Package org.apache.struts2.rest.handler.jackson

Class AuthorizingSettableBeanProperty

java.lang.Object
com.fasterxml.jackson.databind.introspect.ConcreteBeanPropertyBase
com.fasterxml.jackson.databind.deser.SettableBeanProperty
com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating
org.apache.struts2.rest.handler.jackson.AuthorizingSettableBeanProperty
All Implemented Interfaces:
com.fasterxml.jackson.databind.BeanProperty, com.fasterxml.jackson.databind.util.Named, Serializable
public class AuthorizingSettableBeanProperty extends com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating
A SettableBeanProperty.Delegating that authorizes each property against the ParameterAuthorizationContext before delegating to the underlying property's deserializeAndSet. Unauthorized properties are silently dropped — the JSON value is skipped via JsonParser.skipChildren(), so any nested object graph is never instantiated and setter side effects on unauthorized properties never fire.

Path tracking for nested members is done by the AuthorizingValueDeserializer wrapped around every property's value deserializer, so the direct path and the buffered creator path compute the same paths. Values Jackson assigns after construction go through set(java.lang.Object, java.lang.Object) and setAndReturn(java.lang.Object, java.lang.Object), which apply the same authorization to the already-materialized value.

When ParameterAuthorizationContext.isActive() is false, this wrapper is a straight pass-through to the delegate — no overhead for default-config requests — except that a creator parameter is never written after construction (see set(java.lang.Object, java.lang.Object)), and a polymorphic property is never merged in place, a decision taken when the deserializer is built, see DelegatingDeserializer.supportsUpdate(com.fasterxml.jackson.databind.DeserializationConfig).

Since:
7.2.0
See Also:

  • Nested Class Summary

    Nested classes/interfaces inherited from class com.fasterxml.jackson.databind.deser.SettableBeanProperty

    com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating

    Nested classes/interfaces inherited from interface com.fasterxml.jackson.databind.BeanProperty

    com.fasterxml.jackson.databind.BeanProperty.Bogus, com.fasterxml.jackson.databind.BeanProperty.Std

  • Field Summary

    Fields inherited from class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating

    delegate

    Fields inherited from class com.fasterxml.jackson.databind.deser.SettableBeanProperty

    _contextAnnotations, _managedReferenceName, _nullProvider, _objectIdInfo, _propertyIndex, _propName, _type, _valueDeserializer, _valueTypeDeserializer, _viewMatcher, _wrapperName, MISSING_VALUE_DESERIALIZER

    Fields inherited from class com.fasterxml.jackson.databind.introspect.ConcreteBeanPropertyBase

    _aliases, _metadata

    Fields inherited from interface com.fasterxml.jackson.databind.BeanProperty

    EMPTY_FORMAT, EMPTY_INCLUDE

  • Constructor Summary

    Constructors
    Constructor
    Description
    AuthorizingSettableBeanProperty(com.fasterxml.jackson.databind.deser.SettableBeanProperty delegate)
    Deprecated, for removal: This API element is subject to removal in a future version.
    keys authorization on the wire name; use AuthorizingSettableBeanProperty(SettableBeanProperty, String) with the Java member name
    AuthorizingSettableBeanProperty(com.fasterxml.jackson.databind.deser.SettableBeanProperty delegate, String memberName)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    deserializeAndSet(com.fasterxml.jackson.core.JsonParser p, com.fasterxml.jackson.databind.DeserializationContext ctxt, Object instance)
     
    Object
    deserializeSetAndReturn(com.fasterxml.jackson.core.JsonParser p, com.fasterxml.jackson.databind.DeserializationContext ctxt, Object instance)
     
    void
    set(Object instance, Object value)
     
    Object
    setAndReturn(Object instance, Object value)
     
    protected com.fasterxml.jackson.databind.deser.SettableBeanProperty
    withDelegate(com.fasterxml.jackson.databind.deser.SettableBeanProperty d)
     
    com.fasterxml.jackson.databind.deser.SettableBeanProperty
    withValueDeserializer(com.fasterxml.jackson.databind.JsonDeserializer<?> deser)
    Creator-bound properties, and non-creator properties Jackson buffers while collecting creator parameters, never reach deserializeAndSet(com.fasterxml.jackson.core.JsonParser, com.fasterxml.jackson.databind.DeserializationContext, java.lang.Object)/deserializeSetAndReturn(com.fasterxml.jackson.core.JsonParser, com.fasterxml.jackson.databind.DeserializationContext, java.lang.Object): Jackson calls the final SettableBeanProperty#deserialize directly, through this property's own value deserializer.

