codeconsole opened a new pull request, #16119:
URL: https://github.com/apache/grails-core/pull/16119
## What
The `spring-boot-starter-security` forge feature generated a separate
`SecurityConfig` class and pulled it into the generated app with
`@Import(SecurityConfig)`. This declares the same two beans through the `beans`
DSL (#16019) on the generated `Application` class instead, and deletes the
`SecurityConfig` template.
A generated secured app now looks like this, with no
`src/main/groovy/**/SecurityConfig.groovy`:
```groovy
@CompileStatic
@EnableWebSecurity
class Application extends GrailsAutoConfiguration {
static void main(String[] args) {
GrailsApp.run(Application, args)
}
def beans = {
bean(PasswordEncoder) {
PasswordEncoderFactories.createDelegatingPasswordEncoder()
}
bean('filterChain', SecurityFilterChain) { HttpSecurity http ->
http
.authorizeHttpRequests { it.anyRequest().permitAll() }
.formLogin { }
.logout { it.logoutSuccessUrl('/') }
http.build()
}
}
}
```
The behaviour is unchanged — same two beans, same form login, same logout
URL. It is one fewer generated file, and the security wiring sits where an
application's other bean wiring goes.
No dependency declaration is added to the generated build: `grails-core`
already exports `grails-beans-dsl` as an `api` dependency, so the transform
reaches any app that depends on `grails-core`.
Applications generated without the feature are unaffected —
`application.rocker.raw` renders byte-identical output for them.
## Also
`user.rocker.raw` marks the `password` field with the `password` constraint,
so scaffolding renders it masked rather than as plain text:
```groovy
password blank: false, password: true
```
## Testing
`SpringBootStarterSecuritySpec` is updated to assert the DSL in
`Application.groovy` and that no `SecurityConfig.groovy` is generated, and
covers the new constraint. The negative case asserts neither `def beans = {`
nor `@EnableWebSecurity` appears without the feature.
- `SpringBootStarterSecuritySpec` — 6/6 pass
- Full `:grails-forge-core:test` — 322 tests, 0 failures, 1 skipped
Rendered output was inspected directly for both the secured and unsecured
variants.
Not covered here: the tests assert on generated text, not on compiling and
booting a generated project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
