Class AclEntryAfterInvocationValueObjectMapReadProvider

java.lang.Object

org.springframework.security.acls.afterinvocation.AbstractAclProvider

org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationCollectionFilteringProvider

ubic.gemma.core.security.acl.afterinvocation.AclEntryAfterInvocationCollectionFilteringProvider

ubic.gemma.core.security.authorization.acl.AclEntryAfterInvocationValueObjectCollectionReadProvider

ubic.gemma.core.security.authorization.acl.AclEntryAfterInvocationValueObjectMapReadProvider

All Implemented Interfaces:

org.springframework.security.access.AfterInvocationProvider

public class AclEntryAfterInvocationValueObjectMapReadProvider
extends AclEntryAfterInvocationValueObjectCollectionReadProvider

Gemma-owned after-invocation provider for the AFTER_ACL_VALUE_OBJECT_MAP_READ config attribute: bulk ACL check + per-key SecureValueObject security-metadata population over a returned Map whose keys are SecureValueObjects. Map values are NOT checked (matches the gsec semantics) — entries are filtered by whether the user has READ on the key.

Replaces gsec's AclEntryAfterInvocationValueObjectMapFilteringProvider as part of the Phase 3 AfterInvocation modernization (Phase B). Behaviorally identical to the gsec class — same Map unwrap + delegate-to-collection-provider over map.keySet(), same per-key ACL filter, same side-effect that populates isPublic / isShared / userOwned / userCanWrite on every retained key VO. Lives in gemma-core so gsec's class can be retired from the after-invocation provider chain without touching the 6 @Secured({..., "AFTER_ACL_VALUE_OBJECT_MAP_READ"}) call sites (DifferentialExpressionResultService x5, DifferentialExpressionAnalysisService x1).

Cannot be expressed as plain @PostFilter: the per-key security metadata side-effect is load-bearing (DEA results UI renders dataset-level lock / share / mine flags from the key VO), and @PostFilter can only retain or drop entries, not mutate retained keys.

Extends AclEntryAfterInvocationValueObjectCollectionReadProvider via its protected constructor — same bulk readAclsById call, same populate logic — only the decide() entry point differs (unwrap the Map and delegate over keySet, return the original Map so the caller still gets a Map back, not a Collection of keys).

See Also:

• the bulk-collection parent providing the actual ACL + populate logic
• wiring registration

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ATTRIBUTE	The single config attribute string this provider responds to.

Fields inherited from class org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationCollectionFilteringProvider

logger

Fields inherited from class org.springframework.security.acls.afterinvocation.AbstractAclProvider

aclService, objectIdentityRetrievalStrategy, processConfigAttribute, processDomainObjectClass, requirePermission, sidRetrievalStrategy

Constructor Summary

Constructors

Constructor	Description
AclEntryAfterInvocationValueObjectMapReadProvider(org.springframework.security.acls.model.AclService aclService, List<org.springframework.security.acls.model.Permission> requirePermission)

Method Summary

Modifier and Type	Method	Description
Object	decide(org.springframework.security.core.Authentication authentication, Object object, Collection<org.springframework.security.access.ConfigAttribute> config, Object returnedObject)

Methods inherited from class AclEntryAfterInvocationValueObjectCollectionReadProvider

hasPermission

Methods inherited from class AclEntryAfterInvocationCollectionFilteringProvider

getObjectIdentities, hasPermission, hasPermission

Methods inherited from class org.springframework.security.acls.afterinvocation.AbstractAclProvider

getProcessDomainObjectClass, setObjectIdentityRetrievalStrategy, setProcessConfigAttribute, setProcessDomainObjectClass, setSidRetrievalStrategy, supports, supports

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ATTRIBUTE

public static final String ATTRIBUTE

The single config attribute string this provider responds to. Must match the value used in @Secured({..., "AFTER_ACL_VALUE_OBJECT_MAP_READ"}) annotations.

See Also:

• Constant Field Values

Constructor Details

AclEntryAfterInvocationValueObjectMapReadProvider

public AclEntryAfterInvocationValueObjectMapReadProvider(org.springframework.security.acls.model.AclService aclService,
 List<org.springframework.security.acls.model.Permission> requirePermission)

Method Details

decide

public Object decide(org.springframework.security.core.Authentication authentication,
 Object object,
 Collection<org.springframework.security.access.ConfigAttribute> config,
 Object returnedObject)
              throws org.springframework.security.access.AccessDeniedException

Specified by:

decide in interface org.springframework.security.access.AfterInvocationProvider

Overrides:

decide in class AclEntryAfterInvocationCollectionFilteringProvider

Throws:

org.springframework.security.access.AccessDeniedException