Skip to content

Commit 5ad3baf

Browse files
kse-musickse-music
committed
Support @AuthenticationPrincipal on interfaces
Closes gh-16177
1 parent dc82a6e commit 5ad3baf

File tree

4 files changed

+184
-7
lines changed

4 files changed

+184
-7
lines changed

‎core/src/main/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScanner.java

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import java.lang.annotation.Annotation;
2020
import java.lang.reflect.AnnotatedElement;
21+
import java.lang.reflect.Executable;
2122
import java.lang.reflect.Method;
2223
import java.lang.reflect.Parameter;
2324
import java.util.ArrayList;
@@ -83,6 +84,7 @@
8384
*
8485
* @param <A> the annotation to search for and synthesize
8586
* @author Josh Cummings
87+
* @author DingHao
8688
* @since 6.4
8789
*/
8890
final class UniqueSecurityAnnotationScanner<A extends Annotation> extends AbstractSecurityAnnotationScanner<A> {
@@ -107,7 +109,7 @@ final class UniqueSecurityAnnotationScanner<A extends Annotation> extends Abstra
107109
MergedAnnotation<A> merge(AnnotatedElement element, Class<?> targetClass) {
108110
if (element instanceof Parameter parameter) {
109111
return this.uniqueParameterAnnotationCache.computeIfAbsent(parameter, (p) -> {
110-
List<MergedAnnotation<A>> annotations = findDirectAnnotations(p);
112+
List<MergedAnnotation<A>> annotations = findParameterAnnotations(p);
111113
return requireUnique(p, annotations);
112114
});
113115
}
@@ -137,6 +139,50 @@ private MergedAnnotation<A> requireUnique(AnnotatedElement element, List<MergedA
137139
};
138140
}
139141

142+
private List<MergedAnnotation<A>> findParameterAnnotations(Parameter current) {
143+
List<MergedAnnotation<A>> directAnnotations = findDirectAnnotations(current);
144+
if (!directAnnotations.isEmpty()) {
145+
return directAnnotations;
146+
}
147+
directAnnotations = new ArrayList<>(findDirectAnnotations(current));
148+
Executable executable = current.getDeclaringExecutable();
149+
if (executable instanceof Method method) {
150+
Class<?> clazz = method.getDeclaringClass();
151+
Set<Class<?>> visited = new HashSet<>();
152+
while (clazz != null && visited.add(clazz)) {
153+
for (Class<?> ifc : clazz.getInterfaces()) {
154+
directAnnotations.addAll(findParameterAnnotations(method, ifc, current));
155+
}
156+
clazz = clazz.getSuperclass();
157+
if (clazz == Object.class) {
158+
clazz = null;
159+
}
160+
if (clazz != null && visited.add(clazz)) {
161+
directAnnotations.addAll(findParameterAnnotations(method, clazz, current));
162+
}
163+
}
164+
}
165+
return directAnnotations;
166+
}
167+
168+
private List<MergedAnnotation<A>> findParameterAnnotations(Method method, Class<?> superOrIfc, Parameter current) {
169+
try {
170+
Method methodToUse = superOrIfc.getDeclaredMethod(method.getName(), method.getParameterTypes());
171+
for (Parameter parameter : methodToUse.getParameters()) {
172+
if (parameter.getName().equals(current.getName())) {
173+
List<MergedAnnotation<A>> directAnnotations = findDirectAnnotations(parameter);
174+
if (!directAnnotations.isEmpty()) {
175+
return directAnnotations;
176+
}
177+
}
178+
}
179+
}
180+
catch (NoSuchMethodException ex) {
181+
// move on
182+
}
183+
return Collections.emptyList();
184+
}
185+
140186
private List<MergedAnnotation<A>> findMethodAnnotations(Method method, Class<?> targetClass) {
141187
// The method may be on an interface, but we need attributes from the target
142188
// class.

