SpringReactiveOpaqueTokenIntrospector uses WebClient in its
implementation so the auto-configuration of it must back off when
spring-webflux is not on the classpath. Failing to do so results in
a ClassNotFoundException for WebFlux's BodyInserters if the
auto-configuration's other conditions are met.
Fixes gh-50764
This commit guards the creation of a ReactiveJwtDecoder with the
presence of Spring WebFlux. WebClient is used behind the scenes and
the sole presences of the authorization server and reactive types were
not precise enough.
Closes gh-49807
Refactor `spring-boot-security-oauth2-authorization-server` to separate
core authorization server auto-configuration from Spring Security web
auto-configuration.
This update should allow authorization server auto-configuration
outside or a reactive or servlet web application.
Closes gh-43978
A change in Spring Security [1] means that type validation is now
performed by default by Spring Security. A breaking side-effect of
this is that setting validateTypes to false no longer has an effect
and the default JwtTypeValidator is still present. Its presence,
wrapped in a DelegatingOAuth2TokenValidator, prevents a user's
JwtTypeValidator bean from being used for type validation.
This commit updates Boot's auto-configuration to change how the
type validators are created. We avoid wrapping in a
DelegatingOAuth2TokenValidator so that the user's custom
JwtTypeValidator can be detected and used in place of the default.
This requires us to create the JwtIssuerValidator rather than using
the createDefaultWithIssuer method as it does not allow additional
validators to be provided.
Fixes gh-48301
[1] https://github.com/spring-projects/spring-security/commit/6d3b54df21ec0cffc30c8b3e0784220bd117a87d
Create `spring-boot-resttestclient` and `spring-boot-webtestclient`
modules to hold test client auto-configuration and `TestRestTemplate`
code.
Previous these classes were contained in `spring-boot-resetclient-test`
and `spring-boot-webclient-test` which was incorrect since the `-test`
modules should hold code need to test the given modules, not supporting
test classes.
See gh-46356
Co-authored-by: Phillip Webb <phil.webb@broadcom.com>
Make `spring-boot-test-autoconfigure` optionally depend on
`spring-boot-autoconfigure` so that it can be an `api` dependency
for `*-test` modules. Also relocate it to core.
See gh-47322
This commit modularizes spring-boot-test-autoconfigure. It now
contains only the code that's central to test auto-configuration.
Feature-specific functionality has moved out into -test modules,
some existing and some newly created. For example, `@DataJpaTest` can
now be found in spring-boot-data-jpa-test.
Closes gh-47322
Refactor `PropertyMapper` so that it no longer calls adapter or
predicate methods by default when the source value is `null`. This
effectively makes all default calls the same as using
`alwaysWhenNotNull` in the previous generation of the code.
For the limited times when you do need to deal with `null` values, the
new `always()` method can be used.
For example,
map.from(source::method).to(destination::method);
Will not call `destination.method(...)` if `source.method()` returns
`null`.
Where as:
map.from(source::method).always().to(destination::method);
Will call `destination.method(null)` if `source.method()` returns
`null`.
This update provides clearer semantics for the API and allows for better
JSpecify nullability annotations. It has also simplified much of our
existing property mapper code.
Closes gh-47024
Co-authored-by: Moritz Halbritter <moritz.halbritter@broadcom.com>
Andy Wilkinson
Vinod Kumar
Stéphane Nicoll
Phillip Webb
itsmevichu
Yanming Zhou
Moritz Halbritter