I would like to do something like that:
Interface
public interface EndpointCollection<T> {
@GET
// @Secured({Role.Admin}) here everything works fine but won't need it here
@Produces(MediaType.APPLICATION_JSON)
public T getAll();
}
Endpoint
public class EntityEndpoint implements EndpointCollection<Entity> {
@Secured({Role.Admin}) // annotation isn't considered at all
@Override
public Entity getAll() {
...
}
}
So every endpoint holds the basic methods and just the permissions need to be handled. I already tried it and it doesn't seem to work, but I don't understand why and what I can do that it will work.
Edit
If I do the following in my AuthorizationFilter
@Provider
@Priority(Priorities.AUTHORIZATION)
public class AuthorizationFilter implements ContainerRequestFilter {
@Context
private ResourceInfo resourceInfo;
@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
...
List<Role> methodRoles = extractRoles(resourceInfo.getResourceMethod());
...
}
private List<Role> extractRoles(AnnotatedElement annotatedElement) {
System.out.println("AnnotatedElement =====================> " + annotatedElement);
if (annotatedElement == null) {
return new ArrayList<Role>();
} else {
Secured secured = annotatedElement.getAnnotation(Secured.class);
System.out.println("Secured ==============================> " + secured);
if (secured == null) {
return new ArrayList<Role>();
} else {
Role[] allowedRoles = secured.value();
for (Role r : allowedRoles)
System.out.println("Role ============================> " + r);
return Arrays.asList(allowedRoles);
}
}
}
}
I get
AnnotatedElement =====================> public java.util.List com.as.web.core.EntityEndpoint.getAll()
Secured ==============================> null
But I am expecting a value of Admin
like
Role ============================> Admin
Edit
It is a Java EE Application. I am using JAX-RS on wildly 10.
@NameBinding
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD, ElementType.TYPE})
@Inherited
public @interface Secured {
Role[] value() default {};
}