Move Messaging Access API

Issue gh-17847
2026-09-12 20:25:06 +00:00 · 2025-09-02 15:50:57 -06:00
parent eedcec9d5c
commit 3182883e2e
14 changed files with 3 additions and 2 deletions
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.expression;
+
+import org.springframework.expression.EvaluationContext;
+
+/**
+ * Allows post processing the {@link EvaluationContext}
+ *
+ * <p>
+ * This API is intentionally kept package scope as it may evolve over time.
+ * </p>
+ *
+ * @author Daniel Bustamante Ospina
+ * @since 5.2
+ * @deprecated Since {@link MessageExpressionVoter} is deprecated, there is no more need
+ * for this class
+ */
+@Deprecated
+interface EvaluationContextPostProcessor<I> {
+
+	/**
+	 * Allows post processing of the {@link EvaluationContext}. Implementations may return
+	 * a new instance of {@link EvaluationContext} or modify the {@link EvaluationContext}
+	 * that was passed in.
+	 * @param context the original {@link EvaluationContext}
+	 * @param invocation the security invocation object (i.e. Message)
+	 * @return the upated context.
+	 */
+	EvaluationContext postProcess(EvaluationContext context, I invocation);
+
+}
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.expression;
+
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.expression.Expression;
+import org.springframework.messaging.Message;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.access.expression.SecurityExpressionHandler;
+import org.springframework.security.messaging.access.intercept.DefaultMessageSecurityMetadataSource;
+import org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource;
+import org.springframework.security.messaging.util.matcher.MessageMatcher;
+
+/**
+ * A class used to create a {@link MessageSecurityMetadataSource} that uses
+ * {@link MessageMatcher} mapped to Spring Expressions.
+ *
+ * @author Rob Winch
+ * @since 4.0
+ * @deprecated Use
+ * {@link org.springframework.security.messaging.access.intercept.MessageMatcherDelegatingAuthorizationManager}
+ * instead
+ */
+@Deprecated
+public final class ExpressionBasedMessageSecurityMetadataSourceFactory {
+
+	private ExpressionBasedMessageSecurityMetadataSourceFactory() {
+	}
+
+	/**
+	 * Create a {@link MessageSecurityMetadataSource} that uses {@link MessageMatcher}
+	 * mapped to Spring Expressions. Each entry is considered in order and only the first
+	 * match is used.
+	 *
+	 * For example:
+	 *
+	 * <pre>
+	 *     LinkedHashMap&lt;MessageMatcher&lt;?&gt;,String&gt; matcherToExpression = new LinkedHashMap&lt;MessageMatcher&lt;Object&gt;,String&gt;();
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/public/**"), "permitAll");
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/admin/**"), "hasRole('ROLE_ADMIN')");
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/topics/{name}/**"), "@someBean.customLogic(authentication, #name)");
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/**"), "authenticated");
+	 *
+	 *     MessageSecurityMetadataSource metadataSource = createExpressionMessageMetadataSource(matcherToExpression);
+	 * </pre>
+	 *
+	 * <p>
+	 * If our destination is "/public/hello", it would match on "/public/**" and on "/**".
+	 * However, only "/public/**" would be used since it is the first entry. That means
+	 * that a destination of "/public/hello" will be mapped to "permitAll".
+	 *
+	 * <p>
+	 * For a complete listing of expressions see {@link MessageSecurityExpressionRoot}
+	 * @param matcherToExpression an ordered mapping of {@link MessageMatcher} to Strings
+	 * that are turned into an Expression using
+	 * {@link DefaultMessageSecurityExpressionHandler#getExpressionParser()}
+	 * @return the {@link MessageSecurityMetadataSource} to use. Cannot be null.
+	 */
+	public static MessageSecurityMetadataSource createExpressionMessageMetadataSource(
+			LinkedHashMap<MessageMatcher<?>, String> matcherToExpression) {
+		return createExpressionMessageMetadataSource(matcherToExpression,
+				new DefaultMessageSecurityExpressionHandler<>());
+	}
+
+	/**
+	 * Create a {@link MessageSecurityMetadataSource} that uses {@link MessageMatcher}
+	 * mapped to Spring Expressions. Each entry is considered in order and only the first
+	 * match is used.
