Remove constants from CloudFoundryVcapEnvironmentPostProcessor

This commit removes the VCAP_APPLICATION, VCAP_SERVICES, and
VCAP_PROPERTY_SOURCE_NAME constants from the
CloudFoundryVcapEnvironmentPostProcessor class, replacing them with
string literals.

This change simplifies the code and aligns with the team's decision to
avoid using constants in this context.

Signed-off-by: wonyongg <111210881+wonyongg@users.noreply.github.com>

Author: wonyongg

There

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2024 the original author or authors.
+ * Copyright 2012-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,6 +22,8 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.Reader;
+import java.io.UncheckedIOException;
+import java.util.List;
 import java.util.Properties;
 import java.util.Set;
 import java.util.SortedSet;
@@ -61,22 +63,39 @@ public void setAutoConfiguration(FileCollection autoConfiguration) {
 
 	@TaskAction
 	void documentAutoConfigurationClasses() throws IOException {
+		List<AutoConfiguration> autoConfigurations = load();
+		autoConfigurations.forEach(this::writeModuleAdoc);
 		for (File metadataFile : this.autoConfiguration) {
 			Properties metadata = new Properties();
 			try (Reader reader = new FileReader(metadataFile)) {
 				metadata.load(reader);
 			}
 			AutoConfiguration autoConfiguration = new AutoConfiguration(metadata.getProperty("module"), new TreeSet<>(
 					StringUtils.commaDelimitedListToSet(metadata.getProperty("autoConfigurationClassNames"))));
-			writeTable(autoConfiguration);
+			writeModuleAdoc(autoConfiguration);
 		}
+		writeNavAdoc(autoConfigurations);
 	}
 
-	private void writeTable(AutoConfiguration autoConfigurationClasses) throws IOException {
+	private List<AutoConfiguration> load() {
+		return this.autoConfiguration.getFiles()
+			.stream()
+			.map(AutoConfiguration::of)
+			.sorted((a1, a2) -> a1.module.compareTo(a2.module))
+			.toList();
+	}
+
+	private void writeModuleAdoc(AutoConfiguration autoConfigurationClasses) {
 		File outputDir = getOutputDir().getAsFile().get();
 		outputDir.mkdirs();
 		try (PrintWriter writer = new PrintWriter(
 				new FileWriter(new File(outputDir, autoConfigurationClasses.module + ".adoc")))) {
+			writer.println("[[appendix.auto-configuration-classes.%s]]".formatted(autoConfigurationClasses.module));
+			writer.println("= %s".formatted(autoConfigurationClasses.module));
+			writer.println();
+			writer.println("The following auto-configuration classes are from the `%s` module:"
+				.formatted(autoConfigurationClasses.module));
+			writer.println();
 			writer.println("[cols=\"4,1\"]");
 			writer.println("|===");
 			writer.println("| Configuration Class | Links");
@@ -88,6 +107,22 @@ private void writeTable(AutoConfiguration autoConfigurationClasses) throws IOExc
 			}
 			writer.println("|===");
 		}
+		catch (IOException ex) {
+			throw new UncheckedIOException(ex);
+		}
+	}
+
+	private void writeNavAdoc(List<AutoConfiguration> autoConfigurations) {
+		File outputDir = getOutputDir().getAsFile().get();
+		outputDir.mkdirs();
+		try (PrintWriter writer = new PrintWriter(new FileWriter(new File(outputDir, "nav.adoc")))) {
+			autoConfigurations.forEach((autoConfigurationClasses) -> writer
+				.println("*** xref:appendix:auto-configuration-classes/%s.adoc[]"
+					.formatted(autoConfigurationClasses.module)));
+		}
+		catch (IOException ex) {
+			throw new UncheckedIOException(ex);
+		}
 	}
 
 	private static final class AutoConfiguration {
@@ -105,6 +140,18 @@ private AutoConfiguration(String module, Set<String> classNames) {
 			}).collect(Collectors.toCollection(TreeSet::new));
 		}
 
