Skip to content

Commit 626610a

Browse files
jzheauxjzheaux
committed
Polish Annotation API
Rename to a class that isn't focused on the synthesis implementation detail. Also add Security to the front of the name to clarify that it is only intended for security annotations, reminiscent of SecurityMetadataSource. Refine method signatures to better articulate supported use cases. Issue gh-15286
1 parent cc6de8f commit 626610a

20 files changed

+298
-233
lines changed

‎core/src/main/java/org/springframework/security/authorization/method/Jsr250AuthorizationManager.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@
3434
import org.springframework.security.authorization.AuthorizationDecision;
3535
import org.springframework.security.authorization.AuthorizationManager;
3636
import org.springframework.security.core.Authentication;
37-
import org.springframework.security.core.annotation.AnnotationSynthesizer;
38-
import org.springframework.security.core.annotation.AnnotationSynthesizers;
37+
import org.springframework.security.core.annotation.SecurityAnnotationScanner;
38+
import org.springframework.security.core.annotation.SecurityAnnotationScanners;
3939
import org.springframework.util.Assert;
4040

4141
/**
@@ -95,7 +95,7 @@ public AuthorizationDecision check(Supplier<Authentication> authentication, Meth
9595

9696
private final class Jsr250AuthorizationManagerRegistry extends AbstractAuthorizationManagerRegistry {
9797

98-
private final AnnotationSynthesizer<?> synthesizer = AnnotationSynthesizers
98+
private final SecurityAnnotationScanner<?> scanner = SecurityAnnotationScanners
9999
.requireUnique(List.of(DenyAll.class, PermitAll.class, RolesAllowed.class));
100100

101101
@NonNull
@@ -117,7 +117,7 @@ AuthorizationManager<MethodInvocation> resolveManager(Method method, Class<?> ta
117117

118118
private Annotation findJsr250Annotation(Method method, Class<?> targetClass) {
119119
Class<?> targetClassToUse = (targetClass != null) ? targetClass : method.getDeclaringClass();
120-
return this.synthesizer.synthesize(method, targetClassToUse);
120+
return this.scanner.scan(method, targetClassToUse);
121121
}
122122

123123
private Set<String> getAllowedRolesWithPrefix(RolesAllowed rolesAllowed) {

‎core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@
2525
import org.springframework.context.ApplicationContext;
2626
import org.springframework.expression.Expression;
2727
import org.springframework.security.access.prepost.PostAuthorize;
28-
import org.springframework.security.core.annotation.AnnotationSynthesizer;
29-
import org.springframework.security.core.annotation.AnnotationSynthesizers;
3028
import org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults;
29+
import org.springframework.security.core.annotation.SecurityAnnotationScanner;
30+
import org.springframework.security.core.annotation.SecurityAnnotationScanners;
3131
import org.springframework.util.Assert;
3232

3333
/**
@@ -41,12 +41,12 @@ final class PostAuthorizeExpressionAttributeRegistry extends AbstractExpressionA
4141

4242
private final MethodAuthorizationDeniedHandler defaultHandler = new ThrowingMethodAuthorizationDeniedHandler();
4343

44-
private final AnnotationSynthesizer<HandleAuthorizationDenied> handleAuthorizationDeniedSynthesizer = AnnotationSynthesizers
44+
private final SecurityAnnotationScanner<HandleAuthorizationDenied> handleAuthorizationDeniedScanner = SecurityAnnotationScanners
4545
.requireUnique(HandleAuthorizationDenied.class);
4646

4747
private Function<Class<? extends MethodAuthorizationDeniedHandler>, MethodAuthorizationDeniedHandler> handlerResolver;
4848

49-
private AnnotationSynthesizer<PostAuthorize> postAuthorizeSynthesizer = AnnotationSynthesizers
49+
private SecurityAnnotationScanner<PostAuthorize> postAuthorizeScanner = SecurityAnnotationScanners
5050
.requireUnique(PostAuthorize.class);
5151

5252
PostAuthorizeExpressionAttributeRegistry() {
@@ -68,8 +68,7 @@ ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
6868

