Class AclEntryAfterInvocationValueObjectCollectionReadProvider

java.lang.Object
org.springframework.security.acls.afterinvocation.AbstractAclProvider
org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationCollectionFilteringProvider
ubic.gemma.core.security.acl.afterinvocation.AclEntryAfterInvocationCollectionFilteringProvider
ubic.gemma.core.security.authorization.acl.AclEntryAfterInvocationValueObjectCollectionReadProvider
All Implemented Interfaces:
org.springframework.security.access.AfterInvocationProvider
Direct Known Subclasses:
AclEntryAfterInvocationValueObjectMapReadProvider
public class AclEntryAfterInvocationValueObjectCollectionReadProvider extends AclEntryAfterInvocationCollectionFilteringProvider
Gemma-owned after-invocation provider for the AFTER_ACL_VALUE_OBJECT_COLLECTION_READ config attribute: bulk ACL check + per-row SecureValueObject security-metadata population over a returned collection.

Replaces gsec's AclEntryAfterInvocationValueObjectCollectionFilteringProvider as part of the Phase 3 AfterInvocation modernization (Phase B). Behaviorally identical to the gsec class — same bulk-fetch ACL pass (one readAclsById call for the whole collection, not N reads), same per-row filtering, same side-effect that populates isPublic / isShared / userOwned / userCanWrite on every retained VO. Lives in gemma-core so gsec's class can be retired from the after-invocation provider chain without touching the 20 @Secured({..., "AFTER_ACL_VALUE_OBJECT_COLLECTION_READ"}) call sites (ExpressionExperimentService bulk loaders, GeneSetService, etc.).

Cannot be expressed as plain @PostFilter: the security metadata side-effect on every retained VO is load-bearing — the catalog / dataset / gene-set listing UIs render lock / share / edit icons per row based on those flags. @PostFilter can only retain or drop; it has no hook to mutate retained elements. A @PostFilter variant that called a helper inside the SpEL would re-fetch ACLs per row and lose the bulk optimization.

Extends gsec's AclEntryAfterInvocationCollectionFilteringProvider (the bulk-optimized parent — same base used by the existing Gemma-owned association providers for composite sequences and data vectors). That class manages the ThreadLocal-stashed per-row permission results so the inherited decide() loop in Spring's stock AclEntryAfterInvocationCollectionFilteringProvider can call back into the single-object hasPermission cheaply.

See Also:

  • Field Details

    • ATTRIBUTE

      public static final String ATTRIBUTE
      The single config attribute string this provider responds to. Must match the value used in @Secured({..., "AFTER_ACL_VALUE_OBJECT_COLLECTION_READ"}) annotations.
      See Also:

  • Constructor Details

    • AclEntryAfterInvocationValueObjectCollectionReadProvider

      public AclEntryAfterInvocationValueObjectCollectionReadProvider(org.springframework.security.acls.model.AclService aclService, List<org.springframework.security.acls.model.Permission> requirePermission)

    • AclEntryAfterInvocationValueObjectCollectionReadProvider

      protected AclEntryAfterInvocationValueObjectCollectionReadProvider(org.springframework.security.acls.model.AclService aclService, String processConfigAttribute, List<org.springframework.security.acls.model.Permission> requirePermission)
      Subclass constructor used by Map-shaped variants that delegate to this collection provider with a different config attribute (e.g. the keys-only Map provider). Mirrors the protected constructor on gsec's collection provider so subclasses can pass their own processConfigAttribute while inheriting all the bulk-fetch + VO-populate logic.

  • Method Details