Skip to content

Commit 4f61fd2

Browse files
fcamblorfcamblor
committed
[breaking] Considering a StdEntityRoute should *always* bring a permissionFactory at construction time
Deprecated RestxRouter.Builder.addRoute() with no permissionFactory in order to avoid NPEs when checking for security permissions
1 parent 5f95297 commit 4f61fd2

6 files changed

Lines changed: 27 additions & 25 deletions

File tree

‎restx-admin/src/main/java/restx/exceptions/ErrorDescriptorsRoute.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,9 @@ public class ErrorDescriptorsRoute extends StdJsonProducerEntityRoute {
3434
public ErrorDescriptorsRoute(Iterable<ErrorDescriptor> errorDescriptors,
3535
@Named(FrontObjectMapperFactory.WRITER_NAME) ObjectWriter objectWriter,
3636
RestxSecurityManager securityManager,
37-
PermissionFactory permissionFactory) {
38-
39-
super("ErrorDescriptorsRoute", ImmutableCollection.class, objectWriter, new StdRestxRequestMatcher("GET", "/@/errors/descriptors"));
40-
this.permissionFactory = permissionFactory;
37+
PermissionFactory permissionFactory
38+
) {
39+
super("ErrorDescriptorsRoute", ImmutableCollection.class, objectWriter, new StdRestxRequestMatcher("GET", "/@/errors/descriptors"), permissionFactory);
4140
Map<String, ErrorDescriptor> map = Maps.newLinkedHashMap();
4241
for (ErrorDescriptor errorDescriptor : errorDescriptors) {
4342
if (map.containsKey(errorDescriptor.getErrorCode())) {

‎restx-apidocs/src/main/java/restx/apidocs/ApiDeclarationRoute.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public class ApiDeclarationRoute extends StdJsonProducerEntityRoute {
5050
@Inject
5151
public ApiDeclarationRoute(@Named(FrontObjectMapperFactory.WRITER_NAME) ObjectWriter writer,
5252
Factory factory, RestxSecurityManager securityManager, PermissionFactory permissionFactory) {
53-
super("ApiDeclarationRoute", Map.class, writer, new StdRestxRequestMatcher("GET", "/@/api-docs/{router}"));
53+
super("ApiDeclarationRoute", Map.class, writer, new StdRestxRequestMatcher("GET", "/@/api-docs/{router}"), permissionFactory);
5454
this.factory = factory;
5555
this.securityManager = securityManager;
5656
this.permissionFactory = permissionFactory;

‎restx-apidocs/src/main/java/restx/apidocs/ApiDocsIndexRoute.java‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import restx.jackson.StdJsonProducerEntityRoute;
1515
import restx.security.PermissionFactory;
1616
import restx.security.RestxSecurityManager;
17+
import restx.security.PermissionFactory;
1718

1819
import javax.inject.Inject;
1920
import javax.inject.Named;
@@ -44,23 +45,20 @@
4445
public class ApiDocsIndexRoute extends StdJsonProducerEntityRoute {
4546
private final Factory factory;
4647
private final RestxSecurityManager securityManager;
47-
private PermissionFactory permissionFactory;
4848

4949
@Inject
5050
public ApiDocsIndexRoute(@Named(FrontObjectMapperFactory.WRITER_NAME) ObjectWriter writer,
5151
Factory factory,
5252
RestxSecurityManager securityManager,
5353
PermissionFactory permissionFactory) {
54-
55-
super("ApiDocsIndexRoute", Map.class, writer, new StdRestxRequestMatcher("GET", "/@/api-docs"));
54+
super("ApiDocsIndexRoute", Map.class, writer, new StdRestxRequestMatcher("GET", "/@/api-docs"), permissionFactory);
5655
this.factory = factory;
5756
this.securityManager = securityManager;
58-
this.permissionFactory = permissionFactory;
5957
}
6058

6159
@Override
6260
protected Optional<?> doRoute(RestxRequest restxRequest, RestxRequestMatch match, Object i) throws IOException {
63-
securityManager.check(restxRequest, match, permissionFactory.hasRole(AdminModule.RESTX_ADMIN_ROLE));
61+
securityManager.check(restxRequest, match, hasRole(AdminModule.RESTX_ADMIN_ROLE));
6462
return Optional.of(ImmutableMap.builder()
6563
.put("apiVersion", "0.1") // TODO
6664
.put("swaggerVersion", "1.1")

‎restx-core/src/main/java/restx/RestxRouter.java‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@
99
import restx.entity.MatchedEntityRoute;
1010
import restx.jackson.JsonEntityRouteBuilder;
1111
import restx.jackson.StdJsonProducerEntityRoute;
12+
import restx.security.PermissionFactory;
1213

1314
import java.io.IOException;
14-
import java.lang.reflect.Type;
1515
import java.util.List;
1616

1717
import static com.google.common.base.Preconditions.checkNotNull;
@@ -88,8 +88,16 @@ public <O> Builder addRoute(String method, String path, Class<O> outputType, fin
8888
return addRoute(path, new StdRestxRequestMatcher(method, path), outputType, route);
8989
}
9090

