You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
That always pick the 'id' param of the annotated method. Now I need to make it more generic, in case the id is 'hidden' somewhere else, so following the guide I updated to this version:
@Documented
@Target({ METHOD, TYPE })
@Retention(RUNTIME)
@PreAuthorize("@accessControlManager.hasAuthorization({idPath})")
@Inherited
public @interface RestrictedAccess {
/* SPEL expression that return the id of the concerned entity. By default it corresponds to a parameter named 'id' */
String idPath() default "#id";
AccessRight access();
Functionality functionality();
Class<?> entityClass();
String[] recipes() default {};
}
And I had to add:
@Bean
public PrePostTemplateDefaults prePostTemplateDefaults() {
return new PrePostTemplateDefaults();
}
In my configuration. The problem is that this last bean activates the AuthorizationAnnotationUtils and this, in turn performs a type check on the parameters of mine annotation and crashes when testing the 'entityClass' attribute since a converter from Class to String is missing. Ok, this is already suspect to me but I started the journey to add a Converter. So I tried to just declare a bean like:
@Bean
public ClassToStringConverter classToStringConverter() {
return new ClassToStringConverter();
}
The problem is that the bean is picked up by the WebConverter that's not the same instance that's used by the AuthorizationAnnotationUtils. In fact if we look at the code over there we see something like:
jzheaux
changed the title
When using PrePostTemplateDefaults there's no easy way to customize the ConversionService
PrePostTemplateDefaults pick up the ConversionService bean
Sep 3, 2024
kse-music
pushed a commit
to kse-music/spring-security
that referenced
this issue
Sep 4, 2024
Expected Behavior
When a ConversionService bean is defined, it should be picked up by the AuthorizationAnnotationUtils
Current Behavior
AuthorizationAnnotationUtils use a static access to the DefaultConversionService
Context
I have an annotation like:
That always pick the 'id' param of the annotated method. Now I need to make it more generic, in case the id is 'hidden' somewhere else, so following the guide I updated to this version:
And I had to add:
In my configuration. The problem is that this last bean activates the AuthorizationAnnotationUtils and this, in turn performs a type check on the parameters of mine annotation and crashes when testing the 'entityClass' attribute since a converter from Class to String is missing. Ok, this is already suspect to me but I started the journey to add a Converter. So I tried to just declare a bean like:
The problem is that the bean is picked up by the WebConverter that's not the same instance that's used by the AuthorizationAnnotationUtils. In fact if we look at the code over there we see something like:
So, the workaround is that I had to force my converter over there with:
The text was updated successfully, but these errors were encountered: