Skip to content

Commit 3a20373

Browse files
kse-musickse-music
committed
Support @AuthenticationPrincipal on interfaces
Closes gh-16177
1 parent dc82a6e commit 3a20373

File tree

4 files changed

+178
-8
lines changed

4 files changed

+178
-8
lines changed

‎core/src/main/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScanner.java‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import java.lang.annotation.Annotation;
2020
import java.lang.reflect.AnnotatedElement;
21+
import java.lang.reflect.Executable;
2122
import java.lang.reflect.Method;
2223
import java.lang.reflect.Parameter;
2324
import java.util.ArrayList;
@@ -83,6 +84,7 @@
8384
*
8485
* @param <A> the annotation to search for and synthesize
8586
* @author Josh Cummings
87+
* @author DingHao
8688
* @since 6.4
8789
*/
8890
final class UniqueSecurityAnnotationScanner<A extends Annotation> extends AbstractSecurityAnnotationScanner<A> {
@@ -107,7 +109,7 @@ final class UniqueSecurityAnnotationScanner<A extends Annotation> extends Abstra
107109
MergedAnnotation<A> merge(AnnotatedElement element, Class<?> targetClass) {
108110
if (element instanceof Parameter parameter) {
109111
return this.uniqueParameterAnnotationCache.computeIfAbsent(parameter, (p) -> {
110-
List<MergedAnnotation<A>> annotations = findDirectAnnotations(p);
112+
List<MergedAnnotation<A>> annotations = findParameterAnnotations(p);
111113
return requireUnique(p, annotations);
112114
});
113115
}
@@ -137,6 +139,50 @@ private MergedAnnotation<A> requireUnique(AnnotatedElement element, List<MergedA
137139
};
138140
}
139141

142+
private List<MergedAnnotation<A>> findParameterAnnotations(Parameter current) {
143+
List<MergedAnnotation<A>> directAnnotations = findDirectAnnotations(current);
144+
if (!directAnnotations.isEmpty()) {
145+
return directAnnotations;
146+
}
147+
directAnnotations = new ArrayList<>(findDirectAnnotations(current));
148+
Executable executable = current.getDeclaringExecutable();
149+
if (executable instanceof Method method) {
150+
Class<?> clazz = method.getDeclaringClass();
151+
Set<Class<?>> visited = new HashSet<>();
152+
while (clazz != null && visited.add(clazz)) {
153+
for (Class<?> ifc : clazz.getInterfaces()) {
154+
directAnnotations.addAll(findParameterAnnotations(method, ifc, current));
155+
}
156+
clazz = clazz.getSuperclass();
157+
if (clazz == Object.class) {
158+
clazz = null;
159+
}
160+
if (clazz != null && visited.add(clazz)) {
161+
directAnnotations.addAll(findParameterAnnotations(method, clazz, current));
162+
}
163+
}
164+
}
165+
return directAnnotations;
166+
}
167+
168+
private List<MergedAnnotation<A>> findParameterAnnotations(Method method, Class<?> superOrIfc, Parameter current) {
169+
try {
170+
Method methodToUse = superOrIfc.getDeclaredMethod(method.getName(), method.getParameterTypes());
171+
for (Parameter parameter : methodToUse.getParameters()) {
172+
if (parameter.getName().equals(current.getName())) {
173+
List<MergedAnnotation<A>> directAnnotations = findDirectAnnotations(parameter);
174+
if (!directAnnotations.isEmpty()) {
175+
return directAnnotations;
176+
}
177+
}
178+
}
179+
}
180+
catch (NoSuchMethodException ex) {
181+
// move on
182+
}
183+
return Collections.emptyList();
184+
}
185+
140186
private List<MergedAnnotation<A>> findMethodAnnotations(Method method, Class<?> targetClass) {
141187
// The method may be on an interface, but we need attributes from the target
142188
// class.

