apache / apache/grails-core

Creating the Proxy fails if Grails-Service is in a plugin

Open
#15,928 2 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

In `AclAutoProxyCreator#afterPropertiesSet` a list of beanNames is collected from the service class names.

This list is later used to decide about creating a proxy for this bean in `getAdvicesAndAdvisorsForBean`.

The name matching fails for all services that are not declared directly in the project but in a grails plugin.
See `ServicesGrailsPlugin` line 62: If the service class is defined in a plugin then the plugin-name is prepended to the bean name.
Finally the names won't match. To me it looks like it could be corrected by employing the same logic as in the ServicesGrailsPlugin for the naming beans when creating the beanNames list.

In consequence of this problem annotations such as `@PreAuthorize` are just ignored on these services (depending on your code it can have an impact on application security).

In my particular use-case I'll refactor to not use annotations in the plugin, so I leave this github-issue here just as a hint for others.

Contributor guide

Open the contributing guide

Research direction

Start in AclAutoProxyCreator#afterPropertiesSet and getAdvicesAndAdvisorsForBean, then compare their bean-name handling with ServicesGrailsPlugin at line 62. Verify how plugin service names are constructed and ensure the collected names match them, so annotations such as @PreAuthorize are applied to plugin services.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.