coheigea commented on PR #3646: URL: https://github.com/apache/cxf/pull/3646#issuecomment-6515434847
Thanks Freeman. Now that [#3651](https://github.com/apache/cxf/pull/3651) is merged, I’ve rebased this PR onto main and applied the same approach to claims: - Every applicable @Claim has to be met: class, superclass or interface. So your cases (1) and (2) require both claims. - A class-level @Claim is replaced by a method-level @Claim of the same name and format on that class or a subclass. Method-level claims are never replaced, so an override can’t weaken them. - Generic overrides are resolved via ReflectionUtil.getGenericallyOverriddenMethods, and the name-based fallback only applies to methods outside the secured object, so unannotated and unrelated overloads (your case 3, plus update(Integer)) are left alone. The test coverage now matches OAuthScopesFilterTest, including your cases from both PRs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
