Custom annotation aspects in AT Controller

[cheng81]

Hi everyone, I'm facing a problem with Spring MVC 2. 5: i want to annotate the methods of a controller, say for access control (yes, i know there are other methods around to do this, like filters and so on, but it's the point of the thread), for example:

AT Controller
public class MyController {

  AT NeedAccessControl
  AT RequestMapping
  public String anAction(ModelMap model){
    //..do the business method
    return "myView";
  }
}

Now, i have an aspect that check that every method annotated with "AT NeedAccessControl" should be checked before execution, like:

AT Aspect
public class AccessControlAspect{
  AT Autowired //or injected directly, it's the same
  private SessionCheck sessionCheck;

  AT Before("needAccessControlMethods()")
  public void doAccessControl() throws UserNotAuthenticatedException {
    if(!sessionCheck.validSession()){
      throw new UserNotAuthenticatedException();
    }
  }

  AT Pointcut(
  "AT annotation(com.my.webapp.util.NeedAccessControl)"
  )
  public void needAccessControlMethods(){}
}

ok, the code of the aspect is never executed. I think that this caused by the way spring load the AT Controller beans: at context startup time maybe the controller are not loaded, and spring is not aware of that class (and it not "register" the annotated class methods with the aspect) -- but i dont have checked the spring code, so these are my assumptions.

Question: it is possible to use the spring-aspect system with AT Controller annotated classes, or it is absolutely infeasible? or it's better if i just drop this thing and go for simple spring request interceptor?

(BTW i can also write a custom methodNameResolver that check if the resolved method is annotated with AT NeedAccessControl annotation, but spring do so already, and i think it will be a lot more slow than using the spring aspect system)

thanks in advance,

Francesco Zanitti

ps. ..well it's quite annoying that this forum doesn't let me write the 'AT' symbol

[Marten Deinum]

There is nothing preventing you from using it. However check if your annotation is correct it still needs to be there on Runtime so check if the RententionType is set correctly. So can you post your annotation and also your configuration of your Aspect, because only writing the aspect and not configuring anything isn't going to apply the Aspect.

However I would think that a HandlerInterceptor would be easier, that way it is always invoked and you don't need to annotate all your methods.

Also why do you create your own? Why not use Spring Security?

[cheng81]

Yes, you are right: there's nothing prevent from using it. Now it works. I don't know why, but it works. Better said, now it works because i've removed/re-added/name-changed one of the method annotated as with RequestMapping.

I've to admit that this morning i've had some troubles with spring MVC annotation driven controllers: for some reasons it wasn't working at all: all the requests were dispatched to one method only (the "create" one, that i use to create an user object for testing), no matter what. I was a bit disappointed, also because the controller itself was working since the first draft.
So i simply removed that method ("create") and the things have worked. I readded it changing its name ("createUser") and now i don't have troubles (even the AT NeedAccessControl worked at first attempt). So i don't know why it wasn't working, but well.. now it's working, so thanks for your attention anyway

fz