6969
private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?> targetClass) {
7070
Class<?> targetClassToUse = targetClass(method, targetClass);
71-
HandleAuthorizationDenied deniedHandler = this.handleAuthorizationDeniedSynthesizer.synthesize(method,
72-
targetClassToUse);
71+
HandleAuthorizationDenied deniedHandler = this.handleAuthorizationDeniedScanner.scan(method, targetClassToUse);
7372
if (deniedHandler != null) {
7473
return this.handlerResolver.apply(deniedHandler.handlerClass());
7574
}
@@ -78,7 +77,7 @@ private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?>
7877

7978
private PostAuthorize findPostAuthorizeAnnotation(Method method, Class<?> targetClass) {
8079
Class<?> targetClassToUse = targetClass(method, targetClass);
81-
return this.postAuthorizeSynthesizer.synthesize(method, targetClassToUse);
80+
return this.postAuthorizeScanner.scan(method, targetClassToUse);
8281
}
8382

8483
/**
@@ -92,7 +91,7 @@ void setApplicationContext(ApplicationContext context) {
9291
}
9392

9493
void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
95-
this.postAuthorizeSynthesizer = AnnotationSynthesizers.requireUnique(PostAuthorize.class, templateDefaults);
94+
this.postAuthorizeScanner = SecurityAnnotationScanners.requireUnique(PostAuthorize.class, templateDefaults);
9695
}
9796

9897
private MethodAuthorizationDeniedHandler resolveHandler(ApplicationContext context,

‎core/src/main/java/org/springframework/security/authorization/method/PostFilterExpressionAttributeRegistry.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@
2121
import org.springframework.expression.Expression;
2222
import org.springframework.lang.NonNull;
2323
import org.springframework.security.access.prepost.PostFilter;
24-
import org.springframework.security.core.annotation.AnnotationSynthesizer;
25-
import org.springframework.security.core.annotation.AnnotationSynthesizers;
2624
import org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults;
25+
import org.springframework.security.core.annotation.SecurityAnnotationScanner;
26+
import org.springframework.security.core.annotation.SecurityAnnotationScanners;
2727

2828
/**
2929
* For internal use only, as this contract is likely to change.
@@ -34,7 +34,7 @@
3434
*/
3535
final class PostFilterExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry<ExpressionAttribute> {
3636

37-
private AnnotationSynthesizer<PostFilter> synthesizer = AnnotationSynthesizers.requireUnique(PostFilter.class);
37+
private SecurityAnnotationScanner<PostFilter> scanner = SecurityAnnotationScanners.requireUnique(PostFilter.class);
3838

3939
@NonNull
4040
@Override
@@ -49,12 +49,12 @@ ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
4949
}
5050

5151
void setTemplateDefaults(AnnotationTemplateExpressionDefaults defaults) {
52-
this.synthesizer = AnnotationSynthesizers.requireUnique(PostFilter.class, defaults);
52+
this.scanner = SecurityAnnotationScanners.requireUnique(PostFilter.class, defaults);
5353
}
5454

5555
private PostFilter findPostFilterAnnotation(Method method, Class<?> targetClass) {
5656
Class<?> targetClassToUse = targetClass(method, targetClass);
57-
return this.synthesizer.synthesize(method, targetClassToUse);
57+
return this.scanner.scan(method, targetClassToUse);
5858
}
5959

6060
}

‎core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@
2525
import org.springframework.context.ApplicationContext;
2626
import org.springframework.expression.Expression;
2727
import org.springframework.security.access.prepost.PreAuthorize;
28-
import org.springframework.security.core.annotation.AnnotationSynthesizer;
29-
import org.springframework.security.core.annotation.AnnotationSynthesizers;
3028
import org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults;
29+
import org.springframework.security.core.annotation.SecurityAnnotationScanner;
30+
import org.springframework.security.core.annotation.SecurityAnnotationScanners;
3131
import org.springframework.util.Assert;
3232

3333
/**
@@ -41,12 +41,12 @@ final class PreAuthorizeExpressionAttributeRegistry extends AbstractExpressionAt
4141

4242
private final MethodAuthorizationDeniedHandler defaultHandler = new ThrowingMethodAuthorizationDeniedHandler();
4343

