Skip to content

Commit ffc9adf

Browse files
ngocnhan-tran1996ngocnhan-tran1996
committed
Add hasScope and hasAnyScope
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
1 parent 9126aaf commit ffc9adf

File tree

3 files changed

+236
-0
lines changed

3 files changed

+236
-0
lines changed

‎oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/authorization/DefaultOAuth2AuthorizationManagerFactory.java‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
* Copyright 2025-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.core.authorization;
18+
19+
import org.springframework.security.authorization.AuthorizationManager;
20+
import org.springframework.security.authorization.AuthorizationManagerFactory;
21+
import org.springframework.security.authorization.DefaultAuthorizationManagerFactory;
22+
import org.springframework.util.Assert;
23+
24+
/**
25+
* A factory for creating different kinds of {@link AuthorizationManager} instances.
26+
*
27+
* @param <T> the type of object that the authorization check is being done on
28+
* @author Ngoc Nhan
29+
* @since 7.0
30+
*/
31+
public final class DefaultOAuth2AuthorizationManagerFactory<T> implements OAuth2AuthorizationManagerFactory<T> {
32+
33+
private String scopePrefix = "SCOPE_";
34+
35+
private final AuthorizationManagerFactory<T> authorizationManagerFactory;
36+
37+
public DefaultOAuth2AuthorizationManagerFactory() {
38+
this(new DefaultAuthorizationManagerFactory<>());
39+
}
40+
41+
public DefaultOAuth2AuthorizationManagerFactory(AuthorizationManagerFactory<T> authorizationManagerFactory) {
42+
Assert.notNull(authorizationManagerFactory, "authorizationManagerFactory can not be null");
43+
this.authorizationManagerFactory = authorizationManagerFactory;
44+
}
45+
46+
/**
47+
* Sets the prefix used to create an authority name from a scope name. Can be an empty
48+
* string.
49+
* @param scopePrefix the scope prefix to use
50+
*/
51+
public void setScopePrefix(String scopePrefix) {
52+
Assert.notNull(scopePrefix, "scopePrefix can not be null");
53+
this.scopePrefix = scopePrefix;
54+
}
55+
56+
@Override
57+
public AuthorizationManager<T> hasScope(String scope) {
58+
Assert.notNull(scope, "scope can not be null");
59+
return hasAnyScope(scope);
60+
}
61+
62+
@Override
63+
public AuthorizationManager<T> hasAnyScope(String... scopes) {
64+
Assert.notNull(scopes, "scopes can not be null");
65+
String[] mappedScopes = new String[scopes.length];
66+
for (int i = 0; i < scopes.length; i++) {
67+
assertScope(scopes[i]);
68+
mappedScopes[i] = this.scopePrefix + scopes[i];
69+
}
70+
return this.authorizationManagerFactory.hasAnyAuthority(mappedScopes);
71+
}
72+
73+
private void assertScope(String scope) {
74+
Assert.isTrue(!scope.startsWith(this.scopePrefix), () -> scope + " should not start with '" + this.scopePrefix
75+
+ "' since '" + this.scopePrefix
76+
+ "' is automatically prepended when using hasScope and hasAnyScope. Consider using AuthorityAuthorizationManager#hasAuthority or #hasAnyAuthority instead.");
77+
}
78+
79+
}

‎oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/authorization/OAuth2AuthorizationManagerFactory.java‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright 2025-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.core.authorization;
18+
19+
import org.springframework.security.authorization.AuthorizationManager;
20+
import org.springframework.security.core.Authentication;
21+
22+
/**
23+
* A factory for creating different kinds of {@link AuthorizationManager} instances.
24+
*
25+
* @param <T> the type of object that the authorization check is being done on
26+
* @author Ngoc Nhan
27+
* @since 7.0
28+
*/
29+
public interface OAuth2AuthorizationManagerFactory<T> {
30+
31+
/**
32+
* Create an {@link AuthorizationManager} that requires an {@link Authentication} to
33+
* have a {@code SCOPE_scope} authority.
34+
*
35+
* <p>
36+
* For example, if you call {@code hasScope("read")}, then this will require that each
37+
* authentication have a {@link org.springframework.security.core.GrantedAuthority}
38+
* whose value is {@code SCOPE_read}.
39+
*
40+
* <p>
41+
* This would equivalent to calling
42+
* {@code AuthorityAuthorizationManager#hasAuthority("SCOPE_read")}.
43+
* @param scope the scope value to require
44+
* @return an {@link AuthorizationManager} that requires a {@code "SCOPE_scope"}
45+
* authority
46+
*/
47+
default AuthorizationManager<T> hasScope(String scope) {
48+
return OAuth2AuthorizationManagers.hasScope(scope);
49+
}
50+
51+
/**
52+
* Create an {@link AuthorizationManager} that requires an {@link Authentication} to
53+
* have at least one authority among {@code SCOPE_scope1}, {@code SCOPE_scope2}, ...
54+
* {@code SCOPE_scopeN}.
55+
*
56+
* <p>
57+
* For example, if you call {@code hasAnyScope("read", "write")}, then this will
58+
* require that each authentication have at least a
59+
* {@link org.springframework.security.core.GrantedAuthority} whose value is either
60+
* {@code SCOPE_read} or {@code SCOPE_write}.
61+
*
62+
* <p>
63+
* This would equivalent to calling
64+
* {@code AuthorityAuthorizationManager#hasAnyAuthority("SCOPE_read", "SCOPE_write")}.
65+
* @param scopes the scope values to allow
66+
* @return an {@link AuthorizationManager} that requires at least one authority among
67+
* {@code "SCOPE_scope1"}, {@code SCOPE_scope2}, ... {@code SCOPE_scopeN}.
68+
*/
69+
default AuthorizationManager<T> hasAnyScope(String... scopes) {
70+
return OAuth2AuthorizationManagers.hasAnyScope(scopes);
71+
}
72+
73+
}