+	 *
+	 * For example:
+	 *
+	 * <pre>
+	 *     LinkedHashMap&lt;MessageMatcher&lt;?&gt;,String&gt; matcherToExpression = new LinkedHashMap&lt;MessageMatcher&lt;Object&gt;,String&gt;();
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/public/**"), "permitAll");
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/admin/**"), "hasRole('ROLE_ADMIN')");
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/topics/{name}/**"), "@someBean.customLogic(authentication, #name)");
+	 *     matcherToExpression.put(new SimDestinationMessageMatcher("/**"), "authenticated");
+	 *
+	 *     MessageSecurityMetadataSource metadataSource = createExpressionMessageMetadataSource(matcherToExpression);
+	 * </pre>
+	 *
+	 * <p>
+	 * If our destination is "/public/hello", it would match on "/public/**" and on "/**".
+	 * However, only "/public/**" would be used since it is the first entry. That means
+	 * that a destination of "/public/hello" will be mapped to "permitAll".
+	 * </p>
+	 *
+	 * <p>
+	 * For a complete listing of expressions see {@link MessageSecurityExpressionRoot}
+	 * </p>
+	 * @param matcherToExpression an ordered mapping of {@link MessageMatcher} to Strings
+	 * that are turned into an Expression using
+	 * {@link DefaultMessageSecurityExpressionHandler#getExpressionParser()}
+	 * @param handler the {@link SecurityExpressionHandler} to use
+	 * @return the {@link MessageSecurityMetadataSource} to use. Cannot be null.
+	 */
+	public static MessageSecurityMetadataSource createExpressionMessageMetadataSource(
+			LinkedHashMap<MessageMatcher<?>, String> matcherToExpression,
+			SecurityExpressionHandler<Message<Object>> handler) {
+		LinkedHashMap<MessageMatcher<?>, Collection<ConfigAttribute>> matcherToAttrs = new LinkedHashMap<>();
+		for (Map.Entry<MessageMatcher<?>, String> entry : matcherToExpression.entrySet()) {
+			MessageMatcher<?> matcher = entry.getKey();
+			String rawExpression = entry.getValue();
+			Expression expression = handler.getExpressionParser().parseExpression(rawExpression);
+			ConfigAttribute attribute = new MessageExpressionConfigAttribute(expression, matcher);
+			matcherToAttrs.put(matcher, Arrays.asList(attribute));
+		}
+		return new DefaultMessageSecurityMetadataSource(matcherToAttrs);
+	}
+
+}
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.expression;
+
+import java.util.Map;
+
+import org.jspecify.annotations.Nullable;
+
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.messaging.Message;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.messaging.util.matcher.MessageMatcher;
+import org.springframework.util.Assert;
+
+/**
+ * Simple expression configuration attribute for use in {@link Message} authorizations.
+ *
+ * @author Rob Winch
+ * @author Daniel Bustamante Ospina
+ * @since 4.0
+ * @deprecated Use
+ * {@link org.springframework.security.messaging.access.intercept.MessageMatcherDelegatingAuthorizationManager}
+ * instead
+ */
+@Deprecated
+@SuppressWarnings("serial")
+class MessageExpressionConfigAttribute implements ConfigAttribute, EvaluationContextPostProcessor<Message<?>> {
+
+	private final Expression authorizeExpression;
+
+	private final MessageMatcher<Object> matcher;
+
+	/**
+	 * Creates a new instance
+	 * @param authorizeExpression the {@link Expression} to use. Cannot be null
+	 * @param matcher the {@link MessageMatcher} used to match the messages.
+	 */
+	MessageExpressionConfigAttribute(Expression authorizeExpression, MessageMatcher<?> matcher) {
+		Assert.notNull(authorizeExpression, "authorizeExpression cannot be null");
+		Assert.notNull(matcher, "matcher cannot be null");
+		this.authorizeExpression = authorizeExpression;
+		this.matcher = (MessageMatcher<Object>) matcher;
+	}
+
+	Expression getAuthorizeExpression() {
+		return this.authorizeExpression;
+	}
+
+	@Override
+	public @Nullable String getAttribute() {
+		return null;
+	}
+
+	@Override
+	public String toString() {
+		return this.authorizeExpression.getExpressionString();
+	}
+
+	@Override
+	public EvaluationContext postProcess(EvaluationContext ctx, Message<?> message) {
+		Map<String, String> variables = this.matcher.matcher(message).getVariables();
+		for (Map.Entry<String, String> entry : variables.entrySet()) {
+			ctx.setVariable(entry.getKey(), entry.getValue());
+		}
+		return ctx;
+	}
+
+}
@@ -0,0 +1,89 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.expression;
+
+import java.util.Collection;
+
+import org.jspecify.annotations.Nullable;
+
+import org.springframework.expression.EvaluationContext;
+import org.springframework.messaging.Message;
+import org.springframework.security.access.AccessDecisionVoter;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.access.expression.ExpressionUtils;
+import org.springframework.security.access.expression.SecurityExpressionHandler;
+import org.springframework.security.core.Authentication;
+import org.springframework.util.Assert;
+
+/**
+ * Voter which handles {@link Message} authorisation decisions. If a
+ * {@link MessageExpressionConfigAttribute} is found, then its expression is evaluated. If
+ * true, {@code ACCESS_GRANTED} is returned. If false, {@code ACCESS_DENIED} is returned.
