SEC-1216: Replacement of custom-after-invocation-provider with after-invocation-provider element. Some changes to help prevent proxying of aop infrastructure classes (use of AopInfrastructureBean marker interface)

core/src/main/java/org/springframework/security/access/SecurityMetadataSource.java

@@ -18,6 +18,7 @@ package org.springframework.security.access;
 import java.util.Collection;
 import java.util.List;
 
+import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
 
 
@@ -28,7 +29,7 @@ import org.springframework.security.access.intercept.AbstractSecurityInterceptor
  * @author Ben Alex
  * @version $Id$
  */
-public interface SecurityMetadataSource {
+public interface SecurityMetadataSource extends AopInfrastructureBean {
     //~ Methods ========================================================================================================
 
     /**

core/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java

@@ -25,11 +25,13 @@ import org.aopalliance.intercept.MethodInvocation;
 
 
 /**
- * Provides security interception of AOP Alliance based method invocations.<p>The
- * <code>SecurityMetadataSource</code> required by this security interceptor is of type {@link
+ * Provides security interception of AOP Alliance based method invocations.
+ * <p>
+ * The <code>SecurityMetadataSource</code> required by this security interceptor is of type {@link
  * MethodSecurityMetadataSource}. This is shared with the AspectJ based security interceptor
- * (<code>AspectJSecurityInterceptor</code>), since both work with Java <code>Method</code>s.</p>
- *  <P>Refer to {@link AbstractSecurityInterceptor} for details on the workflow.</p>
+ * (<code>AspectJSecurityInterceptor</code>), since both work with Java <code>Method</code>s.
+ * <p>
+ * Refer to {@link AbstractSecurityInterceptor} for details on the workflow.
  *
  * @author Ben Alex
  * @version $Id$

core/src/main/java/org/springframework/security/access/prepost/PostInvocationAttribute.java

@@ -11,6 +11,6 @@ import org.springframework.security.access.ConfigAttribute;
  * @version $Id$
  * @since 3.0
  */
-public interface PostInvocationAttribute extends ConfigAttribute{
+public interface PostInvocationAttribute extends ConfigAttribute {
 
 }

core/src/main/java/org/springframework/security/access/prepost/PostInvocationAuthorizationAdvice.java

@@ -1,6 +1,7 @@
 package org.springframework.security.access.prepost;
 
 import org.aopalliance.intercept.MethodInvocation;
+import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.core.Authentication;
 
@@ -11,7 +12,7 @@ import org.springframework.security.core.Authentication;
  * @version $Id$
  * @since 3.0
  */
-public interface PostInvocationAuthorizationAdvice {
+public interface PostInvocationAuthorizationAdvice extends AopInfrastructureBean {
 
     Object after(Authentication authentication, MethodInvocation mi,
             PostInvocationAttribute pia, Object returnedObject) throws AccessDeniedException;

core/src/main/java/org/springframework/security/access/prepost/PreInvocationAuthorizationAdvice.java

@@ -1,6 +1,7 @@
 package org.springframework.security.access.prepost;
 
 import org.aopalliance.intercept.MethodInvocation;
+import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.core.Authentication;
 
 /**
@@ -10,7 +11,7 @@ import org.springframework.security.core.Authentication;
  * @version $Id$
  * @since 3.0
  */
-public interface PreInvocationAuthorizationAdvice {
+public interface PreInvocationAuthorizationAdvice extends AopInfrastructureBean {
 
     /**
      * The "before" advice which should be executed to perform any filtering necessary and to decide whether
@@ -18,7 +19,7 @@ public interface PreInvocationAuthorizationAdvice {
      *
      * @param authentication the information on the principal on whose account the decision should be made
      * @param mi the method invocation being attempted
-     * @param preInvocationAttribute the attribute built from the @PreFilte and @PostFilter annotations.
+     * @param preInvocationAttribute the attribute built from the @PreFilter and @PostFilter annotations.
      * @return true if authorised, false otherwise
      */
     boolean before(Authentication authentication, MethodInvocation mi, PreInvocationAttribute preInvocationAttribute);

core/src/main/java/org/springframework/security/access/prepost/PrePostInvocationAttributeFactory.java

@@ -1,12 +1,14 @@
 package org.springframework.security.access.prepost;
 
+import org.springframework.aop.framework.AopInfrastructureBean;
+
 /**
  *
  * @author Luke Taylor
  * @version $Id$
  * @since 3.0
  */
-public interface PrePostInvocationAttributeFactory {
+public interface PrePostInvocationAttributeFactory extends AopInfrastructureBean {
 
     PreInvocationAttribute createPreInvocationAttribute(PreFilter preFilter, PreAuthorize preAuthorize);
 

core/src/test/java/org/springframework/security/authentication/concurrent/SessionInformationTests.java

@@ -41,7 +41,7 @@ public class SessionInformationTests extends TestCase {
         assertEquals(sessionId, info.getSessionId());
         assertEquals(currentDate, info.getLastRequest());
 
-        Thread.sleep(1000);
+        Thread.sleep(10);
 
         info.refreshLastRequest();