SEC-1562: Created SecurityExpressionHandler interface and AbstractSecurityExpressionHandler.

web/src/main/java/org/springframework/security/web/access/expression/DefaultWebSecurityExpressionHandler.java

@@ -1,55 +1,19 @@
 package org.springframework.security.web.access.expression;
 
-import org.springframework.beans.BeansException;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.expression.EvaluationContext;
-import org.springframework.expression.ExpressionParser;
-import org.springframework.expression.spel.standard.SpelExpressionParser;
-import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.security.access.expression.AbstractSecurityExpressionHandler;
 import org.springframework.security.access.expression.SecurityExpressionRoot;
-import org.springframework.security.access.expression.SecurityExpressionRootPropertyAccessor;
-import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
-import org.springframework.security.authentication.AuthenticationTrustResolver;
-import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;
 
 /**
- * Facade which isolates Spring Security's requirements for evaluating web-security expressions
- * from the implementation of the underlying expression objects.
  *
  * @author Luke Taylor
  * @since 3.0
  */
-public class DefaultWebSecurityExpressionHandler implements WebSecurityExpressionHandler, ApplicationContextAware {
+public class DefaultWebSecurityExpressionHandler extends AbstractSecurityExpressionHandler<FilterInvocation> {
 
-    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
-    private final ExpressionParser expressionParser = new SpelExpressionParser();
-    private final SecurityExpressionRootPropertyAccessor sxrpa = new SecurityExpressionRootPropertyAccessor();
-    private RoleHierarchy roleHierarchy;
-    private ApplicationContext applicationContext;
-
-    public ExpressionParser getExpressionParser() {
-        return expressionParser;
-    }
-
-    public EvaluationContext createEvaluationContext(Authentication authentication, FilterInvocation fi) {
-        SecurityExpressionRoot root = new WebSecurityExpressionRoot(authentication, fi);
-        root.setTrustResolver(trustResolver);
-        root.setRoleHierarchy(roleHierarchy);
-        root.setApplicationContext(applicationContext);
-        StandardEvaluationContext ctx = new StandardEvaluationContext(root);
-        ctx.addPropertyAccessor(sxrpa);
-
-        return ctx;
-    }
-
-    public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
-        this.roleHierarchy = roleHierarchy;
-    }
-
-    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-        this.applicationContext = applicationContext;
+    @Override
+    protected SecurityExpressionRoot createSecurityExpressionRoot(Authentication authentication, FilterInvocation fi) {
+        return new WebSecurityExpressionRoot(authentication, fi);
     }
 }

web/src/main/java/org/springframework/security/web/access/expression/ExpressionBasedFilterInvocationSecurityMetadataSource.java

@@ -10,12 +10,14 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.expression.ParseException;
 import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.access.expression.SecurityExpressionHandler;
+import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
 import org.springframework.security.web.util.RequestMatcher;
 import org.springframework.util.Assert;
 
 /**
- * Expression-based <tt>FilterInvocationSecurityMetadataSource</tt>.
+ * Expression-based {@code FilterInvocationSecurityMetadataSource}.
  *
  * @author Luke Taylor
  * @since 3.0
@@ -25,7 +27,7 @@ public final class ExpressionBasedFilterInvocationSecurityMetadataSource extends
 
     public ExpressionBasedFilterInvocationSecurityMetadataSource(
             LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap,
-            WebSecurityExpressionHandler expressionHandler) {
+            SecurityExpressionHandler<FilterInvocation> expressionHandler) {
         super(processMap(requestMap, expressionHandler.getExpressionParser()));
         Assert.notNull(expressionHandler, "A non-null SecurityExpressionHandler is required");
     }

web/src/main/java/org/springframework/security/web/access/expression/WebExpressionVoter.java

@@ -6,6 +6,7 @@ import org.springframework.expression.EvaluationContext;
 import org.springframework.security.access.AccessDecisionVoter;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.expression.ExpressionUtils;
+import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;
 
@@ -15,7 +16,7 @@ import org.springframework.security.web.FilterInvocation;
  * @since 3.0
  */
 public class WebExpressionVoter implements AccessDecisionVoter {
-    private WebSecurityExpressionHandler expressionHandler = new DefaultWebSecurityExpressionHandler();
+    private SecurityExpressionHandler<FilterInvocation> expressionHandler = new DefaultWebSecurityExpressionHandler();
 
     public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
         assert authentication != null;
@@ -52,7 +53,7 @@ public class WebExpressionVoter implements AccessDecisionVoter {
         return clazz.isAssignableFrom(FilterInvocation.class);
     }
 
-    public void setExpressionHandler(WebSecurityExpressionHandler expressionHandler) {
+    public void setExpressionHandler(SecurityExpressionHandler<FilterInvocation> expressionHandler) {
         this.expressionHandler = expressionHandler;
     }
 }

web/src/main/java/org/springframework/security/web/access/expression/WebSecurityExpressionHandler.java

@@ -1,19 +1,8 @@
 package org.springframework.security.web.access.expression;
 
-import org.springframework.expression.EvaluationContext;
-import org.springframework.expression.ExpressionParser;
-import org.springframework.security.core.Authentication;
+import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.web.FilterInvocation;
 
-public interface WebSecurityExpressionHandler {
-    /**
-     * @return an expression parser for the expressions used by the implementation.
-     */
-    ExpressionParser getExpressionParser();
-
-    /**
-     * Provides an evaluation context in which to evaluate security expressions for a web invocation.
-     */
-    EvaluationContext createEvaluationContext(Authentication authentication, FilterInvocation fi);
-
+@Deprecated
+public interface WebSecurityExpressionHandler extends SecurityExpressionHandler<FilterInvocation> {
 }