Add Not Support

Closes gh-14058

core/src/main/java/org/springframework/security/authorization/AuthorizationManagers.java

@@ -23,6 +23,7 @@ import java.util.List;
  * A factory class to create an {@link AuthorizationManager} instances.
  *
  * @author Evgeniy Cheban
+ * @author Josh Cummings
  * @since 5.8
  */
 public final class AuthorizationManagers {
@@ -119,6 +120,25 @@ public final class AuthorizationManagers {
 		};
 	}
 
+	/**
+	 * Creates an {@link AuthorizationManager} that reverses whatever decision the given
+	 * {@link AuthorizationManager} granted. If the given {@link AuthorizationManager}
+	 * abstains, then the returned manager also abstains.
+	 * @param <T> the type of object that is being authorized
+	 * @param manager the {@link AuthorizationManager} to reverse
+	 * @return the reversing {@link AuthorizationManager}
+	 * @since 6.3
+	 */
+	public static <T> AuthorizationManager<T> not(AuthorizationManager<T> manager) {
+		return (authentication, object) -> {
+			AuthorizationDecision decision = manager.check(authentication, object);
+			if (decision == null) {
+				return null;
+			}
+			return new NotAuthorizationDecision(decision);
+		};
+	}
+
 	private AuthorizationManagers() {
 	}
 
@@ -138,4 +158,20 @@ public final class AuthorizationManagers {
 
 	}
 
+	private static final class NotAuthorizationDecision extends AuthorizationDecision {
+
+		private final AuthorizationDecision decision;
+
+		private NotAuthorizationDecision(AuthorizationDecision decision) {
+			super(!decision.isGranted());
+			this.decision = decision;
+		}
+
+		@Override
+		public String toString() {
+			return "NotAuthorizationDecision [decision=" + this.decision + ']';
+		}
+
+	}
+
 }

core/src/test/java/org/springframework/security/authorization/AuthorizationManagersTests.java

@@ -224,4 +224,19 @@ class AuthorizationManagersTests {
 		assertThat(decision).isNull();
 	}
 
+	@Test
+	void checkNotWhenEmptyThenAbstainedDecision() {
+		AuthorizationManager<?> negated = AuthorizationManagers.not((a, o) -> null);
+		AuthorizationDecision decision = negated.check(null, null);
+		assertThat(decision).isNull();
+	}
+
+	@Test
+	void checkNotWhenGrantedThenDeniedDecision() {
+		AuthorizationManager<?> negated = AuthorizationManagers.not((a, o) -> new AuthorizationDecision(true));
+		AuthorizationDecision decision = negated.check(null, null);
+		assertThat(decision).isNotNull();
+		assertThat(decision.isGranted()).isFalse();
+	}
+
 }