Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 49f308a

Browse files
committed
Use Supplier<? extends @nullable Authentication>
Previously Supplier<@nullable Authentication> was used. This prevented Supplier<Authentication> from being used. The code now uses Supplier<? extends @nullable Authentication> which allows for both Supplier<@nullable Authentication> and Supplier<Authentication>. Closes gh-17814 
1 parent 4cbe8de commit 49f308a

File tree

32 files changed

+70
-43
lines changed

32 files changed

+70
-43
lines changed

‎config/src/main/java/org/springframework/security/config/method/PointcutDelegatingAuthorizationManager.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import java.util.function.Supplier;
2121

2222
import org.aopalliance.intercept.MethodInvocation;
23+
import org.jspecify.annotations.Nullable;
2324

2425
import org.springframework.aop.Pointcut;
2526
import org.springframework.aop.support.AopUtils;
@@ -37,7 +38,8 @@ class PointcutDelegatingAuthorizationManager implements AuthorizationManager<Met
3738
}
3839

3940
@Override
40-
public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocation object) {
41+
public AuthorizationResult authorize(Supplier<? extends @Nullable Authentication> authentication,
42+
MethodInvocation object) {
4143
for (Map.Entry<Pointcut, AuthorizationManager<MethodInvocation>> entry : this.managers.entrySet()) {
4244
Class<?> targetClass = (object.getThis() != null) ? AopUtils.getTargetClass(object.getThis()) : null;
4345
if (entry.getKey().getClassFilter().matches(targetClass)

‎config/src/main/java/org/springframework/security/config/websocket/WebSocketMessageBrokerSecurityBeanDefinitionParser.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.util.Set;
2626
import java.util.function.Supplier;
2727

28+
import org.jspecify.annotations.Nullable;
2829
import org.w3c.dom.Element;
2930

3031
import org.springframework.beans.BeansException;
@@ -458,7 +459,7 @@ private ExpressionBasedAuthorizationManager(
458459
}
459460

460461
@Override
461-
public AuthorizationResult authorize(Supplier<Authentication> authentication,
462+
public AuthorizationResult authorize(Supplier<? extends@NullableAuthentication> authentication,
462463
MessageAuthorizationContext<?> object) {
463464
EvaluationContext context = this.expressionHandler.createEvaluationContext(authentication, object);
464465
boolean granted = ExpressionUtils.evaluateAsBoolean(this.expression, context);

‎config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ import org.springframework.security.config.annotation.web.configurers.AuthorizeH
2929
import org.springframework.security.config.core.GrantedAuthorityDefaults
3030
import org.springframework.security.core.Authentication
3131
import org.springframework.security.web.access.IpAddressAuthorizationManager
32-
import org.springframework.security.web.access.intercept.AuthorizationFilter
3332
import org.springframework.security.web.access.intercept.RequestAuthorizationContext
3433
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher
3534
import org.springframework.security.web.util.matcher.AnyRequestMatcher
@@ -235,13 +234,13 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl {
235234
* Specify that URLs are allowed by anyone.
236235
*/
237236
val permitAll: AuthorizationManager<RequestAuthorizationContext> =
238-
AuthorizationManager { _: Supplier<Authentication?>, _: RequestAuthorizationContext -> AuthorizationDecision(true) }
237+
AuthorizationManager { _: Supplier<outAuthentication>, _: RequestAuthorizationContext -> AuthorizationDecision(true) }
239238

240239
/**
241240
* Specify that URLs are not allowed by anyone.
242241
*/
243242
val denyAll: AuthorizationManager<RequestAuthorizationContext> =
244-
AuthorizationManager { _: Supplier<Authentication?>, _: RequestAuthorizationContext -> AuthorizationDecision(false) }
243+
AuthorizationManager { _: Supplier<outAuthentication>, _: RequestAuthorizationContext -> AuthorizationDecision(false) }
245244

246245
/**
247246
* Specify that URLs are allowed by any authenticated user.

