diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityConfiguration.java index 6f3dd3859e..bfba8dbf8c 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityConfiguration.java @@ -141,7 +141,7 @@ final class MethodSecurityConfiguration implements ImportAware, InitializingBean if (jsr250Enabled()) { beforeAdvices.add(getJsr250AuthorizationMethodBeforeAdvice()); } - return new DelegatingAuthorizationMethodBeforeAdvice(beforeAdvices); + return new DelegatingAuthorizationMethodBeforeAdvice<>(beforeAdvices); } private PreFilterAuthorizationMethodBeforeAdvice getPreFilterAuthorizationMethodBeforeAdvice() { @@ -192,7 +192,7 @@ final class MethodSecurityConfiguration implements ImportAware, InitializingBean List> afterAdvices = new ArrayList<>(); afterAdvices.add(getPostFilterAuthorizationMethodAfterAdvice()); afterAdvices.add(getPostAuthorizeAuthorizationMethodAfterAdvice()); - return new DelegatingAuthorizationMethodAfterAdvice(afterAdvices); + return new DelegatingAuthorizationMethodAfterAdvice<>(afterAdvices); } private PostFilterAuthorizationMethodAfterAdvice getPostFilterAuthorizationMethodAfterAdvice() { diff --git a/core/src/main/java/org/springframework/security/authorization/method/AfterMethodAuthorizationManager.java b/core/src/main/java/org/springframework/security/authorization/method/AfterMethodAuthorizationManager.java new file mode 100644 index 0000000000..420c635ba1 --- /dev/null +++ b/core/src/main/java/org/springframework/security/authorization/method/AfterMethodAuthorizationManager.java @@ -0,0 +1,65 @@ +/* + * Copyright 2002-2021 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.authorization.method; + +import java.util.function.Supplier; + +import org.aopalliance.intercept.MethodInvocation; + +import org.springframework.lang.Nullable; +import org.springframework.security.access.AccessDeniedException; +import org.springframework.security.authorization.AuthorizationDecision; +import org.springframework.security.core.Authentication; + +/** + * An Authorization manager which can determine if an {@link Authentication} has access to + * a specific object and associated return object. Intended for use specifically to + * evaluate the returning state of a method invocation. + * + * @param the type of object that the authorization check is being done one. + * @author Josh Cummings + * @author Evgeniy Cheban + * @since 5.5 + */ +public interface AfterMethodAuthorizationManager { + + /** + * Determines if access should be granted for a specific authentication and + * returnedObject. + * @param authentication the {@link Supplier} of the {@link Authentication} to check + * @param object the {@code T} object to check, typically a {@link MethodInvocation} + * @param returnedObject the returnedObject from the method invocation to check + * @throws AccessDeniedException if access is not granted + */ + default void verify(Supplier authentication, T object, Object returnedObject) { + AuthorizationDecision decision = check(authentication, object, returnedObject); + if (decision != null && !decision.isGranted()) { + throw new AccessDeniedException("Access Denied"); + } + } + + /** + * Determines if access is granted for a specific authentication and returnedObject. + * @param authentication the {@link Supplier} of the {@link Authentication} to check + * @param object the {@code T} object to check, typically a {@link MethodInvocation} + * @param returnedObject the returned object from the method invocation to check + * @return an {@link AuthorizationDecision} or null if no decision could be made + */ + @Nullable + AuthorizationDecision check(Supplier authentication, T object, Object returnedObject); + +} diff --git a/core/src/main/java/org/springframework/security/authorization/method/AfterMethodAuthorizationManagerAdapter.java b/core/src/main/java/org/springframework/security/authorization/method/AfterMethodAuthorizationManagerAdapter.java new file mode 100644 index 0000000000..00df11da6f --- /dev/null +++ b/core/src/main/java/org/springframework/security/authorization/method/AfterMethodAuthorizationManagerAdapter.java @@ -0,0 +1,62 @@ +/* + * Copyright 2002-2021 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.authorization.method; + +import java.util.function.Supplier; + +import org.aopalliance.intercept.MethodInvocation; + +import org.springframework.security.authorization.AuthorizationDecision; +import org.springframework.security.authorization.AuthorizationManager; +import org.springframework.security.core.Authentication; + +/** + * Adapts an {@link AuthorizationManager} into an {@link AfterMethodAuthorizationManager} + * + * @param the {@code T} object to authorize, typically a {@link