Package com.onec.ui
Class UiAccessService
java.lang.Object
com.onec.ui.UiAccessService
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionbooleancanRead(Principal principal, AccumulationRegisterDescriptor descriptor) booleancanRead(Principal principal, CatalogDescriptor descriptor) booleancanRead(Principal principal, DocumentDescriptor descriptor) booleancanRead(Principal principal, InformationRegisterDescriptor descriptor) booleanbooleancanWrite(Principal principal, AccumulationRegisterDescriptor descriptor) booleancanWrite(Principal principal, CatalogDescriptor descriptor) booleancanWrite(Principal principal, DocumentDescriptor descriptor) voidrequireRead(Principal principal, AccumulationRegisterDescriptor descriptor) voidrequireRead(Principal principal, CatalogDescriptor descriptor) voidrequireRead(Principal principal, DocumentDescriptor descriptor) voidrequireRead(Principal principal, InformationRegisterDescriptor descriptor) voidrequireWrite(Principal principal, CatalogDescriptor descriptor) voidrequireWrite(Principal principal, DocumentDescriptor descriptor) The normalized roles granted to the caller.
-
Constructor Details
-
UiAccessService
-
-
Method Details
-
canRead
-
canWrite
-
canRead
-
canWrite
-
canRead
-
canWrite
-
canRead
-
requireRead
-
requireWrite
-
requireRead
-
requireWrite
-
requireRead
-
requireRead
-
canRead
-
roles
The normalized roles granted to the caller. Authorities are read off the request'sAuthenticationreflectively, because this module deliberately does not depend on Spring Security — only its runtime presence.The
Principalthat Spring injects into a controller is not guaranteed to be the authority-bearingAuthentication: depending on the auth backend it can be a barePrincipal, aUserDetails/OidcUser, or otherwise expose no readablegetAuthorities(). When the injected principal yields nothing we fall back to the authenticated token held in theSecurityContext, which is the canonical source of authorities for the in-flight request. Without this fallback, write checks (the only callers ofrequireWrite) 403 even privileged users, includingADMIN. See issue #54.
-