+ * If no {@code MessageExpressionConfigAttribute} is found, then {@code ACCESS_ABSTAIN} is
+ * returned.
+ *
+ * @author Rob Winch
+ * @author Daniel Bustamante Ospina
+ * @since 4.0
+ * @deprecated Use
+ * {@link org.springframework.security.messaging.access.intercept.MessageMatcherDelegatingAuthorizationManager}
+ * instead
+ */
+@Deprecated
+public class MessageExpressionVoter<T> implements AccessDecisionVoter<Message<T>> {
+
+	private SecurityExpressionHandler<Message<T>> expressionHandler = new DefaultMessageSecurityExpressionHandler<>();
+
+	@Override
+	public int vote(Authentication authentication, Message<T> message, Collection<ConfigAttribute> attributes) {
+		Assert.notNull(authentication, "authentication must not be null");
+		Assert.notNull(message, "message must not be null");
+		Assert.notNull(attributes, "attributes must not be null");
+		MessageExpressionConfigAttribute attr = findConfigAttribute(attributes);
+		if (attr == null) {
+			return ACCESS_ABSTAIN;
+		}
+		EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication, message);
+		ctx = attr.postProcess(ctx, message);
+		return ExpressionUtils.evaluateAsBoolean(attr.getAuthorizeExpression(), ctx) ? ACCESS_GRANTED : ACCESS_DENIED;
+	}
+
+	private @Nullable MessageExpressionConfigAttribute findConfigAttribute(Collection<ConfigAttribute> attributes) {
+		for (ConfigAttribute attribute : attributes) {
+			if (attribute instanceof MessageExpressionConfigAttribute) {
+				return (MessageExpressionConfigAttribute) attribute;
+			}
+		}
+		return null;
+	}
+
+	@Override
+	public boolean supports(ConfigAttribute attribute) {
+		return attribute instanceof MessageExpressionConfigAttribute;
+	}
+
+	@Override
+	public boolean supports(Class<?> clazz) {
+		return Message.class.isAssignableFrom(clazz);
+	}
+
+	public void setExpressionHandler(SecurityExpressionHandler<Message<T>> expressionHandler) {
+		Assert.notNull(expressionHandler, "expressionHandler cannot be null");
+		this.expressionHandler = expressionHandler;
+	}
+
+}
@@ -0,0 +1,113 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.intercept;
+
+import org.jspecify.annotations.Nullable;
+
+import org.springframework.messaging.Message;
+import org.springframework.messaging.MessageChannel;
+import org.springframework.messaging.support.ChannelInterceptor;
+import org.springframework.security.access.SecurityMetadataSource;
+import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
+import org.springframework.security.access.intercept.InterceptorStatusToken;
+import org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory;
+import org.springframework.util.Assert;
+
+/**
+ * Performs security handling of Message resources via a ChannelInterceptor
+ * implementation.
+ * <p>
+ * The <code>SecurityMetadataSource</code> required by this security interceptor is of
+ * type {@link MessageSecurityMetadataSource}.
+ * <p>
+ * Refer to {@link AbstractSecurityInterceptor} for details on the workflow.
+ *
+ * @author Rob Winch
+ * @since 4.0
+ * @deprecated Use {@code AuthorizationChannelInterceptor} instead
+ */
+@Deprecated
+public final class ChannelSecurityInterceptor extends AbstractSecurityInterceptor implements ChannelInterceptor {
+
+	private static final ThreadLocal<InterceptorStatusToken> tokenHolder = new ThreadLocal<>();
+
+	private final MessageSecurityMetadataSource metadataSource;
+
+	/**
+	 * Creates a new instance
+	 * @param metadataSource the MessageSecurityMetadataSource to use. Cannot be null.
