Feat/017 caller role lookup - #36
Open
hendrikebbers wants to merge 5 commits into
Open
Conversation
…017) Add AuthService.getRoles() returning an immutable, prefix-free Set<String> of the current caller's role names, plus the Optional-returning companion AuthService.findAuthentication(). getRoles() degrades closed: a missing or unauthenticated security context, a null authority collection, or null entries all yield an empty set rather than throwing. Add Roles.AUTHORITY_PREFIX, Roles.ROLE_API_KEY and Roles.ROLE_ANONYMOUS, and rewire SecurityConfig's JWT converter and ApiKeyAuthenticationFilter onto AUTHORITY_PREFIX so the "ROLE_" literal lives in exactly one place. Produced authority strings are byte-identical; purely additive. Refs docs/specs/017-caller-role-lookup Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…pgrade (spec 017) Extend AuthServiceTest with 20 getRoles and 3 findAuthentication unit scenarios (prefix stripping, SCOPE_*/bare-ROLE_/whitespace filtering, null tolerance, case sensitivity, immutability, fail-closed vs fail-fast) and RolesTest with the three new constants. Add a real-filter-chain integration test (CallerRoleLookupChainIntegrationTest) proving the anonymous, JWT roles/no-roles, API-key, and 401 cases through the production chains. Add a SecurityConfigRoleTest scenario pinning byte-identical prefix-constant output. Document adoption in the 1.4.0 upgrade guide. Refs docs/specs/017-caller-role-lookup Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ter-chain test The new CallerRoleLookupChainIntegrationTest establishes the JWT-issuing fixture (custom JwtDecoder + test controller) the entry described and covers the Bearer scheme over a real HTTP round-trip (401 + WWW-Authenticate: Bearer + JSON error body). Assessed per spec 017 open question #3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request implements and documents a new feature for programmatically accessing the current caller's roles, along with several related improvements and codebase cleanups. The main addition is the new
AuthService.getRoles()method, which returns an immutable, prefix-free set of the caller's role names, making it easier and safer for applications to check roles without re-implementing Spring Security conventions. The changes are purely additive and do not affect existing APIs or behaviors.New role lookup API and documentation:
AuthService.getRoles(), which returns an immutable set of the current caller's role names (without theROLE_prefix), andAuthService.findAuthentication(), anOptional-returning variant ofgetAuthentication(). The new methods are documented with usage guidance and caveats. ([[1]](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-cd3cd7735018af5bb046c255187a4a48e8a3b58f01bae1548555f6c10d90e92dR29-R35),[[2]](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-cd3cd7735018af5bb046c255187a4a48e8a3b58f01bae1548555f6c10d90e92dR71-R154))docs/releases/upgrade-to-1.4.md) to describe the new role lookup feature, including migration advice and best practices. ([docs/releases/upgrade-to-1.4.mdR115-R162](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-c099d94887f99cbad46da2f4b17bd152f28bb8216400074c9b43b0bc7788d3e5R115-R162))[docs/specs/INDEX.mdL21-R21](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-9baa3cfbc42700dd81a1d390fbf2b8559fea5dca4ca46ba6d5b1fd40b847878cL21-R21))Roles and authority prefix centralization:
Roles.AUTHORITY_PREFIX,Roles.ROLE_API_KEY, andRoles.ROLE_ANONYMOUSconstants to theRolesclass, with detailed documentation explaining their use and context. ([spring-services-core/src/main/java/com/openelements/spring/base/security/roles/Roles.javaL3-R54](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-ac46650333c5f41f9f36a5c84a5d6e821cf0b0e3598151689706bad0929bb5a5L3-R54))Roles.AUTHORITY_PREFIXinstead of hardcoded"ROLE_", ensuring the authority prefix is defined in a single place. ([[1]](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-fb83d7e129dc8cd7ef5de523d6d4d11ceb4096b61b2329a0fdb43bff29f0383fR5),[[2]](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-fb83d7e129dc8cd7ef5de523d6d4d11ceb4096b61b2329a0fdb43bff29f0383fL142-R143),[[3]](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-8eb42dd3f18248ab20dcd7cb5f5502bf85b218160760a749fd87c71f71139e8fR3),[[4]](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-8eb42dd3f18248ab20dcd7cb5f5502bf85b218160760a749fd87c71f71139e8fL125-R126))Cleanup and deferred work:
JsonAuthenticationEntryPoint, as it was out-of-scope for this release. ([docs/TODO.mdL3-L14](https://github.com/OpenElementsLabs/spring-services/pull/36/files#diff-d3b8e9da24ca50b01df9b0fb9e644cf9922d2fd8a7873f345234da41623c64faL3-L14))