org.apache.shiro.authz.aop
Class AnnotationsAuthorizingMethodInterceptor

java.lang.Object
  org.apache.shiro.aop.MethodInterceptorSupport
      org.apache.shiro.authz.aop.AuthorizingMethodInterceptor
          org.apache.shiro.authz.aop.AnnotationsAuthorizingMethodInterceptor

All Implemented Interfaces:

MethodInterceptor

Direct Known Subclasses:

AopAllianceAnnotationsAuthorizingMethodInterceptor, AspectjAnnotationsAuthorizingMethodInterceptor

public abstract class AnnotationsAuthorizingMethodInterceptor
extends AuthorizingMethodInterceptor

An AnnotationsAuthorizingMethodInterceptor is a MethodInterceptor that asserts a given method is authorized to execute based on one or more configured AuthorizingAnnotationMethodInterceptors.

This allows multiple annotations on a method to be processed before the method executes, and if any of the AuthorizingAnnotationMethodInterceptors indicate that the method should not be executed, an AuthorizationException will be thrown, otherwise the method will be invoked as expected.

It is essentially a convenience mechanism to allow multiple annotations to be processed in a single method interceptor.

Since:

0.2

Field Summary

protected Collection<AuthorizingAnnotationMethodInterceptor>

methodInterceptors The method interceptors to execute for the annotated method.

Constructor Summary

AnnotationsAuthorizingMethodInterceptor()
Default no-argument constructor that defaults the methodInterceptors attribute to contain two interceptors by default - the RoleAnnotationMethodInterceptor and the PermissionAnnotationMethodInterceptor to support role and permission annotations.

Method Summary

protected void	assertAuthorized(MethodInvocation methodInvocation) Iterates over the internal methodInterceptors collection, and for each one, ensures that if the interceptor supports the invocation, that the interceptor asserts that the invocation is authorized to proceed.
Collection<AuthorizingAnnotationMethodInterceptor>	getMethodInterceptors() Returns the method interceptors to execute for the annotated method.
void	setMethodInterceptors(Collection<AuthorizingAnnotationMethodInterceptor> methodInterceptors) Sets the method interceptors to execute for the annotated method.

Methods inherited from class org.apache.shiro.authz.aop.AuthorizingMethodInterceptor

invoke

Methods inherited from class org.apache.shiro.aop.MethodInterceptorSupport

getSubject

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

methodInterceptors

protected Collection<AuthorizingAnnotationMethodInterceptor> methodInterceptors

The method interceptors to execute for the annotated method.

Constructor Detail

AnnotationsAuthorizingMethodInterceptor

public AnnotationsAuthorizingMethodInterceptor()

Default no-argument constructor that defaults the methodInterceptors attribute to contain two interceptors by default - the RoleAnnotationMethodInterceptor and the PermissionAnnotationMethodInterceptor to support role and permission annotations.

Method Detail

getMethodInterceptors

public Collection<AuthorizingAnnotationMethodInterceptor> getMethodInterceptors()

Returns the method interceptors to execute for the annotated method.

Unless overridden by the setMethodInterceptors(java.util.Collection) method, the default collection contains a RoleAnnotationMethodInterceptor and a PermissionAnnotationMethodInterceptor to support role and permission annotations automatically.

Returns:

the method interceptors to execute for the annotated method.

setMethodInterceptors

public void setMethodInterceptors(Collection<AuthorizingAnnotationMethodInterceptor> methodInterceptors)

Sets the method interceptors to execute for the annotated method.

Parameters:

methodInterceptors - the method interceptors to execute for the annotated method.

See Also:

getMethodInterceptors()

assertAuthorized

protected void assertAuthorized(MethodInvocation methodInvocation)
                         throws AuthorizationException

Iterates over the internal methodInterceptors collection, and for each one, ensures that if the interceptor supports the invocation, that the interceptor asserts that the invocation is authorized to proceed.

Specified by:

assertAuthorized in class AuthorizingMethodInterceptor

Parameters:

methodInvocation - the MethodInvocation to invoke.

Throws:

AuthorizationException - if the methodInvocation should not be allowed to continue/execute.