‎core/src/test/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScannerTests.java

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,13 @@
1616

1717
package org.springframework.security.core.annotation;
1818

19+
import java.lang.annotation.ElementType;
20+
import java.lang.annotation.Retention;
21+
import java.lang.annotation.RetentionPolicy;
22+
import java.lang.annotation.Target;
1923
import java.lang.reflect.Method;
24+
import java.lang.reflect.Parameter;
25+
import java.util.List;
2026

2127
import org.junit.jupiter.api.Test;
2228

@@ -34,6 +40,9 @@ public class UniqueSecurityAnnotationScannerTests {
3440
private UniqueSecurityAnnotationScanner<PreAuthorize> scanner = new UniqueSecurityAnnotationScanner<>(
3541
PreAuthorize.class);
3642

43+
private UniqueSecurityAnnotationScanner<CustomParameterAnnotation> parameterScanner = new UniqueSecurityAnnotationScanner<>(
44+
CustomParameterAnnotation.class);
45+
3746
@Test
3847
void scanWhenAnnotationOnInterfaceThenResolves() throws Exception {
3948
Method method = AnnotationOnInterface.class.getDeclaredMethod("method");
@@ -251,6 +260,77 @@ void scanWhenClassInheritingAbstractClassNoAnnotationsThenNoAnnotation() throws
251260
assertThat(preAuthorize).isNull();
252261
}
253262

263+
@Test
264+
void scanParameterAnnotationWhenAnnotationOnInterface() throws Exception {
265+
Parameter parameter = UserService.class.getDeclaredMethod("add", String.class).getParameters()[0];
266+
CustomParameterAnnotation customParameterAnnotation = this.parameterScanner.scan(parameter);
267+
assertThat(customParameterAnnotation.value()).isEqualTo("one");
268+
}
269+
270+
@Test
271+
void scanParameterAnnotationWhenClassInheritingInterfaceAnnotation() throws Exception {
272+
Parameter parameter = UserServiceImpl.class.getDeclaredMethod("add", String.class).getParameters()[0];
273+
CustomParameterAnnotation customParameterAnnotation = this.parameterScanner.scan(parameter);
274+
assertThat(customParameterAnnotation.value()).isEqualTo("one");
275+
}
276+
277+
@Test
278+
void scanParameterAnnotationWhenClassOverridingMethodOverridingInterface() throws Exception {
279+
Parameter parameter = UserServiceImpl.class.getDeclaredMethod("get", String.class).getParameters()[0];
280+
CustomParameterAnnotation customParameterAnnotation = this.parameterScanner.scan(parameter);
281+
assertThat(customParameterAnnotation.value()).isEqualTo("five");
282+
}
283+
284+
@Test
285+
void scanParameterAnnotationWhenMultipleMethodInheritanceThenException() throws Exception {
286+
Parameter parameter = UserServiceImpl.class.getDeclaredMethod("list", String.class).getParameters()[0];
287+
assertThatExceptionOfType(AnnotationConfigurationException.class)
288+
.isThrownBy(() -> this.parameterScanner.scan(parameter));
289+
}
290+
291+
interface UserService {
292+
293+
void add(@CustomParameterAnnotation("one") String user);
294+
295+
List<String> list(@CustomParameterAnnotation("two") String user);
296+
297+
String get(@CustomParameterAnnotation("three") String user);
298+
299+
}
300+
301+
interface OtherUserService {
302+
303+
List<String> list(@CustomParameterAnnotation("four") String user);
304+
305+
}
306+
307+
static class UserServiceImpl implements UserService, OtherUserService {
308+
309+
@Override
310+
public void add(String user) {
311+
312+
}
313+
314+
@Override
315+
public List<String> list(String user) {
316+
return List.of(user);
317+
}
318+
319+
@Override
320+
public String get(@CustomParameterAnnotation("five") String user) {
321+
return user;
322+
}
323+
324+
}
325+
326+
@Target({ ElementType.PARAMETER })
327+
@Retention(RetentionPolicy.RUNTIME)
328+
@interface CustomParameterAnnotation {
329+
330+
String value();
331+
332+
}
333+
254334
@PreAuthorize("one")
255335
private interface AnnotationOnInterface {
256336

‎web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
import java.lang.annotation.Annotation;
2020

2121
import org.springframework.core.MethodParameter;
22+
import org.springframework.core.annotation.MergedAnnotation;
23+
import org.springframework.core.annotation.MergedAnnotations;
24+
import org.springframework.core.annotation.RepeatableContainers;
2225
import org.springframework.expression.BeanResolver;
2326
import org.springframework.expression.Expression;
2427
import org.springframework.expression.ExpressionParser;
@@ -98,8 +101,12 @@ public final class AuthenticationPrincipalArgumentResolver implements HandlerMet
98101

