Java AccessDeniedException類代碼示例

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@AroundInvoke
public Object authorizeBasedOnAuthentication(InvocationContext ctx) throws Exception {
    Set<SecurityViolation> violations = new HashSet<SecurityViolation>();
    if (!identity.isLoggedIn()) {
        final String msg = secMessage.notAuthenticated();
        violations.add(new SecurityViolation() {
            @Override
            public String getReason() {
                return msg;
            }
        });
        event.fire(new ExceptionToCatchEvent(new AccessDeniedException(violations)));
    }

    return ctx.proceed();
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
protected void invokeAfterMethodInvocationAuthorizers(InvocationContext invocationContext,
    Set<Authorizer> authorizers, Object result) throws IllegalAccessException
{
    try
    {
        for (Authorizer authorizer : authorizers)
        {
            if (authorizer.isAfterMethodInvocationAuthorizer())
            {
                authorizer.authorize(invocationContext, result, this.beanManager);
            }
        }
    }
    catch (AccessDeniedException e)
    {
        RuntimeException exceptionToThrow = handleAccessDeniedException(e);
        if (exceptionToThrow != null)
        {
            throw exceptionToThrow;
        }
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
public void broadcastAccessDeniedException(AccessDeniedException accessDeniedException)
{
    ExceptionToCatchEvent exceptionToCatchEvent = new ExceptionToCatchEvent(accessDeniedException);

    try
    {
        this.beanManager.fireEvent(exceptionToCatchEvent);
    }
    catch (AccessDeniedException e)
    {
        throw new SkipInternalProcessingException(accessDeniedException);
    }
    //we have to throw it in any case to support "observers" for AccessDeniedException (see DELTASPIKE-636)
    //however, currently we can't do it based on the exception-control api (see DELTASPIKE-638)
    throw new SkipInternalProcessingException(accessDeniedException);
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
public Throwable broadcastAccessDeniedException(AccessDeniedException accessDeniedException)
{
    ExceptionToCatchEvent exceptionToCatchEvent = new ExceptionToCatchEvent(accessDeniedException);

    try
    {
        this.beanManager.fireEvent(exceptionToCatchEvent);
    }
    catch (AccessDeniedException e)
    {
        //intentionally ignore the exception per default, since we just notify the handlers
        //(like in the other cases with AccessDeniedException)
        //that's different from the normal exception-control handling
        return null;
    }
    return null;
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
private static void processApplicationSecurityException(AccessDeniedException exception,
                                                        Class<? extends ViewConfig> errorView,
                                                        boolean allowNavigation)
{
    SecurityViolationHandler securityViolationHandler =
            BeanProvider.getContextualReference(SecurityViolationHandler.class, true);

    if (securityViolationHandler != null)
    {
        //optional (custom handler) - allows to handle custom implementations of SecurityViolation
        securityViolationHandler.processSecurityViolations(exception.getViolations());
    }
    else
    {
        addViolationsAsMessage(exception.getViolations());
    }

    if (allowNavigation)
    {
        BeanProvider.getContextualReference(ViewNavigationHandler.class).navigateTo(errorView);
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@AroundInvoke
public Object authorizeBasedOnRoles(InvocationContext ctx) throws Exception {
    Roles roles = ctx.getMethod().getAnnotation(Roles.class);

    Set<SecurityViolation> result = new HashSet<SecurityViolation>();
    boolean ok = !roles.anyRole();
    for (PersonRole r : roles.value()) {
        if (!identity.getUserContext().hasRole(r.toString())) {
            if (!roles.anyRole()) {
                ok = false;
                break;
            }
        } else {
            if (roles.anyRole()) {
                ok = true;
                break;
            }
        }
    }
    logger.debug("Validation OK: " + ok);
    if (!ok) {
        final String msg = secMessage.roleMissing();
        result.add(new SecurityViolation() {
            @Override
            public String getReason() {
                return msg;
            }
        });
        event.fire(new ExceptionToCatchEvent(new AccessDeniedException(result)));
    }

