Class AclEntryAfterInvocationQuietReadProvider

java.lang.Object
org.springframework.security.acls.afterinvocation.AbstractAclProvider
org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider
ubic.gemma.core.security.authorization.acl.AclEntryAfterInvocationQuietReadProvider
All Implemented Interfaces:
org.springframework.beans.factory.Aware, org.springframework.context.MessageSourceAware, org.springframework.security.access.AfterInvocationProvider
public class AclEntryAfterInvocationQuietReadProvider extends org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider
After-invocation provider for the AFTER_ACL_READ_QUIET config attribute: same ACL check as the stock AclEntryAfterInvocationProvider (READ or ADMINISTRATION on the returned single domain object), but denial is converted to a null return value rather than propagated.

Replaces ubic.gemma.core.security.acl.afterinvocation.AclEntryAfterInvocationProvider (the gsec subclass with quiet=true) as part of the Phase 3 AfterInvocation modernization (Phase B). Behaviorally identical to the gsec provider but lives in gemma-core so we can retire the gsec class without touching the 17 @Secured(..., "AFTER_ACL_READ_QUIET") call sites. Required because the modern @PostAuthorize annotation can only allow or throw — it has no "return null on denial" mode — and Gemma's web/REST controllers pervasively rely on the null return to distinguish "not found / not visible" from "found but access denied" (the latter maps to HTTP 403, the former to 404 via EntityNotFoundException).

See Also:

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ATTRIBUTE
    The single config attribute string this provider responds to.
    static final List<org.springframework.security.acls.model.Permission>
    DEFAULT_PERMISSIONS
    Default permission set: READ or ADMINISTRATION (any one suffices).

    Fields inherited from class org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider

    logger, messages

    Fields inherited from class org.springframework.security.acls.afterinvocation.AbstractAclProvider

    aclService, objectIdentityRetrievalStrategy, processConfigAttribute, processDomainObjectClass, requirePermission, sidRetrievalStrategy

  • Constructor Summary

    Constructors
    Constructor
    Description
    AclEntryAfterInvocationQuietReadProvider(org.springframework.security.acls.model.AclService aclService)
     
    AclEntryAfterInvocationQuietReadProvider(org.springframework.security.acls.model.AclService aclService, List<org.springframework.security.acls.model.Permission> requirePermission)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    Object
    decide(org.springframework.security.core.Authentication authentication, Object object, Collection<org.springframework.security.access.ConfigAttribute> config, Object returnedObject)
     

    Methods inherited from class org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider

    setMessageSource

    Methods inherited from class org.springframework.security.acls.afterinvocation.AbstractAclProvider

    getProcessDomainObjectClass, hasPermission, setObjectIdentityRetrievalStrategy, setProcessConfigAttribute, setProcessDomainObjectClass, setSidRetrievalStrategy, supports, supports

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • ATTRIBUTE

      public static final String ATTRIBUTE
      The single config attribute string this provider responds to. Must match the value used in @Secured({..., "AFTER_ACL_READ_QUIET"}) annotations across the codebase.
      See Also:

    • DEFAULT_PERMISSIONS

      public static final List<org.springframework.security.acls.model.Permission> DEFAULT_PERMISSIONS
      Default permission set: READ or ADMINISTRATION (any one suffices). Matches the wiring gsec used for the afterAclReadQuiet bean and the inline SpEL used by Phase A's @PostAuthorize migrations.

  • Constructor Details

    • AclEntryAfterInvocationQuietReadProvider

      public AclEntryAfterInvocationQuietReadProvider(org.springframework.security.acls.model.AclService aclService)

    • AclEntryAfterInvocationQuietReadProvider

      public AclEntryAfterInvocationQuietReadProvider(org.springframework.security.acls.model.AclService aclService, List<org.springframework.security.acls.model.Permission> requirePermission)

  • Method Details

    • decide

      public Object decide(org.springframework.security.core.Authentication authentication, Object object, Collection<org.springframework.security.access.ConfigAttribute> config, Object returnedObject) throws org.springframework.security.access.AccessDeniedException
      Specified by:
      decide in interface org.springframework.security.access.AfterInvocationProvider
      Overrides:
      decide in class org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider
      Throws:
      org.springframework.security.access.AccessDeniedException