@PostFilter on Optional

Question

我想在返回Optional的方法上使用@PostFilter。

Spring DefaultMethodSecurityExpressionHandler目前不能处理Optional，但我可以做一个简单的装饰器，并将Optional转换为Stream。我如何在不创建新的GlobalMethodSecurityConfiguration的情况下注册这样的装饰器，因为我正在使用一个不能修改的内部框架。

有没有其他方法可以做到这一点？

Answer 1

解决方案非常简单，只需将装饰器声明为@Service

@Service
public class OptionalAdapterMethodSecurityExpressionHandler implements MethodSecurityExpressionHandler {

    private final MethodSecurityExpressionHandler handler

    public CustomMethodSecurityExpressionHandler(MethodSecurityExpressionHandler handler){
        this.handler = handler;
    }

    @Autowired
    public CustomMethodSecurityExpressionHandler(ApplicationContext applicationContext) {
        this(new DefaultMethodSecurityExpressionHandler());
        ((DefaultMethodSecurityExpressionHandler)this.original).setApplicationContext(applicationContext);
    }

    @Override
    public Object filter(Object filterTarget, Expression filterExpression, EvaluationContext ctx) {
        if (filterTarget instanceof Optional) {
            final List<?> optionalUnfilteredList = ((Optional<?>) filterTarget).stream()
                .collect(Collectors.toList());

            final List<?> optionalFilteredList = (List<?>) this.handler.filter(optionalUnfilteredList, filterExpression, ctx);
            return optionalFilteredList.stream()
                .findFirst();
        }
        return this.handler.filter(filterTarget, filterExpression, ctx);
    }
    
    ...
}

Answer 2

更简单的方法是这样：

import java.util.Collection;
import java.util.Optional;
import java.util.stream.Stream;

import org.springframework.expression.EvaluationContext;
import org.springframework.expression.Expression;
import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
import org.springframework.stereotype.Service;

@Service
public class AnyTypeMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler implements MethodSecurityExpressionHandler {
    @Override
    public Object filter(final Object filterTarget, final Expression filterExpression, final EvaluationContext ctx) {
        if (filterTarget instanceof Collection || filterTarget != null && filterTarget.getClass().isArray() || filterTarget instanceof Stream) {
            return super.filter(filterTarget, filterExpression, ctx);
        }
        if (filterTarget instanceof Optional) {
            return ((Stream<?>) super.filter(((Optional<?>) filterTarget).stream(), filterExpression, ctx)).findAny();
        }
        return ((Stream<?>) super.filter(Stream.ofNullable(filterTarget), filterExpression, ctx)).findAny().orElse(null);
    }
}

它将处理Java和普通的Optional对象(如果它们经过过滤，它们就会变成null )。