Class AclEntryAfterInvocationValueObjectReadProvider

java.lang.Object
org.springframework.security.acls.afterinvocation.AbstractAclProvider
org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider
ubic.gemma.core.security.authorization.acl.AclEntryAfterInvocationValueObjectReadProvider
All Implemented Interfaces:
org.springframework.beans.factory.Aware, org.springframework.context.MessageSourceAware, org.springframework.security.access.AfterInvocationProvider
public class AclEntryAfterInvocationValueObjectReadProvider extends org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider
Gemma-owned after-invocation provider for the AFTER_ACL_VALUE_OBJECT_READ config attribute: single-object ACL check on a SecureValueObject return value.

Replaces gsec's AclEntryAfterInvocationValueObjectProvider as part of the Phase 3 AfterInvocation modernization (Phase B). Behaviorally identical to the gsec class — same READ-permission check via AbstractAclProvider.hasPermission(Authentication, Object), same post-check side-effect that populates the four security-metadata fields on the returned SecureValueObject (isPublic, isShared, userOwned, userCanWrite) — but lives in gemma-core so the gsec class can be retired from the after-invocation provider chain without touching the 4 @Secured({..., "AFTER_ACL_VALUE_OBJECT_READ"}) call sites.

Cannot be expressed as plain @PostAuthorize: the security metadata side-effect on the returned VO is load-bearing — the web/REST layer renders the "private / shared / mine / editable" UI affordances based on those flags. @PostAuthorize can only allow or throw; it has no hook to mutate the result. An @PostAuthorize variant that called a helper to populate the flags would duplicate the ACL fetch (once for the SpEL check, again for the populate call). The after-invocation provider does both with one ACL read.

See Also:

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ATTRIBUTE
    The single config attribute string this provider responds to.

    Fields inherited from class org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider

    logger, messages

    Fields inherited from class org.springframework.security.acls.afterinvocation.AbstractAclProvider

    aclService, objectIdentityRetrievalStrategy, processConfigAttribute, processDomainObjectClass, requirePermission, sidRetrievalStrategy

  • Constructor Summary

    Constructors
    Constructor
    Description
    AclEntryAfterInvocationValueObjectReadProvider(org.springframework.security.acls.model.AclService aclService, List<org.springframework.security.acls.model.Permission> requirePermission)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected boolean
    hasPermission(org.springframework.security.core.Authentication authentication, Object domainObject)
     

    Methods inherited from class org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider

    decide, setMessageSource

    Methods inherited from class org.springframework.security.acls.afterinvocation.AbstractAclProvider

    getProcessDomainObjectClass, setObjectIdentityRetrievalStrategy, setProcessConfigAttribute, setProcessDomainObjectClass, setSidRetrievalStrategy, supports, supports

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • ATTRIBUTE

      public static final String ATTRIBUTE
      The single config attribute string this provider responds to. Must match the value used in @Secured({..., "AFTER_ACL_VALUE_OBJECT_READ"}) annotations across the codebase.
      See Also:

  • Constructor Details

    • AclEntryAfterInvocationValueObjectReadProvider

      public AclEntryAfterInvocationValueObjectReadProvider(org.springframework.security.acls.model.AclService aclService, List<org.springframework.security.acls.model.Permission> requirePermission)

  • Method Details

    • hasPermission

      protected boolean hasPermission(org.springframework.security.core.Authentication authentication, Object domainObject)
      Overrides:
      hasPermission in class org.springframework.security.acls.afterinvocation.AbstractAclProvider