Skip to content

Allow nullable objects in authorization managers#19315

Closed
qixiangme wants to merge 1 commit into
spring-projects:mainfrom
qixiangme:gh-17537-nullable-authorization-managers
Closed

Allow nullable objects in authorization managers#19315
qixiangme wants to merge 1 commit into
spring-projects:mainfrom
qixiangme:gh-17537-nullable-authorization-managers

Conversation

@qixiangme

Copy link
Copy Markdown

Several AuthorizationManager implementations and factory methods declared
plain <T> type parameters. Under package-level @NullMarked, JSpecify treats
a plain <T> as <T extends @NonNull Object>, so Kotlin callers could not use
these implementations as AuthorizationManager<Any?> or invoke them with a
null object, even though AuthorizationManager itself already declares
<T extends @Nullable Object> (gh-17667).

This adds <T extends @Nullable Object> bounds to the implementations and
factory methods that do not depend on a non-null authorization object:

  • AuthorityAuthorizationManager
  • AuthenticatedAuthorizationManager
  • SingleResultAuthorizationManager
  • AllAuthoritiesAuthorizationManager
  • RequiredAuthoritiesAuthorizationManager
  • AllRequiredFactorsAuthorizationManager
  • ConditionalAuthorizationManager
  • AuthorizationManagers
  • AuthorizationManagerFactories
  • OAuth2AuthorizationManagers

ObservationAuthorizationManager is intentionally left unchanged because it
passes the authorization object to AuthorizationObservationContext, whose
constructor requires a non-null value.

Closes gh-17537

Several AuthorizationManager implementations and factory methods
declared plain <T> type parameters. Under package-level @NullMarked,
JSpecify treats a plain <T> as <T extends @nonnull Object>, so Kotlin
callers could not use these implementations as
AuthorizationManager<Any?> or invoke them with a null object, even
though AuthorizationManager itself already declares
<T extends @nullable Object>.

Add <T extends @nullable Object> bounds to the implementations and
factory methods that do not depend on a non-null authorization object.
ObservationAuthorizationManager is intentionally left unchanged because
it passes the authorization object to AuthorizationObservationContext,
whose constructor requires a non-null value.

Closes gh-17537

Signed-off-by: Changmin Lee <erang903@khu.ac.kr>
@qixiangme qixiangme closed this by deleting the head repository Jun 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Revisit AuthorizationManager generics and nullability

1 participant