coheigea opened a new pull request, #3651:
URL: https://github.com/apache/cxf/pull/3651
The problem: the first fix (PR 3627) gave each method its own rule, but it
still chose one @Scopes per method when several applied. In some combinations
it chose the weaker one:
- Generic interface: a generic interface method marked “admin”, implemented
by a class marked “user” for all its methods, needed only “user”.
- Two branches: a parent class’s “user” on a method hid an “admin” on the
same method in an unrelated interface.
The fix: instead of choosing one rule, every @Scopes that applies to the
method must be met, whether it’s on the class, a parent class or an interface.
- One exception: a method’s own @Scopes replaces the class-wide @Scopes of
the class it’s declared in, so @Scopes("read") on a class with @Scopes("admin")
on one of its methods means that method needs “admin”.
- Overrides only add: an overriding method can add scopes but never weaken
the method it overrides.
- Generic overrides are linked: update(String) is linked to the generic
update(T) it implements, even when the implementation is inherited from a
parent class.
- Unrelated overloads stay apart: an unannotated delete() no longer picks
up the rule of delete(String).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