    Methods inherited from class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating

    _with, assignIndex, fixAccess, getAnnotation, getCreatorIndex, getDeclaringClass, getDelegate, getInjectableValueId, getManagedReferenceName, getMember, getObjectIdInfo, getPropertyIndex, getValueDeserializer, getValueTypeDeserializer, hasValueDeserializer, hasValueTypeDeserializer, hasViews, isInjectionOnly, visibleInView, withName, withNullProvider

    Methods inherited from class com.fasterxml.jackson.databind.deser.SettableBeanProperty

    _throwAsIOE, _throwAsIOE, _throwAsIOE, _throwAsIOE, depositSchemaProperty, deserialize, deserializeWith, getContextAnnotation, getFullName, getInjectionDefinition, getName, getNullValueProvider, getType, getWrapperName, isIgnorable, isMerging, markAsIgnorable, setManagedReferenceName, setObjectIdInfo, setViews, toString, unwrapped, withSimpleName

    Methods inherited from class com.fasterxml.jackson.databind.introspect.ConcreteBeanPropertyBase

    findAliases, findFormatOverrides, findPropertyFormat, findPropertyInclusion, getMetadata, isRequired, isVirtual

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Constructor Details

    • AuthorizingSettableBeanProperty

      @Deprecated(since="7.4.0", forRemoval=true) public AuthorizingSettableBeanProperty(com.fasterxml.jackson.databind.deser.SettableBeanProperty delegate)
      Deprecated, for removal: This API element is subject to removal in a future version.
      keys authorization on the wire name; use AuthorizingSettableBeanProperty(SettableBeanProperty, String) with the Java member name

    • AuthorizingSettableBeanProperty

      public AuthorizingSettableBeanProperty(com.fasterxml.jackson.databind.deser.SettableBeanProperty delegate, String memberName)
      Parameters:
      memberName - the Java member name the authorizer resolves, which differs from SettableBeanProperty.getName() once the property is renamed on the wire

  • Method Details

    • withDelegate

      protected com.fasterxml.jackson.databind.deser.SettableBeanProperty withDelegate(com.fasterxml.jackson.databind.deser.SettableBeanProperty d)
      Specified by:
      withDelegate in class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating

    • withValueDeserializer

      public com.fasterxml.jackson.databind.deser.SettableBeanProperty withValueDeserializer(com.fasterxml.jackson.databind.JsonDeserializer<?> deser)
      Creator-bound properties, and non-creator properties Jackson buffers while collecting creator parameters, never reach deserializeAndSet(com.fasterxml.jackson.core.JsonParser, com.fasterxml.jackson.databind.DeserializationContext, java.lang.Object)/deserializeSetAndReturn(com.fasterxml.jackson.core.JsonParser, com.fasterxml.jackson.databind.DeserializationContext, java.lang.Object): Jackson calls the final SettableBeanProperty#deserialize directly, through this property's own value deserializer. Wrap that deserializer with AuthorizingValueDeserializer for every property; it owns the path push for nested members on both the direct and the buffered path, and refuses the in-place merge of a polymorphic value that would otherwise skip both.
      Overrides:
      withValueDeserializer in class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating

    • deserializeAndSet

      public void deserializeAndSet(com.fasterxml.jackson.core.JsonParser p, com.fasterxml.jackson.databind.DeserializationContext ctxt, Object instance) throws IOException
      Overrides:
      deserializeAndSet in class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating
      Throws:
      IOException

    • deserializeSetAndReturn

      public Object deserializeSetAndReturn(com.fasterxml.jackson.core.JsonParser p, com.fasterxml.jackson.databind.DeserializationContext ctxt, Object instance) throws IOException
      Overrides:
      deserializeSetAndReturn in class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating
      Throws:
      IOException

    • set

      public void set(Object instance, Object value) throws IOException
      Overrides:
      set in class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating
      Throws:
      IOException

    • setAndReturn

      public Object setAndReturn(Object instance, Object value) throws IOException
      Overrides:
      setAndReturn in class com.fasterxml.jackson.databind.deser.SettableBeanProperty.Delegating
      Throws:
      IOException