‎core/src/test/java/org/springframework/security/core/annotation/UniqueSecurityAnnotationScannerTests.java‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,13 @@
1616

1717
package org.springframework.security.core.annotation;
1818

19+
import java.lang.annotation.ElementType;
20+
import java.lang.annotation.Retention;
21+
import java.lang.annotation.RetentionPolicy;
22+
import java.lang.annotation.Target;
1923
import java.lang.reflect.Method;
24+
import java.lang.reflect.Parameter;
25+
import java.util.List;
2026

2127
import org.junit.jupiter.api.Test;
2228

@@ -34,6 +40,9 @@ public class UniqueSecurityAnnotationScannerTests {
3440
private UniqueSecurityAnnotationScanner<PreAuthorize> scanner = new UniqueSecurityAnnotationScanner<>(
3541
PreAuthorize.class);
3642

43+
private UniqueSecurityAnnotationScanner<CustomParameterAnnotation> parameterScanner = new UniqueSecurityAnnotationScanner<>(
44+
CustomParameterAnnotation.class);
45+
3746
@Test
3847
void scanWhenAnnotationOnInterfaceThenResolves() throws Exception {
3948
Method method = AnnotationOnInterface.class.getDeclaredMethod("method");
@@ -251,6 +260,77 @@ void scanWhenClassInheritingAbstractClassNoAnnotationsThenNoAnnotation() throws
251260
assertThat(preAuthorize).isNull();
252261
}
253262

263+
@Test
264+
void scanParameterAnnotationWhenAnnotationOnInterface() throws Exception {
265+
Parameter parameter = UserService.class.getDeclaredMethod("add", String.class).getParameters()[0];
266+
CustomParameterAnnotation customParameterAnnotation = this.parameterScanner.scan(parameter);
267+
assertThat(customParameterAnnotation.value()).isEqualTo("one");
268+
}
269+
270+
@Test
271+
void scanParameterAnnotationWhenClassInheritingInterfaceAnnotation() throws Exception {
272+
Parameter parameter = UserServiceImpl.class.getDeclaredMethod("add", String.class).getParameters()[0];
273+
CustomParameterAnnotation customParameterAnnotation = this.parameterScanner.scan(parameter);
274+
assertThat(customParameterAnnotation.value()).isEqualTo("one");
275+
}
276+
277+
@Test
278+
void scanParameterAnnotationWhenClassOverridingMethodOverridingInterface() throws Exception {
279+
Parameter parameter = UserServiceImpl.class.getDeclaredMethod("get", String.class).getParameters()[0];
280+
CustomParameterAnnotation customParameterAnnotation = this.parameterScanner.scan(parameter);
281+
assertThat(customParameterAnnotation.value()).isEqualTo("five");
282+
}
283+
284+
@Test
285+
void scanParameterAnnotationWhenMultipleMethodInheritanceThenException() throws Exception {
286+
Parameter parameter = UserServiceImpl.class.getDeclaredMethod("list", String.class).getParameters()[0];
287+
assertThatExceptionOfType(AnnotationConfigurationException.class)
288+
.isThrownBy(() -> this.parameterScanner.scan(parameter));
289+
}
290+
291+
interface UserService {
292+
293+
void add(@CustomParameterAnnotation("one") String user);
294+
295+
List<String> list(@CustomParameterAnnotation("two") String user);
296+
297+
String get(@CustomParameterAnnotation("three") String user);
298+
299+
}
300+
301+
interface OtherUserService {
302+
303+
List<String> list(@CustomParameterAnnotation("four") String user);
304+
305+
}
306+
307+
static class UserServiceImpl implements UserService, OtherUserService {
308+
309+
@Override
310+
public void add(String user) {
311+
312+
}
313+
314+
@Override
315+
public List<String> list(String user) {
316+
return List.of(user);
317+
}
318+
319+
@Override
320+
public String get(@CustomParameterAnnotation("five") String user) {
321+
return user;
322+
}
323+
324+
}
325+
326+
@Target({ ElementType.PARAMETER })
327+
@Retention(RetentionPolicy.RUNTIME)
328+
@interface CustomParameterAnnotation {
329+
330+
String value();
331+
332+
}
333+
254334
@PreAuthorize("one")
255335
private interface AnnotationOnInterface {
256336

‎web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
import java.lang.annotation.Annotation;
2020

2121
import org.springframework.core.MethodParameter;
22+
import org.springframework.core.annotation.AnnotationUtils;
23+
import org.springframework.core.annotation.MergedAnnotations;
2224
import org.springframework.expression.BeanResolver;
2325
import org.springframework.expression.Expression;
2426
import org.springframework.expression.ExpressionParser;
@@ -98,8 +100,12 @@ public final class AuthenticationPrincipalArgumentResolver implements HandlerMet
98100