    return ctx.proceed();
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
public void onAccessDenied(@Handles ExceptionEvent<AccessDeniedException> event) {
    log.logAccessDenied(event.getException());

    this.facesContext.getExternalContext().getSessionMap()
            .put(ERROR_MESSAGE, webMessage.accessDenied(getReasons(event.getException())));
    event.handledAndContinue();
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
private String getReasons(AccessDeniedException ex) {
    StringBuilder sb = new StringBuilder("<br/>");

    for (SecurityViolation sv : ex.getViolations()) {
        sb.append(sv.getReason()).append("<br/>");
    }
    return sb.toString();
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
void authorize(final InvocationContext ic, final Object returnValue, BeanManager beanManager)
    throws IllegalAccessException, IllegalArgumentException
{
    if (boundAuthorizerBean == null)
    {
        lazyInitTargetBean(beanManager);
    }

    final CreationalContext<?> creationalContext = beanManager.createCreationalContext(boundAuthorizerBean);

    Object reference = beanManager.getReference(boundAuthorizerBean,
        boundAuthorizerMethod.getJavaMember().getDeclaringClass(), creationalContext);

    Object result = boundAuthorizerMethodProxy.invoke(reference, creationalContext,
            new SecurityParameterValueRedefiner(creationalContext, ic, returnValue));

    if (Boolean.FALSE.equals(result))
    {
        Set<SecurityViolation> violations = new HashSet<SecurityViolation>();
        violations.add(new SecurityViolation()
        {
            private static final long serialVersionUID = 2358753444038521129L;

            @Override
            public String getReason()
            {
                return "Authorization check failed";
            }
        });

        throw new AccessDeniedException(violations);
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@Test
public void simpleInterceptorTestDenied()
{
    SecuredBean1 testBean = BeanProvider.getContextualReference(SecuredBean1.class, false);
    try {
        testBean.getBlockedResult();
        Assert.fail();
    } catch (AccessDeniedException e) {
        //expected
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@Test
public void simpleInterceptorTestParentDenied()
{
    SecuredBean1 testBean = BeanProvider.getContextualReference(SecuredBean1.class, false);
    try {
        testBean.someBlockedMethodFromParent();
        Assert.fail();
    } catch (AccessDeniedException e) {
        //expected
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@Test
public void simpleInterceptorTestOnMethodsDenied()
{
    SecuredBean2 testBean = BeanProvider.getContextualReference(SecuredBean2.class, false);
    try {
        testBean.getBlockedResult();
    } catch (AccessDeniedException e) {
        //expected
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@Test
public void simpleInterceptorThrowsExceptionWhenImproperlyAnnotated()
{
    try
    {
        SecuredBean1 testBean = BeanProvider.getContextualReference(SecuredBean1.class, false);
        testBean.getResult(new MockObject2(false));
        Assert.fail("Expected exception, IllegalStateException was not thrown");
    }
    catch (AccessDeniedException e)
    {
        // expected exception
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@Test
public void afterInvocationAuthorizerCheckWithDeniedResult()
{
    try
    {
    	SecuredBean1 testBean = BeanProvider.getContextualReference(SecuredBean1.class, false);
    	testBean.getResult(false);
        Assert.fail("AccessDeniedException expect, but was not thrown");
    }
    catch (AccessDeniedException e)
    {
        // expected
    }
}
 

import org.apache.deltaspike.security.api.authorization.AccessDeniedException; //導入依賴的package包/類
@Test
public void afterInvocationAuthorizerWithoutReturnType()
{
    MethodInvocationParameter parameter = new MethodInvocationParameter();
    try
    {
        SecuredBean2 testBean = BeanProvider.getContextualReference(SecuredBean2.class, false);
        testBean.securityCheckAfterMethodInvocation(parameter);
        Assert.fail("AccessDeniedException expect, but was not thrown");
    }
    catch (AccessDeniedException e)
    {
        Assert.assertTrue(parameter.isMethodInvoked());
    }
}