spring-projects / spring-statemachine

Spring Statemachine is a framework for application developers to use state machine concepts with Spring.
1.53k stars 599 forks source link

comparisonType for securing transition/event is not working #1019

Open se0kjun opened 2 years ago

se0kjun commented 2 years ago

When configuring transitions or events security, comparisonType is not working.

AFAIK, to configure transition or event security, we can use withSecurity, which instantiates DefaultSecurityConfigurer by default, defined in StateMachineConfigurationBuilder.

...
    @Override
    public SecurityConfigurer<S, E> withSecurity() throws Exception {
        return apply(new DefaultSecurityConfigurer<S, E>());
    }
...

Also, event or transition method defined in DefaultSecurityConfigurer provides comparisonType parameter to decide securing methodology: ALL, ANY, MAJORITY.

However, There is no specifying comparisonType to SecurityRule in event or transition configuration method.

...
    @Override
    public SecurityConfigurer<S, E> event(String attributes, ComparisonType match) {
        if (eventSecurityRule == null) {
            eventSecurityRule = new SecurityRule();
        }
        eventSecurityRule.setAttributes(SecurityRule.commaDelimitedListToSecurityAttributes(attributes));
        return this;
    }
...

And, comparisonType in SecurityRule is specified ANY type by default, so it is always working as ANY type

Thanks