99101
private ExpressionParser parser = new SpelExpressionParser();
100102

103+
private final Class<AuthenticationPrincipal> annotationType = AuthenticationPrincipal.class;
104+
101105
private SecurityAnnotationScanner<AuthenticationPrincipal> scanner = SecurityAnnotationScanners
102-
.requireUnique(AuthenticationPrincipal.class);
106+
.requireUnique(this.annotationType);
107+
108+
private boolean useAnnotationTemplate = false;
103109

104110
private BeanResolver beanResolver;
105111

@@ -164,7 +170,8 @@ public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy secur
164170
* @since 6.4
165171
*/
166172
public void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
167-
this.scanner = SecurityAnnotationScanners.requireUnique(AuthenticationPrincipal.class, templateDefaults);
173+
this.useAnnotationTemplate = templateDefaults != null;
174+
this.scanner = SecurityAnnotationScanners.requireUnique(this.annotationType, templateDefaults);
168175
}
169176

170177
/**
@@ -173,9 +180,22 @@ public void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDef
173180
* @param parameter the {@link MethodParameter} to search for an {@link Annotation}
174181
* @return the {@link Annotation} that was found or null.
175182
*/
176-
@SuppressWarnings("unchecked")
177-
private <T extends Annotation> T findMethodAnnotation(MethodParameter parameter) {
178-
return (T) this.scanner.scan(parameter.getParameter());
183+
private AuthenticationPrincipal findMethodAnnotation(MethodParameter parameter) {
184+
if (this.useAnnotationTemplate) {
185+
return this.scanner.scan(parameter.getParameter());
186+
}
187+
AuthenticationPrincipal annotation = parameter.getParameterAnnotation(this.annotationType);
188+
if (annotation != null) {
189+
return annotation;
190+
}
191+
Annotation[] annotationsToSearch = parameter.getParameterAnnotations();
192+
for (Annotation toSearch : annotationsToSearch) {
193+
annotation = AnnotationUtils.findAnnotation(toSearch.annotationType(), this.annotationType);
194+
if (annotation != null) {
195+
return MergedAnnotations.from(toSearch).get(this.annotationType).synthesize();
196+
}
197+
}
198+
return null;
179199
}
180200

181201
}

‎web/src/test/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolverTests.java‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828

2929
import org.springframework.core.MethodParameter;
3030
import org.springframework.core.annotation.AliasFor;
31+
import org.springframework.core.annotation.AnnotatedMethod;
3132
import org.springframework.expression.BeanResolver;
3233
import org.springframework.security.authentication.TestingAuthenticationToken;
3334
import org.springframework.security.core.annotation.AnnotationTemplateExpressionDefaults;
@@ -214,6 +215,18 @@ public void resolveArgumentCustomMetaAnnotationTpl() throws Exception {
214215
.isEqualTo(this.expectedPrincipal);
215216
}
216217

218+
@Test
219+
public void resolveArgumentAnnotationFromInterface() {
220+
CustomUserPrincipal principal = new CustomUserPrincipal();
221+
setAuthenticationPrincipal(principal);
222+
assertThat(this.resolver.resolveArgument(getUserByInterface(), null, null, null))
223+
.isEqualTo(this.expectedPrincipal);
224+
}
225+
226+
private MethodParameter getUserByInterface() {
227+
return getMethodParameter("getUserByInterface", CustomUserPrincipal.class);
228+
}
229+
217230
private MethodParameter showUserNoAnnotation() {
218231
return getMethodParameter("showUserNoAnnotation", String.class);
219232
}
@@ -272,7 +285,7 @@ private MethodParameter showUserCustomMetaAnnotationTpl() {
272285

273286
private MethodParameter getMethodParameter(String methodName, Class<?>... paramTypes) {
274287
Method method = ReflectionUtils.findMethod(TestController.class, methodName, paramTypes);
275-
return new MethodParameter(method, 0);
288+
return new AnnotatedMethod(method).getMethodParameters()[0];
276289
}
277290

278291
private void setAuthenticationPrincipal(Object principal) {
@@ -312,7 +325,18 @@ private void setAuthenticationPrincipal(Object principal) {
312325

313326
}
314327

315-
public static class TestController {
328+
interface UserApi {
329+
330+
String getUserByInterface(@AuthenticationPrincipal CustomUserPrincipal user);
331+
332+
}
333+
334+
public static class TestController implements UserApi {
335+
336+
@Override
337+
public String getUserByInterface(CustomUserPrincipal user) {
338+
return "";
339+
}
316340

317341
public void showUserNoAnnotation(String user) {
318342
}

0 commit comments

Comments
 (0)