44-
private final AnnotationSynthesizer<HandleAuthorizationDenied> handleAuthorizationDeniedSynthesizer = AnnotationSynthesizers
44+
private final SecurityAnnotationScanner<HandleAuthorizationDenied> handleAuthorizationDeniedScanner = SecurityAnnotationScanners
4545
.requireUnique(HandleAuthorizationDenied.class);
4646

4747
private Function<Class<? extends MethodAuthorizationDeniedHandler>, MethodAuthorizationDeniedHandler> handlerResolver;
4848

49-
private AnnotationSynthesizer<PreAuthorize> preAuthorizeSynthesizer = AnnotationSynthesizers
49+
private SecurityAnnotationScanner<PreAuthorize> preAuthorizeScanner = SecurityAnnotationScanners
5050
.requireUnique(PreAuthorize.class);
5151

5252
PreAuthorizeExpressionAttributeRegistry() {
@@ -68,8 +68,7 @@ ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
6868

6969
private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?> targetClass) {
7070
Class<?> targetClassToUse = targetClass(method, targetClass);
71-
HandleAuthorizationDenied deniedHandler = this.handleAuthorizationDeniedSynthesizer.synthesize(method,
72-
targetClassToUse);
71+
HandleAuthorizationDenied deniedHandler = this.handleAuthorizationDeniedScanner.scan(method, targetClassToUse);
7372
if (deniedHandler != null) {
7473
return this.handlerResolver.apply(deniedHandler.handlerClass());
7574
}
@@ -78,7 +77,7 @@ private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?>
7877

7978
private PreAuthorize findPreAuthorizeAnnotation(Method method, Class<?> targetClass) {
8079
Class<?> targetClassToUse = targetClass(method, targetClass);
81-
return this.preAuthorizeSynthesizer.synthesize(method, targetClassToUse);
80+
return this.preAuthorizeScanner.scan(method, targetClassToUse);
8281
}
8382

8483
/**
@@ -92,7 +91,7 @@ void setApplicationContext(ApplicationContext context) {
9291
}
9392

9493
void setTemplateDefaults(AnnotationTemplateExpressionDefaults defaults) {
95-
this.preAuthorizeSynthesizer = AnnotationSynthesizers.requireUnique(PreAuthorize.class, defaults);
94+
this.preAuthorizeScanner = SecurityAnnotationScanners.requireUnique(PreAuthorize.class, defaults);
9695
}
9796

9897
private MethodAuthorizationDeniedHandler resolveHandler(ApplicationContext context,

‎core/src/main/java/org/springframework/security/authorization/method/PreFilterExpressionAttributeRegistry.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@
2121
import org.springframework.expression.Expression;
2222
import org.springframework.lang.NonNull;
2323
import org.springframework.security.access.prepost.PreFilter;
24-
import org.springframework.security.core.annotation.AnnotationSynthesizer;
25-
import org.springframework.security.core.annotation.AnnotationSynthesizers;
2624
import org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults;
25+
import org.springframework.security.core.annotation.SecurityAnnotationScanner;
26+
import org.springframework.security.core.annotation.SecurityAnnotationScanners;
2727

2828
/**
2929
* For internal use only, as this contract is likely to change.
@@ -35,7 +35,7 @@
3535
final class PreFilterExpressionAttributeRegistry
3636
extends AbstractExpressionAttributeRegistry<PreFilterExpressionAttributeRegistry.PreFilterExpressionAttribute> {
3737

38-
private AnnotationSynthesizer<PreFilter> synthesizer = AnnotationSynthesizers.requireUnique(PreFilter.class);
38+
private SecurityAnnotationScanner<PreFilter> scanner = SecurityAnnotationScanners.requireUnique(PreFilter.class);
3939

4040
@NonNull
4141
@Override
@@ -50,12 +50,12 @@ PreFilterExpressionAttribute resolveAttribute(Method method, Class<?> targetClas
5050
}
5151

5252
void setTemplateDefaults(AnnotationTemplateExpressionDefaults defaults) {
53-
this.synthesizer = AnnotationSynthesizers.requireUnique(PreFilter.class, defaults);
53+
this.scanner = SecurityAnnotationScanners.requireUnique(PreFilter.class, defaults);
5454
}
5555