+		private static AutoConfiguration of(File metadataFile) {
+			Properties metadata = new Properties();
+			try (Reader reader = new FileReader(metadataFile)) {
+				metadata.load(reader);
+			}
+			catch (IOException ex) {
+				throw new UncheckedIOException(ex);
+			}
+			return new AutoConfiguration(metadata.getProperty("module"), new TreeSet<>(
+					StringUtils.commaDelimitedListToSet(metadata.getProperty("autoConfigurationClassNames"))));
+		}
+
 	}
 
 	private static final class AutoConfigurationClass implements Comparable<AutoConfigurationClass> {

buildSrc/src/main/java/org/springframework/boot/build/autoconfigure/DocumentAutoConfigurationClasses.java

@@ -21,6 +21,6 @@ nativeBuildToolsVersion=0.10.6
 snakeYamlVersion=2.4
 springFrameworkVersion=6.2.8-SNAPSHOT
 springFramework60xVersion=6.0.23
-tomcatVersion=10.1.41
+tomcatVersion=10.1.42
 
 kotlin.stdlib.default.dependency=false

gradle.properties

@@ -174,6 +174,7 @@ public static class IgnoredCloudFoundryPathsWebSecurityConfiguration {
 		SecurityFilterChain cloudFoundrySecurityFilterChain(HttpSecurity http,
 				CloudFoundryWebEndpointServletHandlerMapping handlerMapping) throws Exception {
 			RequestMatcher cloudFoundryRequest = getRequestMatcher(handlerMapping);
+			http.csrf((csrf) -> csrf.ignoringRequestMatchers(cloudFoundryRequest));
 			http.securityMatchers((matches) -> matches.requestMatchers(cloudFoundryRequest))
 				.authorizeHttpRequests((authorize) -> authorize.anyRequest().permitAll());
 			return http.build();

spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryActuatorAutoConfiguration.java

@@ -39,7 +39,6 @@
 import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication.Type;
 import org.springframework.boot.autoconfigure.condition.SearchStrategy;
 import org.springframework.boot.autoconfigure.web.ServerProperties;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.boot.web.embedded.jetty.JettyServletWebServerFactory;
 import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
 import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
@@ -67,7 +66,6 @@
  */
 @ManagementContextConfiguration(value = ManagementContextType.CHILD, proxyBeanMethods = false)
 @ConditionalOnWebApplication(type = Type.SERVLET)
-@EnableConfigurationProperties(ManagementServerProperties.class)
 class ServletManagementChildContextConfiguration {
 
 	@Bean

spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/web/servlet/ServletManagementChildContextConfiguration.java

@@ -33,6 +33,7 @@
 import org.springframework.boot.actuate.endpoint.EndpointId;
 import org.springframework.boot.actuate.endpoint.annotation.Endpoint;
 import org.springframework.boot.actuate.endpoint.annotation.ReadOperation;
+import org.springframework.boot.actuate.endpoint.annotation.WriteOperation;
 import org.springframework.boot.actuate.endpoint.web.EndpointMapping;
 import org.springframework.boot.actuate.endpoint.web.ExposableWebEndpoint;
 import org.springframework.boot.actuate.endpoint.web.WebOperation;
@@ -49,17 +50,24 @@
 import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
 import org.springframework.context.ApplicationContext;
 import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.config.BeanIds;
 import org.springframework.security.web.FilterChainProxy;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.assertj.MockMvcTester;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.client.RestTemplate;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.filter.CompositeFilter;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
 /**
  * Tests for {@link CloudFoundryActuatorAutoConfiguration}.
@@ -170,7 +178,7 @@ void cloudFoundryPlatformActiveAndCloudControllerUrlNotPresent() {
 	}
 
 	@Test
-	void cloudFoundryPathsIgnoredBySpringSecurity() {
+	void cloudFoundryPathsPermittedBySpringSecurity() {
 		this.contextRunner.withBean(TestEndpoint.class, TestEndpoint::new)
 			.withPropertyValues("VCAP_APPLICATION:---", "vcap.application.application_id:my-app-id")
 			.run((context) -> {
@@ -189,6 +197,19 @@ void cloudFoundryPathsIgnoredBySpringSecurity() {
 			});
 	}
 
