Simplify authorization

The current implementation of authorization is too cumbersome
and requires implementing a big amount of boilerplate code.

This changes inroduce `Authorizer` interface, which is responsible
for authorizing users. It's a replacement for specifiying a function
for creating a new secure context.

Advantage is stem from the fact that users only implement business
logic for authorization and nothing more. Also this type of API
is similar to `Authenticator`, which makes API more consistent.

dropwizard-auth/src/main/java/io/dropwizard/auth/AuthFilter.java

@@ -1,20 +1,16 @@
 package io.dropwizard.auth;
 
-import com.google.common.base.Function;
-
 import javax.annotation.Priority;
 import javax.ws.rs.Priorities;
-import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.container.ContainerRequestFilter;
-import javax.ws.rs.core.SecurityContext;
 import java.security.Principal;
 
 @Priority(Priorities.AUTHENTICATION)
 public abstract class AuthFilter<C, P extends Principal> implements ContainerRequestFilter {
     protected String prefix;
     protected String realm;
     protected Authenticator<C, P> authenticator;
-    protected Function<Tuple, SecurityContext> securityContextFunction;
+    protected Authorizer<P> authorizer;
     protected UnauthorizedHandler unauthorizedHandler = new DefaultUnauthorizedHandler();
 
     protected void setPrefix(String prefix) {
@@ -29,37 +25,15 @@ protected void setAuthenticator(Authenticator<C, P> authenticator) {
         this.authenticator = authenticator;
     }
 
-    protected void setSecurityContextFunction(Function<Tuple, SecurityContext> securityContextFunction) {
-        this.securityContextFunction = securityContextFunction;
-    }
-
-    protected Function<Tuple, SecurityContext> getSecurityContextFunction() {
-        return securityContextFunction;
-    }
-
-    public static class Tuple {
-        private ContainerRequestContext containerRequestContext;
-        private Principal principal;
-
-        public Tuple(ContainerRequestContext containerRequestContext, Principal principal) {
-            this.containerRequestContext = containerRequestContext;
-            this.principal = principal;
-        }
-
-        public ContainerRequestContext getContainerRequestContext() {
-            return containerRequestContext;
-        }
-
-        public Principal getPrincipal() {
-            return principal;
-        }
+    protected void setAuthorizer(Authorizer<P> authorizer) {
+        this.authorizer = authorizer;
     }
 
     public abstract static class AuthFilterBuilder<C, P extends Principal, T extends AuthFilter<C, P>, A extends Authenticator<C, P>> {
         protected String realm = "realm";
         protected String prefix = "Basic";
         protected Authenticator<C, P> authenticator;
-        protected Function<Tuple, SecurityContext> securityContextFunction;
+        protected Authorizer<P> authorizer;
 
         public AuthFilterBuilder<C, P, T, A>  setRealm(String realm) {
             this.realm = realm;
@@ -71,8 +45,8 @@ public AuthFilterBuilder<C, P, T, A>  setPrefix(String prefix) {
             return this;
         }
 
-        public AuthFilterBuilder<C, P, T, A>  setSecurityContextFunction(Function<Tuple, SecurityContext> securityContextFunction) {
-            this.securityContextFunction = securityContextFunction;
+        public AuthFilterBuilder<C, P, T, A>  setAuthorizer(Authorizer<P> authorizer) {
+            this.authorizer = authorizer;
             return this;
         }
 

dropwizard-auth/src/main/java/io/dropwizard/auth/Authorizer.java

@@ -0,0 +1,20 @@
+package io.dropwizard.auth;
+
+import java.security.Principal;
+
+/**
+ * An interface for classes which authorize principal objects.
+ *
+ * @param <P> the type of principals
+ */
+public interface Authorizer<P extends Principal> {
+
+    /**
+     * Decides if access is granted for the given principal in the given role.
+     *
+     * @param principal a {@link Principal} object, representing a user
+     * @param role a user role
+     * @return {@code true}, if the access is granted, {@code false otherwise}
+     */
+    boolean authorize(P principal, String role);
+}

dropwizard-auth/src/main/java/io/dropwizard/auth/basic/BasicCredentialAuthFilter.java

@@ -13,6 +13,7 @@
 import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.SecurityContext;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.security.Principal;
@@ -25,7 +26,7 @@ private BasicCredentialAuthFilter() {
     }
 