‎oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/authorization/OAuth2AuthorizationManagerFactoryTests.java‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
/*
2+
* Copyright 2025-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.core.authorization;
18+
19+
import org.junit.jupiter.api.Test;
20+
21+
import org.springframework.security.authentication.TestingAuthenticationToken;
22+
import org.springframework.security.authorization.AuthorityAuthorizationManager;
23+
import org.springframework.security.authorization.AuthorizationManager;
24+
import org.springframework.security.authorization.AuthorizationManagerFactories;
25+
import org.springframework.security.authorization.AuthorizationResult;
26+
27+
import static org.assertj.core.api.Assertions.assertThat;
28+
29+
/**
30+
* Tests for {@link OAuth2AuthorizationManagerFactory}.
31+
*
32+
* @author Ngoc Nhan
33+
*/
34+
public class OAuth2AuthorizationManagerFactoryTests {
35+
36+
@Test
37+
public void hasScopeReturnsAuthorityAuthorizationManagerByDefault() {
38+
OAuth2AuthorizationManagerFactory<String> factory = new DefaultOAuth2AuthorizationManagerFactory<>();
39+
AuthorizationManager<String> authorizationManager = factory.hasScope("message:read");
40+
assertThat(authorizationManager).isInstanceOf(AuthorityAuthorizationManager.class);
41+
}
42+
43+
@Test
44+
public void hasAnyScopeReturnsAuthorityAuthorizationManagerByDefault() {
45+
OAuth2AuthorizationManagerFactory<String> factory = new DefaultOAuth2AuthorizationManagerFactory<>();
46+
AuthorizationManager<String> authorizationManager = factory.hasAnyScope("message:read", "message:write");
47+
assertThat(authorizationManager).isInstanceOf(AuthorityAuthorizationManager.class);
48+
}
49+
50+
@Test
51+
public void hasScopeWhenSetAuthorizationManagerFactories() {
52+
DefaultOAuth2AuthorizationManagerFactory<String> factory = new DefaultOAuth2AuthorizationManagerFactory<>(
53+
AuthorizationManagerFactories.<String>multiFactor().requireFactors("SCOPE_message:read").build());
54+
assertUserGranted(factory.hasScope("message:read"));
55+
assertUserDenied(factory.hasScope("message:write"));
56+
}
57+
58+
@Test
59+
public void hasAnyScopeWhenSetAuthorizationManagerFactories() {
60+
DefaultOAuth2AuthorizationManagerFactory<String> factory = new DefaultOAuth2AuthorizationManagerFactory<>(
61+
AuthorizationManagerFactories.<String>multiFactor().requireFactors("SCOPE_message:read").build());
62+
assertUserGranted(factory.hasAnyScope("message:read"));
63+
assertUserDenied(factory.hasAnyScope("message:write"));
64+
}
65+
66+
private void assertUserGranted(AuthorizationManager<String> manager) {
67+
AuthorizationResult authorizationResult = createAuthorizationResult(manager);
68+
assertThat(authorizationResult).isNotNull();
69+
assertThat(authorizationResult.isGranted()).isTrue();
70+
}
71+
72+
private void assertUserDenied(AuthorizationManager<String> manager) {
73+
AuthorizationResult authorizationResult = createAuthorizationResult(manager);
74+
assertThat(authorizationResult).isNotNull();
75+
assertThat(authorizationResult.isGranted()).isFalse();
76+
}
77+
78+
private AuthorizationResult createAuthorizationResult(AuthorizationManager<String> manager) {
79+
TestingAuthenticationToken authenticatedUser = new TestingAuthenticationToken("user", "pass",
80+
"SCOPE_message:read");
81+
return manager.authorize(() -> authenticatedUser, "");
82+
}
83+
84+
}

0 commit comments

Comments
 (0)