+	@Test
+	void cloudFoundryPathsPermittedWithCsrfBySpringSecurity() {
+		this.contextRunner.withBean(TestEndpoint.class, TestEndpoint::new)
+			.withPropertyValues("VCAP_APPLICATION:---", "vcap.application.application_id:my-app-id")
+			.run((context) -> {
+				MockMvc mvc = MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).build();
+				mvc.perform(post(BASE_PATH + "/test?name=test").contentType(MediaType.APPLICATION_JSON)
+					.with(csrf().useInvalidToken())).andExpect(status().isServiceUnavailable());
+				// If CSRF fails we'll get a 403, if it works we get service unavailable
+				// because of "Cloud controller URL is not available"
+			});
+	}
+
 	private SecurityFilterChain getSecurityFilterChain(AssertableWebApplicationContext context) {
 		Filter springSecurityFilterChain = context.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN, Filter.class);
 		FilterChainProxy filterChainProxy = getFilterChainProxy(springSecurityFilterChain);
@@ -258,7 +279,7 @@ void endpointPathCustomizationIsNotApplied() {
 					.findFirst()
 					.get();
 				Collection<WebOperation> operations = endpoint.getOperations();
-				assertThat(operations).hasSize(1);
+				assertThat(operations).hasSize(2);
 				assertThat(operations.iterator().next().getRequestPredicate().getPath()).isEqualTo("test");
 			});
 	}
@@ -307,6 +328,10 @@ String hello() {
 			return "hello world";
 		}
 
+		@WriteOperation
+		void update(String name) {
+		}
+
 	}
 
 }

spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryActuatorAutoConfigurationTests.java

@@ -19,6 +19,8 @@
 import org.junit.jupiter.api.Test;
 
 import org.springframework.boot.actuate.autoconfigure.web.reactive.ReactiveManagementChildContextConfiguration.AccessLogCustomizer;
+import org.springframework.boot.actuate.autoconfigure.web.server.ManagementServerProperties;
+import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -46,4 +48,22 @@ void accessLogCustomizerWithNullPrefix() {
 		assertThat(customizer.customizePrefix("existing")).isEqualTo("existing");
 	}
 
+	@Test
+	// gh-45857
+	void failsWithoutManagementServerPropertiesBeanFromParent() {
+		new ReactiveWebApplicationContextRunner()
+			.run((parent) -> new ReactiveWebApplicationContextRunner().withParent(parent)
+				.withUserConfiguration(ReactiveManagementChildContextConfiguration.class)
+				.run((context) -> assertThat(context).hasFailed()));
+	}
+
+	@Test
+	// gh-45857
+	void succeedsWithManagementServerPropertiesBeanFromParent() {
+		new ReactiveWebApplicationContextRunner().withBean(ManagementServerProperties.class)
+			.run((parent) -> new ReactiveWebApplicationContextRunner().withParent(parent)
+				.withUserConfiguration(ReactiveManagementChildContextConfiguration.class)
+				.run((context) -> assertThat(context).hasNotFailed()));
+	}
+
 }

spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/tracing/zipkin/ZipkinAutoConfigurationIntegrationTests.java

@@ -18,7 +18,9 @@
 
 import org.junit.jupiter.api.Test;
 
+import org.springframework.boot.actuate.autoconfigure.web.server.ManagementServerProperties;
 import org.springframework.boot.actuate.autoconfigure.web.servlet.ServletManagementChildContextConfiguration.AccessLogCustomizer;
+import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -46,4 +48,21 @@ void accessLogCustomizerWithNullPrefix() {
 		assertThat(customizer.customizePrefix("existing")).isEqualTo("existing");
 	}
 
+	@Test
+	// gh-45857
+	void failsWithoutManagementServerPropertiesBeanFromParent() {
+		new WebApplicationContextRunner().run((parent) -> new WebApplicationContextRunner().withParent(parent)
+			.withUserConfiguration(ServletManagementChildContextConfiguration.class)
+			.run((context) -> assertThat(context).hasFailed()));
+	}
+
+	@Test
+	// gh-45857
+	void succeedsWithManagementServerPropertiesBeanFromParent() {
+		new WebApplicationContextRunner().withBean(ManagementServerProperties.class)
+			.run((parent) -> new WebApplicationContextRunner().withParent(parent)
+				.withUserConfiguration(ServletManagementChildContextConfiguration.class)
+				.run((context) -> assertThat(context).hasNotFailed()));
+	}
+
 }

spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/web/reactive/ReactiveManagementChildContextConfigurationTests.java

@@ -343,6 +343,7 @@ public void setTimeout(Duration timeout) {
 
 	}
 
+	@Deprecated(since = "3.5.1", forRemoval = true)
 	public static final class DeprecatedSse {
 
 		private final Sse sse;