     @Override
-    public void filter(ContainerRequestContext requestContext) throws IOException {
+    public void filter(final ContainerRequestContext requestContext) throws IOException {
         final String header = requestContext.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
         try {
             if (header != null) {
@@ -42,11 +43,29 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
                             final String password = decoded.substring(i + 1);
                             final BasicCredentials credentials = new BasicCredentials(username, password);
                             try {
-                                final Optional<P> result = authenticator.authenticate(credentials);
-                                if (result.isPresent()) {
-                                    Principal principal = result.get();
-                                    requestContext.setSecurityContext(
-                                            getSecurityContextFunction().apply(new Tuple(requestContext, principal)));
+                                final Optional<P> principal = authenticator.authenticate(credentials);
+                                if (principal.isPresent()) {
+                                    requestContext.setSecurityContext(new SecurityContext() {
+                                        @Override
+                                        public Principal getUserPrincipal() {
+                                            return principal.get();
+                                        }
+
+                                        @Override
+                                        public boolean isUserInRole(String role) {
+                                            return authorizer.authorize(principal.get(), role);
+                                        }
+
+                                        @Override
+                                        public boolean isSecure() {
+                                            return requestContext.getSecurityContext().isSecure();
+                                        }
+
+                                        @Override
+                                        public String getAuthenticationScheme() {
+                                            return SecurityContext.BASIC_AUTH;
+                                        }
+                                    });
                                     return;
                                 }
                             } catch (AuthenticationException e) {
@@ -70,15 +89,15 @@ public static class Builder<APrincipal extends Principal, AAuthenticator extends
 
         @Override
         public BasicCredentialAuthFilter<APrincipal> buildAuthFilter() {
-            if (realm == null || authenticator == null || prefix == null || securityContextFunction == null) {
+            if (realm == null || authenticator == null || prefix == null || authorizer == null) {
                 throw new RuntimeException("Required auth filter parameters not set");
             }
 
             BasicCredentialAuthFilter<APrincipal> basicCredentialAuthFilter = new BasicCredentialAuthFilter<>();
             basicCredentialAuthFilter.setRealm(realm);
             basicCredentialAuthFilter.setAuthenticator(authenticator);
             basicCredentialAuthFilter.setPrefix(prefix);
-            basicCredentialAuthFilter.setSecurityContextFunction(securityContextFunction);
+            basicCredentialAuthFilter.setAuthorizer(authorizer);
             return basicCredentialAuthFilter;
         }
     }

dropwizard-auth/src/main/java/io/dropwizard/auth/oauth/OAuthCredentialAuthFilter.java

@@ -13,6 +13,7 @@
 import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.SecurityContext;
 import java.io.IOException;
 import java.security.Principal;
 
@@ -23,7 +24,7 @@ private OAuthCredentialAuthFilter() {
     }
 
     @Override
-    public void filter(ContainerRequestContext requestContext) throws IOException {
+    public void filter(final ContainerRequestContext requestContext) throws IOException {
         final String header = requestContext.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
         if (header != null) {
             try {
@@ -32,11 +33,29 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
                     final String method = header.substring(0, space);
                     if (prefix.equalsIgnoreCase(method)) {
                         final String credentials = header.substring(space + 1);
-                        final Optional<P> result = authenticator.authenticate(credentials);
-                        if (result.isPresent()) {
-                            final Principal principal = result.get();
-                            requestContext.setSecurityContext(
-                                    getSecurityContextFunction().apply(new Tuple(requestContext, principal)));
+                        final Optional<P> principal = authenticator.authenticate(credentials);
+                        if (principal.isPresent()) {
+                            requestContext.setSecurityContext(new SecurityContext() {
+                                @Override
+                                public Principal getUserPrincipal() {
+                                    return principal.get();
+                                }
+
+                                @Override
+                                public boolean isUserInRole(String role) {
+                                    return authorizer.authorize(principal.get(), role);
+                                }
+
+                                @Override
+                                public boolean isSecure() {
+                                    return requestContext.getSecurityContext().isSecure();
+                                }
+
+                                @Override
+                                public String getAuthenticationScheme() {
+                                    return SecurityContext.BASIC_AUTH;
+                                }
+                            });
                             return;
                         }
                     }
@@ -54,15 +73,15 @@ public static class Builder<APrincipal extends Principal, AAuthenticator extends
             extends AuthFilterBuilder<String, APrincipal, OAuthCredentialAuthFilter<APrincipal>, AAuthenticator> {
         @Override
         public OAuthCredentialAuthFilter<APrincipal> buildAuthFilter() {
-            if (realm == null || authenticator == null || prefix == null || securityContextFunction == null) {
+            if (realm == null || authenticator == null || prefix == null || authorizer == null) {
                 throw new RuntimeException("Required auth filter parameters not set");
             }
 