MethodInvocation} + * @author Josh Cummings + * @since 5.5 + */ +public final class AfterMethodAuthorizationManagerAdapter implements AfterMethodAuthorizationManager { + + private final AuthorizationManager authorizationManager; + + /** + * Construct a {@link AfterMethodAuthorizationManagerAdapter} with the provided + * parameters + * @param authorizationManager the {@link AuthorizationManager} to adapt + */ + public AfterMethodAuthorizationManagerAdapter(AuthorizationManager authorizationManager) { + this.authorizationManager = authorizationManager; + } + + /** + * Determine if access is granted for a specific authentication and {@code T} object. + * + * Note that the {@code returnedObject} parameter is ignored + * @param authentication the {@link Supplier} of the {@link Authentication} to check + * @param object the {@code T} object to check, typically a {@link MethodInvocation} + * @param returnedObject the returned object from the method invocation, ignored in + * this implementation + * @return an {@link AuthorizationDecision} or null if no decision could be made + */ + @Override + public AuthorizationDecision check(Supplier authentication, T object, Object returnedObject) { + return this.authorizationManager.check(authentication, object); + } + +} diff --git a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdvice.java b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdvice.java index 257f3fc8eb..5442d49d15 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdvice.java +++ b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdvice.java @@ -39,14 +39,15 @@ public final class AuthorizationManagerMethodAfterAdvice implements Authoriza private final Pointcut pointcut; - private final AuthorizationManager authorizationManager; + private final AfterMethodAuthorizationManager authorizationManager; /** * Creates an instance. * @param pointcut the {@link Pointcut} to use * @param authorizationManager the {@link AuthorizationManager} to use */ - public AuthorizationManagerMethodAfterAdvice(Pointcut pointcut, AuthorizationManager authorizationManager) { + public AuthorizationManagerMethodAfterAdvice(Pointcut pointcut, + AfterMethodAuthorizationManager authorizationManager) { Assert.notNull(pointcut, "pointcut cannot be null"); Assert.notNull(authorizationManager, "authorizationManager cannot be null"); this.pointcut = pointcut; @@ -57,13 +58,14 @@ public final class AuthorizationManagerMethodAfterAdvice implements Authoriza * Determines if an {@link Authentication} has access to the {@link T} object using * the {@link AuthorizationManager}. * @param authentication the {@link Supplier} of the {@link Authentication} to check - * @param object the {@link T} object to check + * @param object the {@link T} object to check - note that {@code T} should contain + * the returned object * @throws AccessDeniedException if access is not granted */ @Override - public Object after(Supplier authentication, T object, Object returnedObject) { - this.authorizationManager.verify(authentication, object); - return returnedObject; + public Object after(Supplier authentication, T context, Object object) { + this.authorizationManager.verify(authentication, context, object); + return object; } /** diff --git a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationMethodAfterAdvice.java b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationMethodAfterAdvice.java index 705005be78..f059bdef84 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationMethodAfterAdvice.java +++ b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationMethodAfterAdvice.java @@ -27,9 +27,9 @@ import org.springframework.aop.framework.AopInfrastructureBean; import org.springframework.security.core.Authentication; /** - * An {@link Advice} which can determine if an {@link Authentication} has - * access to the returned object from the {@link MethodInvocation}. {@link #getPointcut()} - * describes when the advice applies for the method. + * An {@link Advice} which can determine if an {@link Authentication} has access to the + * returned object from the {@link MethodInvocation}. {@link #getPointcut()} describes + * when the advice applies for the method. * * @param the type of object that the authorization check is being done one. * @author Evgeniy Cheban diff --git a/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodAfterAdvice.java b/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodAfterAdvice.java index 7ab8b89c1a..cf978c9bca 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodAfterAdvice.java +++ b/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodAfterAdvice.java @@ -38,21 +38,19 @@ import org.springframework.util.Assert; * @author