A change in Spring Security [1] means that type validation is now
performed by default by Spring Security. A breaking side-effect of
this is that setting validateTypes to false no longer has an effect
and the default JwtTypeValidator is still present. Its presence,
wrapped in a DelegatingOAuth2TokenValidator, prevents a user's
JwtTypeValidator bean from being used for type validation.
This commit updates Boot's auto-configuration to change how the
type validators are created. We avoid wrapping in a
DelegatingOAuth2TokenValidator so that the user's custom
JwtTypeValidator can be detected and used in place of the default.
This requires us to create the JwtIssuerValidator rather than using
the createDefaultWithIssuer method as it does not allow additional
validators to be provided.
Fixes gh-48301
[1] https://github.com/spring-projects/spring-security/commit/6d3b54df21ec0cffc30c8b3e0784220bd117a87d
Create `spring-boot-resttestclient` and `spring-boot-webtestclient`
modules to hold test client auto-configuration and `TestRestTemplate`
code.
Previous these classes were contained in `spring-boot-resetclient-test`
and `spring-boot-webclient-test` which was incorrect since the `-test`
modules should hold code need to test the given modules, not supporting
test classes.
See gh-46356
Co-authored-by: Phillip Webb <phil.webb@broadcom.com>
Make `spring-boot-test-autoconfigure` optionally depend on
`spring-boot-autoconfigure` so that it can be an `api` dependency
for `*-test` modules. Also relocate it to core.
See gh-47322
This commit modularizes spring-boot-test-autoconfigure. It now
contains only the code that's central to test auto-configuration.
Feature-specific functionality has moved out into -test modules,
some existing and some newly created. For example, `@DataJpaTest` can
now be found in spring-boot-data-jpa-test.
Closes gh-47322
Refactor `PropertyMapper` so that it no longer calls adapter or
predicate methods by default when the source value is `null`. This
effectively makes all default calls the same as using
`alwaysWhenNotNull` in the previous generation of the code.
For the limited times when you do need to deal with `null` values, the
new `always()` method can be used.
For example,
map.from(source::method).to(destination::method);
Will not call `destination.method(...)` if `source.method()` returns
`null`.
Where as:
map.from(source::method).always().to(destination::method);
Will call `destination.method(null)` if `source.method()` returns
`null`.
This update provides clearer semantics for the API and allows for better
JSpecify nullability annotations. It has also simplified much of our
existing property mapper code.
Closes gh-47024
Co-authored-by: Moritz Halbritter <moritz.halbritter@broadcom.com>
Stéphane Nicoll
Andy Wilkinson
Yanming Zhou
Phillip Webb
Moritz Halbritter