From 0b4d326b764fc394bc2043cd8155bea891b61409 Mon Sep 17 00:00:00 2001 From: skdas20 Date: Thu, 27 Aug 2026 15:44:03 +0000 Subject: [PATCH] Fix Authorization Granted Events sample The sample under "Authorization Granted Events" did not compile. It called a no-arg SpringAuthorizationEventPublisher constructor, but the only constructor takes an ApplicationEventPublisher, and it called setShouldPublishEvent, which is named setShouldPublishResult. The Kotlin sample had three further problems: it destructured the lambda parameter as (result), it referenced an undefined "decision" rather than the parameter, and it used bare returns inside a lambda. The surrounding prose also promised something the class does not do. SpringAuthorizationEventPublisher documents itself as publishing only AuthorizationDeniedEvents, and publishAuthorizationEvent only ever constructs one, so a predicate returning true for a granted result publishes an AuthorizationDeniedEvent carrying a granted result rather than an AuthorizationGrantedEvent. Describe the predicate as selecting which denials are published. Closes gh-19584 Signed-off-by: skdas20 --- .../pages/servlet/authorization/events.adoc | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/modules/ROOT/pages/servlet/authorization/events.adoc b/docs/modules/ROOT/pages/servlet/authorization/events.adoc index 2d25965626c..627005d7833 100644 --- a/docs/modules/ROOT/pages/servlet/authorization/events.adoc +++ b/docs/modules/ROOT/pages/servlet/authorization/events.adoc @@ -74,8 +74,8 @@ Because ``AuthorizationGrantedEvent``s have the potential to be quite noisy, the In fact, publishing these events will likely require some business logic on your part to ensure that your application is not inundated with noisy authorization events. -You can provide your own predicate that filters success events. -For example, the following publisher only publishes authorization grants where `ROLE_ADMIN` was required: +`SpringAuthorizationEventPublisher` publishes only ``AuthorizationDeniedEvent``s, so the predicate you give it decides which denials are published rather than adding grants. +For example, the following publisher skips denials that did not require `ROLE_ADMIN`: [tabs] ====== @@ -84,11 +84,11 @@ Java:: [source,java,role="primary"] ---- @Bean -AuthorizationEventPublisher authorizationEventPublisher() { - SpringAuthorizationEventPublisher eventPublisher = new SpringAuthorizationEventPublisher(); - eventPublisher.setShouldPublishEvent((result) -> { - if (!result.isGranted()) { - return true; +AuthorizationEventPublisher authorizationEventPublisher(ApplicationEventPublisher applicationEventPublisher) { + SpringAuthorizationEventPublisher eventPublisher = new SpringAuthorizationEventPublisher(applicationEventPublisher); + eventPublisher.setShouldPublishResult((result) -> { + if (result.isGranted()) { + return false; } if (result instanceof AuthorityAuthorizationDecision decision) { Collection authorities = decision.getAuthorities(); @@ -105,17 +105,17 @@ Kotlin:: [source,kotlin,role="secondary"] ---- @Bean -fun authorizationEventPublisher(): AuthorizationEventPublisher { - val eventPublisher = SpringAuthorizationEventPublisher() - eventPublisher.setShouldPublishEvent { (result) -> - if (!result.isGranted()) { - return true +fun authorizationEventPublisher(applicationEventPublisher: ApplicationEventPublisher): AuthorizationEventPublisher { + val eventPublisher = SpringAuthorizationEventPublisher(applicationEventPublisher) + eventPublisher.setShouldPublishResult { result -> + if (result.isGranted) { + return@setShouldPublishResult false } - if (decision is AuthorityAuthorizationDecision) { - val authorities = decision.getAuthorities() - return AuthorityUtils.authorityListToSet(authorities).contains("ROLE_ADMIN") + if (result is AuthorityAuthorizationDecision) { + val authorities = result.authorities + return@setShouldPublishResult AuthorityUtils.authorityListToSet(authorities).contains("ROLE_ADMIN") } - return false + false } return eventPublisher }