javakaffee

Yesterday I added another example resource to the spring-annotations sample that shows how to use spring-aop with jersey.

The example contains a resource class SpringAopResource that is created by spring (in this case via autodetection/classpath scanning). There’s an example SecurityAdvice defined with a pointcut matching methods annotated with a custom @Secure annotation. The resource method of the SpringAopResource of course is annotated with this annotation, so that the SecurityAdvice will be applied to this resource method. (The SecurityAdvice in our case does plain stupid logging, this should be changed of course :))

So that spring-aop can come into play our resource class needs to be proxied. This raises the question about subresources. Normally they would be created by the resource class, e.g. some UsersResource.getUserResource(String userId) would return some new UserResource(userId). At this point the UserResource could not be proxied by spring - simply impossible. For this we introduced the ResourceContext (I already blogged about this in the context of the initial jersey-spring integration), so that a resource class can fetch an instance of a subresource class from the IoC container.
This is demonstrated by the subresource locator SpringAopResource.getSubResource() which returns an instance of a SpringAopSubResource fetched from the ResourceContext.

The code is shown below - just too little to believe that this should be all :)

The configuration in applicationContext.xml for aspectj-annotation support, and the configuration of the advice bean.

<beans xmlns="..." etc.>
    ...
    <aop:aspectj-autoproxy/>
    <bean id="securityAdvice" class="com.sun.jersey.samples.springannotations.resources.aop.SecurityAdvice" />
    ...
</beans>

The @Secure annotation and the SecurityAdvice:

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface Secure {

}

@Aspect
public class SecurityAdvice {
    
    private static final Logger LOGGER = Logger.getLogger( SecurityAdvice.class.getName() );
    
    @Before( "@annotation(com.sun.jersey.samples.springannotations.resources.aop.Secure)" )
    public void check( JoinPoint jp ) {
        /* this might get some authentication/authorization info from the request 
         * and throw a WebApplicationException with a response with status 401 (unauthorized)
         * if the request is not authorized.
         */
        final Signature signature = jp.getSignature();
        LOGGER.info( "Authorized execution of " + signature.getDeclaringTypeName() + "." + signature.getName() );
    }
    
}

The resource and subresource classes:

@Path("/spring-aop")
@Component
@Scope("singleton")
public class SpringAopResource {
    
    @Context
    private ResourceContext _resourceContext;

    @Autowired
    private Item _item;

    @GET
    @Secure
    @Produces("application/xml")
    public Item getItem() {
        return _item;
    }
    
    @Path( "subresource" )
    public SpringAopSubResource getSubResource() {
        return _resourceContext.getResource( SpringAopSubResource.class );
    }
    
}


@Component
@Scope("prototype")
public class SpringAopSubResource {

    @Autowired
    @Qualifier("1")
    private Item2 _item;

    @GET
    @Secure
    @Produces("application/xml")
    public Item2 getItem() {
        return _item;
    }
    
}

That’s all. The Item and Item2 classes are just normal beans injected by spring.

You can pull the full example from subversion or browse it online.