Consider supporting Spring Data container types for AuthorizeReturnObject #16953
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
evgeniycheban
force-pushed
the
gh-15994
branch
6 times, most recently
from
aa991e6 to
fe6e014
Compare
jzheaux
added
in: data
…ject Closes spring-projectsgh-15994 Signed-off-by: Evgeniy Cheban <[email protected]>
There was a problem hiding this comment.
Thanks, @evgeniycheban, this looks great. I left a comment that I could use your clarification on.
| @@ -34,4 +44,39 @@ static SecurityHintsRegistrar authorizeReturnObjectDataHintsRegistrar(Authorizat | |||
| return new AuthorizeReturnObjectDataHintsRegistrar(proxyFactory); | |||
| } | |||
|
|
|||
| @Bean | |||
| @Role(BeanDefinition.ROLE_INFRASTRUCTURE) | |||
| @Order(Ordered.HIGHEST_PRECEDENCE + 100) | |||
There was a problem hiding this comment.
I'm not clear on why this is needed. Can you elaborate? If anything, I would have expected it to have LOWEST_PRECEDENCE to make it easier to have custom TargetVisitor implementations take priority.
There was a problem hiding this comment.
The initial reason for this was that the DataTargetVisitor should be executed before ContainerTypeVisitor because the ContainerTypeVisitor checks for Iterable which Spring Data container types are assignable for, also we have a test defining TargetVisitor.defaultsSkipValueTypes() with @Order(0), but generally I agree with your point that this could be set to LOWEST_PRECEDENCE.
jzheaux
added
the
status: waiting-for-feedback
Closes gh-15994