurityService service() {
2828
return new MethodSecurityServiceImpl();
2929
}
3030

31-
@Bean
32-
ReactiveMethodSecurityService reactiveService() {
33-
return new ReactiveMethodSecurityServiceImpl();
34-
}
35-
36-
@Bean
37-
Authz authz() {
38-
return new Authz();
39-
}
40-
4131
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityServiceImpl.java

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -197,9 +197,4 @@ public UserRecordWithEmailProtected getUserWithFallbackWhenUnauthorized() {
197197
return new UserRecordWithEmailProtected("username", "[email protected]");
198198
}
199199

200-
@Override
201-
public String checkCustomResult(boolean result) {
202-
return "ok";
203-
}
204-
205200
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,6 @@
6666
import org.springframework.security.authorization.method.AuthorizationInterceptorsOrder;
6767
import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
6868
import org.springframework.security.authorization.method.AuthorizeReturnObject;
69-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler;
70-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedPostProcessor;
7169
import org.springframework.security.authorization.method.MethodInvocationResult;
7270
import org.springframework.security.authorization.method.PrePostTemplateDefaults;
7371
import org.springframework.security.config.Customizer;
@@ -94,8 +92,6 @@
9492
import static org.mockito.Mockito.atLeastOnce;
9593
import static org.mockito.Mockito.mock;
9694
import static org.mockito.Mockito.verify;
97-
import static org.mockito.Mockito.verifyNoInteractions;
98-
import static org.mockito.Mockito.verifyNoMoreInteractions;
9995

10096
/**
10197
* Tests for {@link PrePostMethodSecurityConfiguration}.
@@ -929,23 +925,6 @@ void getUserWhenNotAuthorizedAndHandlerFallbackValueThenReturnFallbackValue() {
929925
assertThat(user.name()).isEqualTo("Protected");
930926
}
931927

932-
@Test
933-
@WithMockUser
934-
void getUserWhenNotAuthorizedThenHandlerUsesCustomAuthorizationDecision() {
935-
this.spring.register(MethodSecurityServiceConfig.class, CustomResultConfig.class).autowire();
936-
MethodSecurityService service = this.spring.getContext().getBean(MethodSecurityService.class);
937-
MethodAuthorizationDeniedHandler handler = this.spring.getContext()
938-
.getBean(MethodAuthorizationDeniedHandler.class);
939-
MethodAuthorizationDeniedPostProcessor postProcessor = this.spring.getContext()
940-
.getBean(MethodAuthorizationDeniedPostProcessor.class);
941-
assertThat(service.checkCustomResult(false)).isNull();
942-
verify(handler).handle(any(), any(Authz.AuthzResult.class));
943-
verifyNoInteractions(postProcessor);
944-
assertThat(service.checkCustomResult(true)).isNull();
945-
verify(postProcessor).postProcessResult(any(), any(Authz.AuthzResult.class));
946-
verifyNoMoreInteractions(handler);
947-
}
948-
949928
private static Consumer<ConfigurableWebApplicationContext> disallowBeanOverriding() {
950929
return (context) -> ((AnnotationConfigWebApplicationContext) context).setAllowBeanDefinitionOverriding(false);
951930
}
@@ -1470,23 +1449,4 @@ public String getName() {
14701449

14711450
}
14721451

1473-
@EnableMethodSecurity
1474-
static class CustomResultConfig {
1475-
1476-
MethodAuthorizationDeniedHandler handler = mock(MethodAuthorizationDeniedHandler.class);
1477-
1478-
MethodAuthorizationDeniedPostProcessor postProcessor = mock(MethodAuthorizationDeniedPostProcessor.class);
1479-
1480-
@Bean
1481-
MethodAuthorizationDeniedHandler methodAuthorizationDeniedHandler() {
1482-
return this.handler;
1483-
}
1484-
1485-
@Bean
1486-
MethodAuthorizationDeniedPostProcessor methodAuthorizationDeniedPostProcessor() {
1487-
return this.postProcessor;
1488-
}
1489-
1490-
}
1491-
14921452
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecurityConfigurationTests.java

Lines changed: 1 addition & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -47,23 +47,15 @@
4747
import org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory;
4848
import org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory.TargetVisitor;
4949
import org.springframework.security.authorization.method.AuthorizeReturnObject;
50-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler;
51-
import org.springframework.security.authorization.method.MethodAuthorizationDeniedPostProcessor;
5250
import org.springframework.security.config.Customizer;
5351
import org.springframework.security.config.core.GrantedAuthorityDefaults;
5452
import org.springframework.security.config.test.SpringTestContext;
5553
import org.springframework.security.config.test.SpringTestContextExtension;
5654
import org.springframework.security.core.Authentication;
5755
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
5856
import org.springframework.security.core.userdetails.User;
59-
import org.springframework.security.test.context.support.WithMockUser;
6057

