Class AclVoterAuthorizationManagerConfig

java.lang.Object
ubic.gemma.core.security.authorization.acl.AclVoterAuthorizationManagerConfig
@Configuration public class AclVoterAuthorizationManagerConfig extends Object
Wires AclVoterAuthorizationManager beans, one per active ACL_SECURABLE_* config attribute, on top of the existing gsec voter beans. Phase X.1 of the ACL voter migration (see ACL_ENTRY_VOTER_MIGRATION.md on worktree-aclentryvoter-recce).

The recce identified 4 active voter beans and 4 active config attributes plus 2 _IGNORE_TRANSIENT variants (281 call sites total). The 4 map/map-value voter beans are dead (zero call sites) and are not wrapped here — they will be removed wholesale in Phase X.4.

Active wrappers:

  • aclSecurableReadAuthorizationManager — wraps securableReadVoter (AclEntryVoter) for ACL_SECURABLE_READ (176 call sites).
  • aclSecurableEditAuthorizationManager — wraps securableEditVoter for ACL_SECURABLE_EDIT (87 call sites).
  • aclSecurableEditIgnoreTransientAuthorizationManager — same voter bean, bound to the _IGNORE_TRANSIENT suffix variant (1 call site in SecurableBaseService).
  • aclSecurableCollectionReadAuthorizationManager — wraps securableCollectionReadVoter (AclEntryCollectionVoter) for ACL_SECURABLE_COLLECTION_READ (12 call sites).
  • aclSecurableCollectionEditAuthorizationManager — wraps securableCollectionEditVoter for ACL_SECURABLE_COLLECTION_EDIT (2 call sites).
  • aclSecurableCollectionEditIgnoreTransientAuthorizationManager — same voter bean, _IGNORE_TRANSIENT variant (1 call site in SecurableBaseService).

Parallel-run posture. These beans exist but are not yet wired into the method-security interceptor chain. MethodSecurityConfig still runs @EnableGlobalMethodSecurity on top of the legacy accessDecisionManager bean. Phase X.2 will: (1) flip MethodSecurityConfig to @EnableMethodSecurity, (2) construct one AuthorizationManagerBeforeMethodInterceptor per bean here with a pointcut matching @Secured annotations carrying the matching attribute string, (3) drop the accessDecisionManager() / runAsManager() overrides. Until then the wrappers are tested in isolation (see AclVoterAuthorizationManagerTest) but inactive in the running call chain.

Author:
claude

  • Constructor Details

    • AclVoterAuthorizationManagerConfig

      public AclVoterAuthorizationManagerConfig()

  • Method Details

    • aclSecurableReadAuthorizationManager

      @Bean public AclVoterAuthorizationManager aclSecurableReadAuthorizationManager(@Qualifier("securableReadVoter") org.springframework.security.access.AccessDecisionVoter<org.aopalliance.intercept.MethodInvocation> voter)

    • aclSecurableEditAuthorizationManager

      @Bean public AclVoterAuthorizationManager aclSecurableEditAuthorizationManager(@Qualifier("securableEditVoter") org.springframework.security.access.AccessDecisionVoter<org.aopalliance.intercept.MethodInvocation> voter)

    • aclSecurableEditIgnoreTransientAuthorizationManager

      @Bean public AclVoterAuthorizationManager aclSecurableEditIgnoreTransientAuthorizationManager(@Qualifier("securableEditVoter") org.springframework.security.access.AccessDecisionVoter<org.aopalliance.intercept.MethodInvocation> voter)

    • aclSecurableCollectionReadAuthorizationManager

      @Bean public AclVoterAuthorizationManager aclSecurableCollectionReadAuthorizationManager(@Qualifier("securableCollectionReadVoter") org.springframework.security.access.AccessDecisionVoter<org.aopalliance.intercept.MethodInvocation> voter)

    • aclSecurableCollectionEditAuthorizationManager

      @Bean public AclVoterAuthorizationManager aclSecurableCollectionEditAuthorizationManager(@Qualifier("securableCollectionEditVoter") org.springframework.security.access.AccessDecisionVoter<org.aopalliance.intercept.MethodInvocation> voter)

    • aclSecurableCollectionEditIgnoreTransientAuthorizationManager

      @Bean public AclVoterAuthorizationManager aclSecurableCollectionEditIgnoreTransientAuthorizationManager(@Qualifier("securableCollectionEditVoter") org.springframework.security.access.AccessDecisionVoter<org.aopalliance.intercept.MethodInvocation> voter)