5656
private PreFilter findPreFilterAnnotation(Method method, Class<?> targetClass) {
5757
Class<?> targetClassToUse = targetClass(method, targetClass);
58-
return this.synthesizer.synthesize(method, targetClassToUse);
58+
return this.scanner.scan(method, targetClassToUse);
5959
}
6060

6161
static final class PreFilterExpressionAttribute extends ExpressionAttribute {

‎core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@
3232
import org.springframework.security.authorization.AuthorizationDecision;
3333
import org.springframework.security.authorization.AuthorizationManager;
3434
import org.springframework.security.core.Authentication;
35-
import org.springframework.security.core.annotation.AnnotationSynthesizer;
36-
import org.springframework.security.core.annotation.AnnotationSynthesizers;
35+
import org.springframework.security.core.annotation.SecurityAnnotationScanner;
36+
import org.springframework.security.core.annotation.SecurityAnnotationScanners;
3737
import org.springframework.util.Assert;
3838

3939
/**
@@ -51,7 +51,7 @@ public final class SecuredAuthorizationManager implements AuthorizationManager<M
5151

5252
private final Map<MethodClassKey, Set<String>> cachedAuthorities = new ConcurrentHashMap<>();
5353

54-
private final AnnotationSynthesizer<Secured> synthesizer = AnnotationSynthesizers.requireUnique(Secured.class);
54+
private final SecurityAnnotationScanner<Secured> scanner = SecurityAnnotationScanners.requireUnique(Secured.class);
5555

5656
/**
5757
* Sets an {@link AuthorizationManager} that accepts a collection of authority
@@ -95,7 +95,7 @@ private Set<String> resolveAuthorities(Method method, Class<?> targetClass) {
9595

9696
private Secured findSecuredAnnotation(Method method, Class<?> targetClass) {
9797
Class<?> targetClassToUse = (targetClass != null) ? targetClass : method.getDeclaringClass();
98-
return this.synthesizer.synthesize(method, targetClassToUse);
98+
return this.scanner.scan(method, targetClassToUse);
9999
}
100100

101101
}

‎core/src/main/java/org/springframework/security/core/annotation/AbstractSecurityAnnotationScanner.java

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/*
2+
* Copyright 2002-2024 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.core.annotation;
18+
19+
import java.lang.annotation.Annotation;
20+
import java.lang.reflect.AnnotatedElement;
21+
import java.lang.reflect.Method;
22+
import java.lang.reflect.Parameter;
23+
24+
import org.springframework.core.annotation.MergedAnnotation;
25+
import org.springframework.lang.Nullable;
26+
import org.springframework.util.Assert;
27+
28+
/**
29+
* An abstract class to hide the {@link MergedAnnotation} implementation details.
30+
*
31+
* <p>
32+
* Also handy for allowing each scanner to delegate to another without needing to
33+
* synthesize twice.
34+
*/
35+
abstract class AbstractSecurityAnnotationScanner<A extends Annotation> implements SecurityAnnotationScanner<A> {
36+
37+
/**
38+
* {@inheritDoc}
39+
**/
40+
@Nullable
41+
@Override
42+
public A scan(Method method, Class<?> targetClass) {
43+
Assert.notNull(targetClass, "targetClass cannot be null");
44+
MergedAnnotation<A> annotation = merge(method, targetClass);
45+
if (annotation == null) {
46+
return null;
47+
}
48+
return annotation.synthesize();
49+
}
50+
51+
/**
52+
* {@inheritDoc}
53+
**/
54+
@Nullable
55+
@Override
56+
public A scan(Parameter parameter) {
57+
MergedAnnotation<A> annotation = merge(parameter, null);
58+
if (annotation == null) {
59+
return null;
60+
}
61+
return annotation.synthesize();
62+
}
63+
64+
abstract MergedAnnotation<A> merge(AnnotatedElement element, Class<?> targetClass);
65+
66+
}

‎core/src/main/java/org/springframework/security/core/annotation/AnnotationSynthesizers.java

Lines changed: 0 additions & 81 deletions
This file was deleted.

0 commit comments

Comments
 (0)