+	 *
+	 * @see DefaultMessageSecurityMetadataSource
+	 * @see ExpressionBasedMessageSecurityMetadataSourceFactory
+	 */
+	public ChannelSecurityInterceptor(MessageSecurityMetadataSource metadataSource) {
+		Assert.notNull(metadataSource, "metadataSource cannot be null");
+		this.metadataSource = metadataSource;
+	}
+
+	@Override
+	public Class<?> getSecureObjectClass() {
+		return Message.class;
+	}
+
+	@Override
+	public SecurityMetadataSource obtainSecurityMetadataSource() {
+		return this.metadataSource;
+	}
+
+	@Override
+	public Message<?> preSend(Message<?> message, MessageChannel channel) {
+		InterceptorStatusToken token = beforeInvocation(message);
+		if (token != null) {
+			tokenHolder.set(token);
+		}
+		return message;
+	}
+
+	@Override
+	public void postSend(Message<?> message, MessageChannel channel, boolean sent) {
+		InterceptorStatusToken token = clearToken();
+		afterInvocation(token, null);
+	}
+
+	@Override
+	public void afterSendCompletion(Message<?> message, MessageChannel channel, boolean sent, @Nullable Exception ex) {
+		InterceptorStatusToken token = clearToken();
+		finallyInvocation(token);
+	}
+
+	@Override
+	public boolean preReceive(MessageChannel channel) {
+		return true;
+	}
+
+	@Override
+	public Message<?> postReceive(Message<?> message, MessageChannel channel) {
+		return message;
+	}
+
+	@Override
+	public void afterReceiveCompletion(@Nullable Message<?> message, MessageChannel channel, @Nullable Exception ex) {
+	}
+
+	private InterceptorStatusToken clearToken() {
+		InterceptorStatusToken token = tokenHolder.get();
+		tokenHolder.remove();
+		return token;
+	}
+
+}
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.intercept;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+
+import org.springframework.messaging.Message;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory;
+import org.springframework.security.messaging.util.matcher.MessageMatcher;
+
+/**
+ * A default implementation of {@link MessageSecurityMetadataSource} that looks up the
+ * {@link ConfigAttribute} instances using a {@link MessageMatcher}.
+ *
+ * <p>
+ * Each entry is considered in order. The first entry that matches, the corresponding
+ * {@code Collection<ConfigAttribute>} is returned.
+ * </p>
+ *
+ * @author Rob Winch
+ * @since 4.0
+ * @see ChannelSecurityInterceptor
+ * @see ExpressionBasedMessageSecurityMetadataSourceFactory
+ * @deprecated Use {@link MessageMatcherDelegatingAuthorizationManager} instead
+ */
+@Deprecated
+public final class DefaultMessageSecurityMetadataSource implements MessageSecurityMetadataSource {
+
+	private final Map<MessageMatcher<?>, Collection<ConfigAttribute>> messageMap;
+
+	public DefaultMessageSecurityMetadataSource(
+			LinkedHashMap<MessageMatcher<?>, Collection<ConfigAttribute>> messageMap) {
+		this.messageMap = messageMap;
+	}
+
+	@Override
+	@SuppressWarnings({ "rawtypes", "unchecked" })
+	public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
+		final Message message = (Message) object;
+		for (Map.Entry<MessageMatcher<?>, Collection<ConfigAttribute>> entry : this.messageMap.entrySet()) {
+			if (entry.getKey().matches(message)) {
+				return entry.getValue();
+			}
+		}
+		return Collections.emptyList();
+	}
+
+	@Override
+	public Collection<ConfigAttribute> getAllConfigAttributes() {
+		Set<ConfigAttribute> allAttributes = new HashSet<>();
+		for (Collection<ConfigAttribute> entry : this.messageMap.values()) {
+			allAttributes.addAll(entry);
+		}
+		return allAttributes;
+	}
+
+	@Override
+	public boolean supports(Class<?> clazz) {
+		return Message.class.isAssignableFrom(clazz);
+	}
+
+}
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.messaging.access.intercept;
+
+import org.springframework.messaging.Message;
+import org.springframework.security.access.SecurityMetadataSource;
+
+/**
+ * A {@link SecurityMetadataSource} that is used for securing {@link Message}
+ *
+ * @author Rob Winch
+ * @since 4.0
+ * @see ChannelSecurityInterceptor
+ * @see DefaultMessageSecurityMetadataSource
+ * @deprecated Use {@link MessageMatcherDelegatingAuthorizationManager} instead
+ */
+@Deprecated
+public interface MessageSecurityMetadataSource extends SecurityMetadataSource {
+
+}