From 29f8dd53cd6e384245436caf36bf9024e8913b26 Mon Sep 17 00:00:00 2001 From: Manuel Siggen Date: Thu, 16 Apr 2026 08:03:31 +0200 Subject: [PATCH] Pick Up PermissionEvaluator Bean Closes gh-19084 Signed-off-by: Manuel Siggen --- .../PrePostMethodSecurityConfiguration.java | 6 ++++++ .../PrePostMethodSecurityConfigurationTests.java | 9 ++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java index 990c3ffa6e..5af3a8948c 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java @@ -32,6 +32,7 @@ import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.ImportAware; import org.springframework.context.annotation.Role; import org.springframework.core.type.AnnotationMetadata; +import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler; import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler; import org.springframework.security.access.hierarchicalroles.RoleHierarchy; @@ -127,6 +128,11 @@ final class PrePostMethodSecurityConfiguration implements ImportAware, Applicati this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory); } + @Autowired(required = false) + void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) { + this.expressionHandler.setPermissionEvaluator(permissionEvaluator); + } + @Autowired(required = false) void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) { this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults); diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java index d48047980e..9c4ca90b1b 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java @@ -1527,13 +1527,13 @@ public class PrePostMethodSecurityConfigurationTests { } + @Configuration @EnableMethodSecurity static class CustomPermissionEvaluatorConfig { @Bean - MethodSecurityExpressionHandler methodSecurityExpressionHandler() { - DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler(); - expressionHandler.setPermissionEvaluator(new PermissionEvaluator() { + PermissionEvaluator permissionEvaluator() { + return new PermissionEvaluator() { @Override public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) { @@ -1545,8 +1545,7 @@ public class PrePostMethodSecurityConfigurationTests { Object permission) { throw new UnsupportedOperationException(); } - }); - return expressionHandler; + }; } }