| /* |
| * Copyright 2005-2008 Les Hazlewood |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.jsecurity.authz.aop; |
| |
| import org.jsecurity.aop.MethodInvocation; |
| import org.jsecurity.authz.AuthorizationException; |
| |
| import java.util.ArrayList; |
| import java.util.Collection; |
| |
| /** |
| * An <tt>AnnotationsAuthorizingMethodInterceptor</tt> is a MethodInterceptor that asserts a given method is authorized |
| * to execute based on one or more configured <tt>AuthorizingAnnotationMethodInterceptor</tt>s. |
| * |
| * <p>This allows multiple annotations on a method to be processed before the method |
| * executes, and if any of the <tt>AuthorizingAnnotationMethodInterceptor</tt>s indicate that the method should not be |
| * executed, an <tt>AuthorizationException</tt> will be thrown, otherwise the method will be invoked as expected. |
| * |
| * <p>It is essentially a convenience mechanism to allow multiple annotations to be processed in a single method |
| * interceptor. |
| * |
| * @author Les Hazlewood |
| * @since 0.2 |
| */ |
| public abstract class AnnotationsAuthorizingMethodInterceptor extends AuthorizingMethodInterceptor { |
| |
| protected Collection<AuthorizingAnnotationMethodInterceptor> methodInterceptors = null; |
| |
| public void init() { |
| super.init(); |
| if ( methodInterceptors == null ) { |
| if ( log.isInfoEnabled() ) { |
| log.info( "No methodAuthorizers configured. " + |
| "Enabling default Role and Permission annotation support..." ); |
| } |
| methodInterceptors = new ArrayList<AuthorizingAnnotationMethodInterceptor>(2); |
| methodInterceptors.add( new RoleAnnotationMethodInterceptor( getSecurityManager() ) ); |
| methodInterceptors.add( new PermissionAnnotationMethodInterceptor( getSecurityManager() ) ); |
| } |
| |
| } |
| |
| public Collection<AuthorizingAnnotationMethodInterceptor> getMethodInterceptors() { |
| return methodInterceptors; |
| } |
| |
| public void setMethodInterceptors(Collection<AuthorizingAnnotationMethodInterceptor> methodInterceptors) { |
| this.methodInterceptors = methodInterceptors; |
| } |
| |
| protected void assertAuthorized(MethodInvocation methodInvocation) throws AuthorizationException { |
| //default implementation just ensures no deny votes are cast: |
| Collection<AuthorizingAnnotationMethodInterceptor> aamis = getMethodInterceptors(); |
| if ( aamis != null && !aamis.isEmpty() ) { |
| for( AuthorizingAnnotationMethodInterceptor aami : aamis ) { |
| aami.assertAuthorized( methodInvocation ); |
| } |
| } |
| } |
| } |