Add AuthorizationManagerFactory

[sjohnr]

Closes gh-17585

[rwinch]

Thanks for the updates @sjohnr! I've provided feedback inline.

[sjohnr]

@rwinch Thanks for the review! Changing the generic type of MessageSecurityExpressionRoot to Message<T> is a breaking change. Please confirm if that's something we want to do here and I will work on this and the other changes from your review.

[rwinch]

@sjohnr

@rwinch Thanks for the review! Changing the generic type of MessageSecurityExpressionRoot to Message<T> is a breaking change. Please confirm if that's something we want to do here and I will work on this and the other changes from your review.

I think that this can work if we update the constructor too. For example:

public class MessageSecurityExpressionRoot<T> extends SecurityExpressionRoot {

	public final Message<T> message;

	public MessageSecurityExpressionRoot(Authentication authentication, Message<T> message) {
	  ...
	public MessageSecurityExpressionRoot(Supplier<Authentication> authentication, Message<T> message) {
	  ...

Then this will compile:

Message<?> message = ...
MessageSecurityExpressionRoot root = new MessageSecurityExpressionRoot<>(authentication, message);

[sjohnr]

@rwinch I've working through the changes and it's looking really good. The only thing I'm noticing is that a few packages are missing nullability defaults.

• org.springframework.security.web.access.expression has a package-info.java but no @NullMarked. Is this intended or perhaps it should be addressed separately?
• org.springframework.security.messaging.access.expression is missing package-info.java along with all the other packages in spring-security-messaging.

As it stands now, classes in these packages show as having inconsistent nullability. These show up as IntelliJ inspections for me, similar to our conversation a few weeks ago. I think adding @NullMarked at the package level will address this, but if omitting that was intentional, let me know. I've added @NullMarked at the class level to show where these issues are but I will revert that after you review.

[rwinch]

This is looking great @sjohnr!

I think we are very close 😄 I provided a few minor comments inline.

Now that we are almost done, please also add documentation (using include-code).

After those are addressed, I think we will be ready to merge!

[rwinch]

We've only added nullability for crypto and core so feel free to leave as is. We'll get the rest of the module in a different ticket commit.

[sjohnr]

@rwinch I've added documentation, code examples with include-code, and tests. I've also added two additional notes for your review below. Aside from the note below, I believe this PR is ready to merge.

I will also be creating a GH issue for the Kotlin authorizeHttpRequests DSL, which doesn't currently support using the new AuthorizationManagerFactory. I doubt I'll have time to work on that change though (if needed for 7.0).

[rwinch]

@sjohnr Thanks for the PR. Overall, I think that we are ready to merge after you address my two replies to your comments.

I will also be creating a GH issue for the Kotlin authorizeHttpRequests DSL, which doesn't currently support using the new AuthorizationManagerFactory. I doubt I'll have time to work on that change though (if needed for 7.0).

Thanks for the heads up. We will ensure that this gets taken care of.

[rwinch]

I've provided feedback inline. Can you please include a link in the whats-new.adoc as well?

[rwinch]

Awesome work @sjohnr! This is ready for merge