spring-projects / spring-projects/spring-security
No Type Safety with 'Object'
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Use Generics in the interface to set the type of the parameters rather than using the Object class.
Currently for PermissionEvaluator method
boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission)
Would or should become
interface PermissionEvaluator <S, TDO, P>
boolean hasPermission(Authentication authentication, S targetId , String targetType, P permission);
boolean hasPermission(Authentication authentication, TDO targetDomainObject, P permission);
This alleviates the need for casting and type un safety, by setting and knowing the types of data ahead of time.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the PermissionEvaluator interface and trace its implementations and call sites in Spring Security. Review how the current Object parameters are used and assess the impact of introducing generic parameters for target IDs, domain objects, and permissions. Done means the API provides the requested type safety and all affected usages remain consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100