Josh Cummings * @since 5.5 */ -public final class DelegatingAuthorizationMethodAfterAdvice - implements AuthorizationMethodAfterAdvice { +public final class DelegatingAuthorizationMethodAfterAdvice implements AuthorizationMethodAfterAdvice { private final Log logger = LogFactory.getLog(getClass()); private final Pointcut pointcut; - private final List> delegates; + private final List> delegates; /** * Creates an instance. * @param delegates the {@link AuthorizationMethodAfterAdvice}s to use */ - public DelegatingAuthorizationMethodAfterAdvice( - List> delegates) { + public DelegatingAuthorizationMethodAfterAdvice(List> delegates) { Assert.notEmpty(delegates, "delegates cannot be empty"); this.delegates = delegates; ComposablePointcut pointcut = null; @@ -79,26 +77,24 @@ public final class DelegatingAuthorizationMethodAfterAdvice * Delegates to specific {@link AuthorizationMethodAfterAdvice}s and returns the * returnedObject (possibly modified) from the method argument. * @param authentication the {@link Supplier} of the {@link Authentication} to check - * @param methodAuthorizationContext the {@link MethodAuthorizationContext} to check + * @param object the {@link MethodAuthorizationContext} to check * @param returnedObject the returned object from the {@link MethodInvocation} to * check * @return the returnedObject (possibly modified) from the method * argument */ @Override - public Object after(Supplier authentication, MethodAuthorizationContext methodAuthorizationContext, - Object returnedObject) { + public Object after(Supplier authentication, T object, Object returnedObject) { if (this.logger.isTraceEnabled()) { - this.logger.trace( - LogMessage.format("Post Authorizing %s from %s", returnedObject, methodAuthorizationContext)); + this.logger.trace(LogMessage.format("Post Authorizing %s from %s", returnedObject, object)); } Object result = returnedObject; - for (AuthorizationMethodAfterAdvice delegate : this.delegates) { + for (AuthorizationMethodAfterAdvice delegate : this.delegates) { if (this.logger.isTraceEnabled()) { - this.logger.trace(LogMessage.format("Checking authorization on %s from %s using %s", result, - methodAuthorizationContext, delegate)); + this.logger.trace( + LogMessage.format("Checking authorization on %s from %s using %s", result, object, delegate)); } - result = delegate.after(authentication, methodAuthorizationContext, result); + result = delegate.after(authentication, object, result); } return result; } diff --git a/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodBeforeAdvice.java b/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodBeforeAdvice.java index a2276d6e8e..395047defa 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodBeforeAdvice.java +++ b/core/src/main/java/org/springframework/security/authorization/method/DelegatingAuthorizationMethodBeforeAdvice.java @@ -38,21 +38,19 @@ import org.springframework.util.Assert; * @author Josh Cummings * @since 5.5 */ -public final class DelegatingAuthorizationMethodBeforeAdvice - implements AuthorizationMethodBeforeAdvice { +public final class DelegatingAuthorizationMethodBeforeAdvice implements AuthorizationMethodBeforeAdvice { private final Log logger = LogFactory.getLog(getClass()); private final Pointcut pointcut; - private final List> delegates; + private final List> delegates; /** * Creates an instance. * @param delegates the {@link AuthorizationMethodBeforeAdvice}s to use */ - public DelegatingAuthorizationMethodBeforeAdvice( - List> delegates) { + public DelegatingAuthorizationMethodBeforeAdvice(List> delegates) { Assert.notEmpty(delegates, "delegates cannot be empty"); this.delegates = delegates; ComposablePointcut pointcut = null; @@ -80,19 +78,18 @@ public final class DelegatingAuthorizationMethodBeforeAdvice * if all {@link AuthorizationMethodBeforeAdvice}s granted or abstained. Denies only * if one of the {@link AuthorizationMethodBeforeAdvice}s denied. * @param authentication the {@link Supplier} of the {@link Authentication} to check - * @param methodAuthorizationContext the {@link MethodAuthorizationContext} to check + * @param object the {@link MethodAuthorizationContext} to check */ @Override - public void before(Supplier authentication, MethodAuthorizationContext methodAuthorizationContext) { + public void before(Supplier authentication, T object) { if (this.logger.isTraceEnabled()) { - this.logger.trace(LogMessage.format("Pre Authorizing %s", methodAuthorizationContext)); + this.logger.trace(LogMessage.format("Pre Authorizing %s", object)); } - for (AuthorizationMethodBeforeAdvice delegate : this.delegates) { + for (AuthorizationMethodBeforeAdvice delegate : this.delegates) { if (this.logger.isTraceEnabled()) { - this.logger.trace(LogMessage.format("Checking authorization on %s using %s", methodAuthorizationContext, - delegate)); + this.logger.trace(LogMessage.format("Checking authorization on %s using %s", object, delegate)); } - delegate.before(authentication, methodAuthorizationContext); + delegate.before(authentication, object); } } diff --git a/core/src/main/java/org/springframework/security/authorization/method/MethodAuthorizationContext.java b/core/src/main/java/org/springframework/security/authorization/method/MethodAuthorizationContext.java index a73b0f0846..94f5277761 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/MethodAuthorizationContext.java +++ b/core/src/main/java/org/springframework/security/authorization/method/MethodAuthorizationContext.java @@ -31,8 +31,6 @@ public final class MethodAuthorizationContext { private final Class targetClass; - private Object returnObject; - /** * Creates an instance. * @param methodInvocation the {@link MethodInvocation} to use @@ -59,26 +57,10 @@ public final class MethodAuthorizationContext { return this.targetClass; } - /** - * Returns the returned object from the {@link MethodInvocation}. - * @return the returned object from the {@link MethodInvocation} to use - */ - public Object getReturnObject() { - return this.returnObject; - } - - /** - * Sets the returned object from the {@link MethodInvocation}. - * @param returnObject the returned object from the {@link MethodInvocation} to use - */ - public void setReturnObject(Object returnObject) { - this.returnObject = returnObject; - } - @Override public String toString() { return "MethodAuthorizationContext[methodInvocation=" + this.methodInvocation + ", targetClass=" - + this.targetClass + ", returnObject=" + this.returnObject + ']'; + + this.targetClass + ']'; } } diff --git a/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManager.java b/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManager.java index 9a594288d3..57449b6e1c 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManager.java +++ b/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManager.java @@ -43,7 +43,8 @@ import org.springframework.util.Assert; * @author Evgeniy Cheban * @since 5.5 */ -public final class PostAuthorizeAuthorizationManager implements AuthorizationManager { +public final class PostAuthorizeAuthorizationManager + implements AfterMethodAuthorizationManager { private final PostAuthorizeExpressionAttributeRegistry registry = new PostAuthorizeExpressionAttributeRegistry(); @@ -68,14 +69,14 @@ public final class PostAuthorizeAuthorizationManager implements AuthorizationMan */ @Override public AuthorizationDecision check(Supplier authentication, - MethodAuthorizationContext methodAuthorizationContext) { + MethodAuthorizationContext methodAuthorizationContext, Object returnedObject) { ExpressionAttribute attribute = this.registry.getAttribute(methodAuthorizationContext); if (attribute == ExpressionAttribute.NULL_ATTRIBUTE) { return null; } EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication.get(), methodAuthorizationContext.getMethodInvocation()); - this.expressionHandler.setReturnObject(methodAuthorizationContext.getReturnObject(), ctx); + this.expressionHandler.setReturnObject(returnedObject, ctx); boolean granted = ExpressionUtils.evaluateAsBoolean(attribute.getExpression(), ctx); return new AuthorizationDecision(granted); } diff --git a/core/src/main/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodAfterAdvice.java b/core/src/main/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodAfterAdvice.java index 9798536ec2..0844da6763 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodAfterAdvice.java +++ b/core/src/main/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodAfterAdvice.java @@ -82,7 +82,6 @@ public final class PostFilterAuthorizationMethodAfterAdvice * evaluating an expression from the {@link PostFilter} annotation. * @param authentication the {@link Supplier} of the {@link Authentication} to check * @param methodAuthorizationContext the {@link MethodAuthorizationContext} to check - * @param returnedObject the returned object from the {@link MethodInvocation} to * check * @return filtered returnedObject from the {@link MethodInvocation} */ @@ -98,9 +97,7 @@ public final class PostFilterAuthorizationMethodAfterAdvice } EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication.get(), methodAuthorizationContext.getMethodInvocation()); - Object result = this.expressionHandler.filter(returnedObject, attribute.getExpression(), ctx); - methodAuthorizationContext.setReturnObject(result); - return result; + return