99102
private ExpressionParser parser = new SpelExpressionParser();
100103

104+
private final Class<AuthenticationPrincipal> annotationType = AuthenticationPrincipal.class;
105+
101106
private SecurityAnnotationScanner<AuthenticationPrincipal> scanner = SecurityAnnotationScanners
102-
.requireUnique(AuthenticationPrincipal.class);
107+
.requireUnique(this.annotationType);
108+
109+
private boolean useAnnotationTemplate = false;
103110

104111
private BeanResolver beanResolver;
105112

@@ -164,7 +171,8 @@ public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy secur
164171
* @since 6.4
165172
*/
166173
public void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
167-
this.scanner = SecurityAnnotationScanners.requireUnique(AuthenticationPrincipal.class, templateDefaults);
174+
this.useAnnotationTemplate = templateDefaults != null;
175+
this.scanner = SecurityAnnotationScanners.requireUnique(this.annotationType, templateDefaults);
168176
}
169177

170178
/**
@@ -173,9 +181,16 @@ public void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDef
173181
* @param parameter the {@link MethodParameter} to search for an {@link Annotation}
174182
* @return the {@link Annotation} that was found or null.
175183
*/
176-
@SuppressWarnings("unchecked")
177-
private <T extends Annotation> T findMethodAnnotation(MethodParameter parameter) {
178-
return (T) this.scanner.scan(parameter.getParameter());
184+
private AuthenticationPrincipal findMethodAnnotation(MethodParameter parameter) {
185+
if (this.useAnnotationTemplate) {
186+
return this.scanner.scan(parameter.getParameter());
187+
}
188+
return MergedAnnotations
189+
.from(parameter.getParameter(), MergedAnnotations.SearchStrategy.INHERITED_ANNOTATIONS,
190+
RepeatableContainers.none())
191+
.get(this.annotationType)
192+
.synthesize(MergedAnnotation::isPresent)
193+
.orElse(null);
179194
}
180195

181196
}

‎web/src/test/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolverTests.java

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828

2929
import org.springframework.core.MethodParameter;
3030
import org.springframework.core.annotation.AliasFor;
31+
import org.springframework.core.annotation.AnnotationConfigurationException;
3132
import org.springframework.expression.BeanResolver;
3233
import org.springframework.security.authentication.TestingAuthenticationToken;
3334
import org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults;
@@ -214,6 +215,17 @@ public void resolveArgumentCustomMetaAnnotationTpl() throws Exception {
214215
.isEqualTo(this.expectedPrincipal);
215216
}
216217

218+
@Test
219+
public void resolveArgumentAnnotationFromInterface() {
220+
CustomUserPrincipal principal = new CustomUserPrincipal();
221+
setAuthenticationPrincipal(principal);
222+
this.resolver.setTemplateDefaults(new AnnotationTemplateExpressionDefaults());
223+
assertThat(this.resolver.supportsParameter(getMethodParameter("getUserByInterface", CustomUserPrincipal.class)))
224+
.isTrue();
225+
assertThatExceptionOfType(AnnotationConfigurationException.class).isThrownBy(() -> this.resolver
226+
.resolveArgument(getMethodParameter("username", CustomUserPrincipal.class), null, null, null));
227+
}
228+
217229
private MethodParameter showUserNoAnnotation() {
218230
return getMethodParameter("showUserNoAnnotation", String.class);
219231
}
@@ -312,7 +324,31 @@ private void setAuthenticationPrincipal(Object principal) {
312324

313325
}
314326

315-
public static class TestController {
327+
interface UserApi {
328+
329+
String getUserByInterface(@AuthenticationPrincipal CustomUserPrincipal user);
330+
331+
Object username(@AuthenticationPrincipal CustomUserPrincipal user);
332+
333+
}
334+
335+
interface UserPublicApi {
336+
337+
Object username(@AuthenticationPrincipal CustomUserPrincipal user);
338+
339+
}
340+
341+
public static class TestController implements UserApi, UserPublicApi {
342+
343+
@Override
344+
public String getUserByInterface(CustomUserPrincipal user) {
345+
return "";
346+
}
347+
348+
@Override
349+
public Object username(CustomUserPrincipal user) {
350+
return user.getPrincipal();
351+
}
316352

317353
public void showUserNoAnnotation(String user) {
318354
}

0 commit comments

Comments
 (0)