             OAuthCredentialAuthFilter<APrincipal> oauthCredentialAuthFilter = new OAuthCredentialAuthFilter<>();
             oauthCredentialAuthFilter.setRealm(realm);
             oauthCredentialAuthFilter.setAuthenticator(authenticator);
             oauthCredentialAuthFilter.setPrefix(prefix);
-            oauthCredentialAuthFilter.setSecurityContextFunction(securityContextFunction);
+            oauthCredentialAuthFilter.setAuthorizer(authorizer);
             return oauthCredentialAuthFilter;
         }
     }

dropwizard-auth/src/test/java/io/dropwizard/auth/basic/BasicAuthProviderTest.java

@@ -2,7 +2,6 @@
 
 import com.codahale.metrics.MetricRegistry;
 import io.dropwizard.auth.AuthDynamicFeature;
-import io.dropwizard.auth.AuthFilter;
 import io.dropwizard.auth.AuthResource;
 import io.dropwizard.auth.Authenticator;
 import io.dropwizard.auth.util.AuthUtil;
@@ -158,7 +157,7 @@ private ContainerRequestFilter getAuthFilter() {
 
             BasicCredentialAuthFilter.Builder<Principal, Authenticator<BasicCredentials, Principal>> builder
                     = new BasicCredentialAuthFilter.Builder<>();
-            builder.setSecurityContextFunction(AuthUtil.<AuthFilter.Tuple, SecurityContext>getSecurityContextProviderFunction(validUser, VALID_ROLE));
+            builder.setAuthorizer(AuthUtil.getTestAuthorizer(validUser, VALID_ROLE));
             builder.setAuthenticator(AuthUtil.<BasicCredentials, Principal>getTestAuthenticatorBasicCredential(validUser));
             return builder.buildAuthFilter();
         }

dropwizard-auth/src/test/java/io/dropwizard/auth/basic/BasicCustomAuthProviderTest.java

@@ -149,7 +149,7 @@ private ContainerRequestFilter getAuthFilter() {
 
             BasicCredentialAuthFilter.Builder<Principal, Authenticator<BasicCredentials, Principal>> builder
                     = new BasicCredentialAuthFilter.Builder<>();
-            builder.setSecurityContextFunction(AuthUtil.getSecurityContextProviderFunction(validUser, VALID_ROLE));
+            builder.setAuthorizer(AuthUtil.getTestAuthorizer(validUser, VALID_ROLE));
             builder.setAuthenticator(AuthUtil.getTestAuthenticatorBasicCredential(validUser));
             builder.setPrefix("Custom");
             return builder.buildAuthFilter();

dropwizard-auth/src/test/java/io/dropwizard/auth/chained/ChainedAuthProviderTest.java

@@ -1,12 +1,8 @@
 package io.dropwizard.auth.chained;
 
 import com.codahale.metrics.MetricRegistry;
-import com.google.common.base.Function;
 import com.google.common.collect.Lists;
-import io.dropwizard.auth.AuthDynamicFeature;
-import io.dropwizard.auth.AuthFilter;
-import io.dropwizard.auth.AuthResource;
-import io.dropwizard.auth.Authenticator;
+import io.dropwizard.auth.*;
 import io.dropwizard.auth.basic.BasicCredentialAuthFilter;
 import io.dropwizard.auth.basic.BasicCredentials;
 import io.dropwizard.auth.oauth.OAuthCredentialAuthFilter;
@@ -133,8 +129,8 @@ public ChainedAuthTestResourceConfig() {
 
             final String validUser = "good-guy";
 
-            final Function<AuthFilter.Tuple, SecurityContext> securityContextFunction =
-                    AuthUtil.getSecurityContextProviderFunction(validUser, ADMIN_ROLE);
+            final Authorizer<Principal> authorizer =
+                    AuthUtil.getTestAuthorizer(validUser, ADMIN_ROLE);
 
             final Authenticator<BasicCredentials, Principal> basicAuthenticator =
                     AuthUtil.getTestAuthenticatorBasicCredential(validUser);
@@ -145,13 +141,13 @@ public ChainedAuthTestResourceConfig() {
             final AuthFilter<BasicCredentials, Principal> basicAuthFilter =
                     new BasicCredentialAuthFilter.Builder<>()
                     .setAuthenticator(basicAuthenticator)
-                    .setSecurityContextFunction(securityContextFunction)
+                    .setAuthorizer(authorizer)
                     .buildAuthFilter();
 