this.expressionHandler.filter(returnedObject, attribute.getExpression(), ctx); } private final class PostFilterExpressionAttributeRegistry diff --git a/core/src/test/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdviceTests.java b/core/src/test/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdviceTests.java index a407fcf85e..8764cfb1ba 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdviceTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/AuthorizationManagerMethodAfterAdviceTests.java @@ -23,7 +23,6 @@ import org.junit.Test; import org.springframework.aop.Pointcut; import org.springframework.security.authentication.TestAuthentication; -import org.springframework.security.authorization.AuthorizationManager; import org.springframework.security.core.Authentication; import static org.assertj.core.api.Assertions.assertThat; @@ -40,8 +39,10 @@ public class AuthorizationManagerMethodAfterAdviceTests { @Test public void instantiateWhenMethodMatcherNullThenException() { + AfterMethodAuthorizationManager mockAuthorizationManager = mock( + AfterMethodAuthorizationManager.class); assertThatIllegalArgumentException() - .isThrownBy(() -> new AuthorizationManagerMethodAfterAdvice<>(null, mock(AuthorizationManager.class))) + .isThrownBy(() -> new AuthorizationManagerMethodAfterAdvice<>(null, mockAuthorizationManager)) .withMessage("pointcut cannot be null"); } @@ -57,12 +58,13 @@ public class AuthorizationManagerMethodAfterAdviceTests { Supplier authentication = TestAuthentication::authenticatedUser; MethodInvocation mockMethodInvocation = mock(MethodInvocation.class); Object returnedObject = new Object(); - AuthorizationManager mockAuthorizationManager = mock(AuthorizationManager.class); + AfterMethodAuthorizationManager mockAuthorizationManager = mock( + AfterMethodAuthorizationManager.class); AuthorizationManagerMethodAfterAdvice advice = new AuthorizationManagerMethodAfterAdvice<>( mock(Pointcut.class), mockAuthorizationManager); Object result = advice.after(authentication, mockMethodInvocation, returnedObject); assertThat(result).isEqualTo(returnedObject); - verify(mockAuthorizationManager).verify(authentication, mockMethodInvocation); + verify(mockAuthorizationManager).verify(authentication, mockMethodInvocation, returnedObject); } } diff --git a/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java b/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java index 3da8219285..c9e589fbfe 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java @@ -62,7 +62,7 @@ public class PostAuthorizeAuthorizationManagerTests { TestClass.class); PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager(); AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, - methodAuthorizationContext); + methodAuthorizationContext, null); assertThat(decision).isNull(); } @@ -74,7 +74,7 @@ public class PostAuthorizeAuthorizationManagerTests { TestClass.class); PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager(); AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, - methodAuthorizationContext); + methodAuthorizationContext, null); assertThat(decision).isNotNull(); assertThat(decision.isGranted()).isTrue(); } @@ -87,7 +87,7 @@ public class PostAuthorizeAuthorizationManagerTests { TestClass.class); PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager(); AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, - methodAuthorizationContext); + methodAuthorizationContext, null); assertThat(decision).isNotNull(); assertThat(decision.isGranted()).isFalse(); } @@ -99,10 +99,9 @@ public class PostAuthorizeAuthorizationManagerTests { "doSomethingList", new Class[] { List.class }, new Object[] { list }); MethodAuthorizationContext methodAuthorizationContext = new MethodAuthorizationContext(mockMethodInvocation, TestClass.class); - methodAuthorizationContext.setReturnObject(list); PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager(); AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, - methodAuthorizationContext); + methodAuthorizationContext, list); assertThat(decision).isNotNull(); assertThat(decision.isGranted()).isTrue(); } @@ -114,10 +113,9 @@ public class PostAuthorizeAuthorizationManagerTests { "doSomethingList", new Class[] { List.class }, new Object[] { list }); MethodAuthorizationContext methodAuthorizationContext = new MethodAuthorizationContext(mockMethodInvocation, TestClass.class); - methodAuthorizationContext.setReturnObject(list); PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager(); AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, - methodAuthorizationContext); + methodAuthorizationContext, list); assertThat(decision).isNotNull(); assertThat(decision.isGranted()).isFalse(); }