91+
/**
92+
* @deprecated Prefer to use addRoute(String, RestxRequestMatcher, PermissionFactory, Class<O>, MatchedEntityRoute<Void, O>)
93+
* in order to avoid NPEs when checking permissions through permissionFactory
94+
*/
9195
public <O> Builder addRoute(String name, RestxRequestMatcher matcher, Class<O> outputType, final MatchedEntityRoute<Void, O> route) {
92-
routes.add(new StdJsonProducerEntityRoute<O>(name, outputType, writer.withType(outputType), matcher) {
96+
return addRoute(name, matcher, null, outputType, route);
97+
}
98+
99+
public <O> Builder addRoute(String name, RestxRequestMatcher matcher, PermissionFactory permissionFactory, Class<O> outputType, final MatchedEntityRoute<Void, O> route) {
100+
routes.add(new StdJsonProducerEntityRoute<O>(name, outputType, writer.withType(outputType), matcher, permissionFactory) {
93101
@Override
94102
protected Optional<O> doRoute(RestxRequest restxRequest, RestxRequestMatch match, Void i) throws IOException {
95103
return route.route(restxRequest, match, i);

‎restx-core/src/main/java/restx/entity/StdEntityRoute.java‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ public static class Builder<I,O> {
3232
protected RestxRequestMatcher matcher;
3333
protected HttpStatus successStatus = HttpStatus.OK;
3434
protected RestxLogLevel logLevel = RestxLogLevel.DEFAULT;
35+
protected PermissionFactory permissionFactory;
3536
protected MatchedEntityRoute<I,O> matchedEntityRoute;
3637

3738
public Builder<I,O> entityRequestBodyReader(final EntityRequestBodyReader<I> entityRequestBodyReader) {
@@ -49,6 +50,11 @@ public Builder<I,O> name(final String name) {
4950
return this;
5051
}
5152

53+
public Builder<I,O> permissionFactory(final PermissionFactory permissionFactory) {
54+
this.permissionFactory = permissionFactory;
55+
return this;
56+
}
57+
5258
public Builder<I,O> matcher(final RestxRequestMatcher matcher) {
5359
this.matcher = matcher;
5460
return this;
@@ -74,7 +80,7 @@ public StdEntityRoute<I,O> build() {
7480
return new StdEntityRoute<I, O>(
7581
name, entityRequestBodyReader == null ? voidBodyReader() : entityRequestBodyReader,
7682
entityResponseWriter,
77-
matcher, successStatus, logLevel) {
83+
matcher, successStatus, logLevel, permissionFactory) {
7884
@Override
7985
protected Optional<O> doRoute(RestxRequest restxRequest, RestxRequestMatch match, I i) throws IOException {
8086
return matchedEntityRoute.route(restxRequest, match, i);
@@ -102,16 +108,6 @@ public static <I,O> Builder<I,O> builder() {
102108
private final RestxLogLevel logLevel;
103109
private final PermissionFactory permissionFactory;
104110

105-
public StdEntityRoute(String name,
106-
EntityRequestBodyReader<I> entityRequestBodyReader,
107-
EntityResponseWriter<O> entityResponseWriter,
108-
RestxRequestMatcher matcher,
109-
HttpStatus successStatus,
110-
RestxLogLevel logLevel
111-
) {
112-
this(name, entityRequestBodyReader, entityResponseWriter, matcher, successStatus, logLevel, null);
113-
}
114-
115111
public StdEntityRoute(String name,
116112
EntityRequestBodyReader<I> entityRequestBodyReader,
117113
EntityResponseWriter<O> entityResponseWriter,

‎restx-core/src/main/java/restx/jackson/StdJsonProducerEntityRoute.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import restx.entity.StdEntityRoute;
77
import restx.entity.VoidContentTypeModule;
88
import restx.http.HttpStatus;
9+
import restx.security.PermissionFactory;
910

1011
import java.lang.reflect.Type;
1112

@@ -14,11 +15,11 @@
1415
* Time: 11:06
1516
*/
1617
public abstract class StdJsonProducerEntityRoute<O> extends StdEntityRoute<Void,O> {
17-
public StdJsonProducerEntityRoute(String name, Type type, ObjectWriter writer, RestxRequestMatcher matcher) {
18+
public StdJsonProducerEntityRoute(String name, Type type, ObjectWriter writer, RestxRequestMatcher matcher, PermissionFactory permissionFactory) {
1819
super(name,
1920
VoidContentTypeModule.VoidEntityRequestBodyReader.INSTANCE,
2021
JsonEntityResponseWriter.<O>using(type, writer),
2122
matcher,
22-
HttpStatus.OK, RestxLogLevel.DEFAULT);
23+
HttpStatus.OK, RestxLogLevel.DEFAULT, permissionFactory);
2324
}
2425
}

0 commit comments

Comments
 (0)