6158
import static org.assertj.core.api.Assertions.assertThat;
62-
import static org.mockito.ArgumentMatchers.any;
63-
import static org.mockito.Mockito.mock;
64-
import static org.mockito.Mockito.verify;
65-
import static org.mockito.Mockito.verifyNoInteractions;
66-
import static org.mockito.Mockito.verifyNoMoreInteractions;
6759

6860
/**
6961
* @author Tadaya Tsuyukubo
@@ -73,7 +65,7 @@ public class ReactiveMethodSecurityConfigurationTests {
7365

7466
public final SpringTestContext spring = new SpringTestContext(this);
7567

76-
@Autowired(required = false)
68+
@Autowired
7769
DefaultMethodSecurityExpressionHandler methodSecurityExpressionHandler;
7870

7971
@Test
@@ -220,23 +212,6 @@ public void findAllWhenNestedPreAuthorizeThenAuthorizes() {
220212
.verifyError(AccessDeniedException.class);
221213
}
222214

223-
@Test
224-
@WithMockUser
225-
void getUserWhenNotAuthorizedThenHandlerUsesCustomAuthorizationDecision() {
226-
this.spring.register(MethodSecurityServiceConfig.class, CustomResultConfig.class).autowire();
227-
ReactiveMethodSecurityService service = this.spring.getContext().getBean(ReactiveMethodSecurityService.class);
228-
MethodAuthorizationDeniedHandler handler = this.spring.getContext()
229-
.getBean(MethodAuthorizationDeniedHandler.class);
230-
MethodAuthorizationDeniedPostProcessor postProcessor = this.spring.getContext()
231-
.getBean(MethodAuthorizationDeniedPostProcessor.class);
232-
assertThat(service.checkCustomResult(false).block()).isNull();
233-
verify(handler).handle(any(), any(Authz.AuthzResult.class));
234-
verifyNoInteractions(postProcessor);
235-
assertThat(service.checkCustomResult(true).block()).isNull();
236-
verify(postProcessor).postProcessResult(any(), any(Authz.AuthzResult.class));
237-
verifyNoMoreInteractions(handler);
238-
}
239-
240215
private static Consumer<User.UserBuilder> authorities(String... authorities) {
241216
return (builder) -> builder.authorities(authorities);
242217
}
@@ -378,23 +353,4 @@ public Mono<String> getName() {
378353

379354
}
380355

381-
@EnableReactiveMethodSecurity
382-
static class CustomResultConfig {
383-
384-
MethodAuthorizationDeniedHandler handler = mock(MethodAuthorizationDeniedHandler.class);
385-
386-
MethodAuthorizationDeniedPostProcessor postProcessor = mock(MethodAuthorizationDeniedPostProcessor.class);
387-
388-
@Bean
389-
MethodAuthorizationDeniedHandler methodAuthorizationDeniedHandler() {
390-
return this.handler;
391-
}
392-
393-
@Bean
394-
MethodAuthorizationDeniedPostProcessor methodAuthorizationDeniedPostProcessor() {
395-
return this.postProcessor;
396-
}
397-
398-
}
399-
400356
}

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecurityService.java

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,11 +85,6 @@ public interface ReactiveMethodSecurityService {
8585
@Mask(expression = "@myMasker.getMask(returnObject)")
8686
Mono<String> postAuthorizeWithMaskAnnotationUsingBean();
8787

88-
@PreAuthorize(value = "@authz.checkReactiveResult(#result)", handlerClass = MethodAuthorizationDeniedHandler.class)
89-
@PostAuthorize(value = "@authz.checkReactiveResult(!#result)",
90-
postProcessorClass = MethodAuthorizationDeniedPostProcessor.class)
91-
Mono<String> checkCustomResult(boolean result);
92-
9388
class StarMaskingHandler implements MethodAuthorizationDeniedHandler {
9489

9590
@Override

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecurityServiceImpl.java

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,4 @@ public Mono<String> postAuthorizeWithMaskAnnotationUsingBean() {
8282
return Mono.just("ok");
8383
}
8484

85-
@Override
86-
public Mono<String> checkCustomResult(boolean result) {
87-
return Mono.just("ok");
88-
}
89-
9085
}

0 commit comments

Comments
 (0)