‎config/src/test/java/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525

2626
import jakarta.servlet.http.HttpServletRequest;
2727
import jakarta.servlet.http.HttpSession;
28+
import org.jspecify.annotations.Nullable;
2829
import org.junit.jupiter.api.Test;
2930
import org.junit.jupiter.api.extension.ExtendWith;
3031

@@ -310,7 +311,7 @@ private AccessAuthorizationManagerAdapter(AccessDecisionManager delegate, String
310311
}
311312

312313
@Override
313-
public AuthorizationResult authorize(Supplier<Authentication> authentication,
314+
public AuthorizationResult authorize(Supplier<? extends@NullableAuthentication> authentication,
314315
RequestAuthorizationContext object) {
315316
HttpServletRequest request = object.getRequest();
316317
FilterInvocation invocation = new FilterInvocation(request.getContextPath(), request.getServletPath(),

‎config/src/test/java/org/springframework/security/config/method/MethodSecurityBeanDefinitionParserTests.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -464,7 +464,9 @@ public boolean hasPermission(Authentication authentication, Serializable targetI
464464
static class MyAuthorizationManager implements AuthorizationManager<MethodInvocation> {
465465

466466
@Override
467-
public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocation object) {
467+
public AuthorizationResult authorize(
468+
Supplier<? extends @org.jspecify.annotations.Nullable Authentication> authentication,
469+
MethodInvocation object) {
468470
return new AuthorizationDecision("bob".equals(authentication.get().getName()));
469471
}
470472

‎config/src/test/java/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.function.Supplier;
2727

2828
import org.assertj.core.api.ThrowableAssert;
29+
import org.jspecify.annotations.Nullable;
2930
import org.junit.jupiter.api.Test;
3031
import org.junit.jupiter.api.extension.ExtendWith;
3132

@@ -735,7 +736,7 @@ public boolean denyNile() {
735736
}
736737

737738
@Override
738-
public EvaluationContext createEvaluationContext(Supplier<Authentication> authentication,
739+
public EvaluationContext createEvaluationContext(Supplier<? extends@NullableAuthentication> authentication,
739740
Message<Object> message) {
740741
return new StandardEvaluationContext(new MessageSecurityExpressionRoot(authentication, message) {
741742
public boolean denyNile() {

‎config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ class AuthorizeHttpRequestsDslTests {
193193
open class MvcMatcherPathVariablesConfig {
194194
@Bean
195195
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
196-
val access = AuthorizationManager { _: Supplier<Authentication?>, context: RequestAuthorizationContext ->
196+
val access = AuthorizationManager { _: Supplier<outAuthentication>, context: RequestAuthorizationContext ->
197197
AuthorizationDecision(context.variables["userName"] == "user")
198198
}
199199
http {

‎core/src/main/java/org/springframework/security/access/expression/SecurityExpressionHandler.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ public interface SecurityExpressionHandler<T> extends AopInfrastructureBean {
5757
* @return the {@link EvaluationContext} to use
5858
* @since 5.8
5959
*/
60-
default EvaluationContext createEvaluationContext(Supplier<@Nullable Authentication> authentication, T invocation) {
60+
default EvaluationContext createEvaluationContext(Supplier<? extends @Nullable Authentication> authentication,
61+
T invocation) {
6162
return createEvaluationContext(authentication.get(), invocation);
6263
}
6364

‎core/src/main/java/org/springframework/security/access/expression/SecurityExpressionRoot.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ public SecurityExpressionRoot(@Nullable Authentication authentication) {
8989
* Cannot be null.
9090
* @since 5.8
9191
*/
92-
public SecurityExpressionRoot(Supplier<@Nullable Authentication> authentication) {
92+
public SecurityExpressionRoot(Supplier<? extends@Nullable Authentication> authentication) {
9393
this.authentication = SingletonSupplier.of(() -> {
9494
Authentication value = authentication.get();
9595
Assert.notNull(value, "Authentication object cannot be null");

‎core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public StandardEvaluationContext createEvaluationContextInternal(@Nullable Authe
8585
}
8686

8787
@Override
88-
public EvaluationContext createEvaluationContext(Supplier<@Nullable Authentication> authentication,
88+
public EvaluationContext createEvaluationContext(Supplier<? extends@Nullable Authentication> authentication,
8989
MethodInvocation mi) {
9090
MethodSecurityExpressionOperations root = createSecurityExpressionRoot(authentication, mi);
9191
MethodSecurityEvaluationContext ctx = new MethodSecurityEvaluationContext(root, mi,
@@ -104,7 +104,7 @@ protected MethodSecurityExpressionOperations createSecurityExpressionRoot(@Nulla
104104
}
105105

106106
private MethodSecurityExpressionOperations createSecurityExpressionRoot(
107-
Supplier<@Nullable Authentication> authentication, MethodInvocation invocation) {
107+
Supplier<? extends@Nullable Authentication> authentication, MethodInvocation invocation) {
108108
MethodSecurityExpressionRoot root = new MethodSecurityExpressionRoot(authentication);
109109
root.setThis(invocation.getThis());
110110
root.setPermissionEvaluator(getPermissionEvaluator());

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /