Make RequestMatcherDelegatingAuthorizationManager post-processable

[codeconsole]

Fix extensibility issue since RequestMatcherDelegatingAuthorizationManager is final and does not expose any public methods other than what is available through AuthorizationManager. Fixes #15948

Allows the following:

http.authorizeHttpRequests((authorize) -> authorize
    .requestMatchers("/assets/**", "/logout").permitAll()
    .anyRequest().permitAll().withObjectPostProcessor(new ObjectPostProcessor<AuthorizationManager<HttpServletRequest>>() {
        @Override
         public <O extends AuthorizationManager<HttpServletRequest>> O postProcess(O object) {
            return (O) new WrappedRequestMatcherDelegatingAuthorizationManager(context, object);
        }
    })
);

which opens up the possibility to provide additional security checks such as Controller annotations by wrapping the current manager and using the outcome of is authorization check to be compared against other checks.

This works similar to what is already possible with the ObjectPostProcessor for AuthorizationFilter except unlike RequestMatcherDelegatingAuthorizationManager, AuthorizationFilter is not final and can be extended.

There is no benefit in post processing a final class that doesn't not expose any additional information that is not already provided by it's interface AuthorizationManager

Alternatively, you could just remove final from

spring-security/web/src/main/java/org/springframework/security/web/access/intercept/RequestMatcherDelegatingAuthorizationManager.java

Line 49 in 8a97291

public final class RequestMatcherDelegatingAuthorizationManager implements AuthorizationManager<HttpServletRequest> {

but either solution works.

[jzheaux]

Thanks, @codeconsole! Will you please also add a unit test in AuthorizeHttpRequestsConfigurer that confirms the behavior works?

And when you push your update, it will help if you can change your commit to something more like this:

Make RequestMatcherDelegatingAuthorizationManager Post-Processable

Closes gh-15978

It improves readability in the git history to have a short title. The Closes line makes sure our GitHub integration creates tickets for the other supported branches when this is merged.

[codeconsole]

@jzheaux Thanks for the feedback. I have changed the commit message and added the test.

I also published a snapshot locally and confirmed it works as expected with my application and that I am able to perform the behavior that I needed it to do.

This 1 little change allows me to delete 462 lines of code so I will be excited to see it merged. 😄

[codeconsole]

@jzheaux The version of main I was based on was failing so I synced up and force pushed off of the latest main to make sure all the tests passed. I hope that didn't cause any issues?

[jzheaux]

It didn't cause any issues, @codeconsole, thanks for checking. I moved the PR to be based off of 6.2.x so that we can forward port from there. Also, I accidentally gave you the wrong ticket number to place in the commit, so I just fixed it myself rather than have you re-do it.

[jzheaux]

Thanks, @codeconsole! This is now merged into 6.2.x, 6.3.x, and main.