             final AuthFilter<String, Principal> oAuthFilter = new OAuthCredentialAuthFilter.Builder<>()
                     .setAuthenticator(oauthAuthenticator)
                     .setPrefix("Bearer")
-                    .setSecurityContextFunction(securityContextFunction)
+                    .setAuthorizer(authorizer)
                     .buildAuthFilter();
 
             register(new AuthDynamicFeature(new ChainedAuthFilter<>(buildHandlerList(basicAuthFilter, oAuthFilter ))));

dropwizard-auth/src/test/java/io/dropwizard/auth/oauth/OAuthCustomProviderTest.java

@@ -129,8 +129,8 @@ private AuthFilter getAuthFilter() {
             final String validUser = "good-guy";
 
             return new OAuthCredentialAuthFilter.Builder<>()
-                    .setAuthenticator(AuthUtil.<String, SecurityContext>getTestAuthenticator(validUser))
-                    .setSecurityContextFunction(AuthUtil.getSecurityContextProviderFunction(validUser, "ADMIN"))
+                    .setAuthenticator(AuthUtil.getTestAuthenticator(validUser))
+                    .setAuthorizer(AuthUtil.getTestAuthorizer(validUser, "ADMIN"))
                     .setPrefix("Custom")
                     .buildAuthFilter();
         }

dropwizard-auth/src/test/java/io/dropwizard/auth/oauth/OAuthProviderTest.java

@@ -123,9 +123,9 @@ private AuthFilter getAuthFilter() {
             final String validUser = "good-guy";
 
             return new OAuthCredentialAuthFilter.Builder<>()
-                    .setAuthenticator(AuthUtil.<String, Principal>getTestAuthenticator(validUser))
+                    .setAuthenticator(AuthUtil.getTestAuthenticator(validUser))
+                    .setAuthorizer(AuthUtil.getTestAuthorizer(validUser, "ADMIN"))
                     .setPrefix("Bearer")
-                    .setSecurityContextFunction(AuthUtil.getSecurityContextProviderFunction(validUser, "ADMIN"))
                     .buildAuthFilter();
         }
     }

dropwizard-auth/src/test/java/io/dropwizard/auth/util/AuthUtil.java

@@ -1,14 +1,9 @@
 package io.dropwizard.auth.util;
 
-import com.google.common.base.Function;
 import com.google.common.base.Optional;
-import io.dropwizard.auth.AuthFilter;
-import io.dropwizard.auth.AuthenticationException;
-import io.dropwizard.auth.Authenticator;
-import io.dropwizard.auth.PrincipalImpl;
+import io.dropwizard.auth.*;
 import io.dropwizard.auth.basic.BasicCredentials;
 
-import javax.ws.rs.core.SecurityContext;
 import java.security.Principal;
 
 public class AuthUtil {
@@ -48,37 +43,14 @@ public static Authenticator<String, Principal> getTestAuthenticator(final String
         return getTestAuthenticator(presented, presented);
     }
 
-    public static Function<AuthFilter.Tuple, SecurityContext> getSecurityContextProviderFunction(
-            final String validUser,
-            final String validRole
-    ) {
-        return new Function<AuthFilter.Tuple, SecurityContext>() {
+    public static Authorizer<Principal> getTestAuthorizer(final String validUser,
+                                                          final String validRole) {
+        return new Authorizer<Principal>() {
             @Override
-            public SecurityContext apply(final AuthFilter.Tuple input) {
-                return new SecurityContext() {
-
-                    @Override
-                    public Principal getUserPrincipal() {
-                        return input.getPrincipal();
-                    }
-
-                    @Override
-                    public boolean isUserInRole(String role) {
-                        return getUserPrincipal() != null
-                                && validUser.equals(getUserPrincipal().getName())
-                                && validRole.equals(role);
-                    }
-
-                    @Override
-                    public boolean isSecure() {
-                        return input.getContainerRequestContext().getSecurityContext().isSecure();
-                    }
-
-                    @Override
-                    public String getAuthenticationScheme() {
-                        return SecurityContext.BASIC_AUTH;
-                    }
-                };
+            public boolean authorize(Principal principal, String role) {
+                return principal != null
+                        && validUser.equals(principal.getName())
+                        && validRole.equals(role);
             }
         };
     }