Package com.broadleafcommerce.data.tracking.core.policy

Class PolicyOverride

  • All Implemented Interfaces:
    org.springframework.core.Ordered
    public class PolicyOverride
extends Object
implements org.springframework.core.Ordered
    An alternative to Policy used to introduce, alter or remove policy configuration on one or more component methods. Usually declared as a bean in a Spring application context Configuration class and generally associated with a single Aspect declaring component, although the latter is not a requirement. The aspect is responsible for declaring pointcuts that are responsible for catching calls to methods that should be protected with policy enforcement. The aspect delegates to PolicyAspectProcessor, which is responsible for utilizing PolicyOverride instances to define policy enforcement configuration. In the absence of PolicyOverride, any applicable Policy annotations are leveraged.

    When enhancing (altering or removing) existing Policy annotated methods in the Broadleaf stack, it is not necessary to declare any aspect, as DefaultPolicyAspect is already responsible for recognizing these fields. In this case, you may simply declare an instance of PolicyOverride with the desired change. Here's an example that alters policy configuration for a Policy annotated method in TrackableRepository. 

     @Bean
 PolicyOverride saveOverride() {
     return new PolicyOverride("save.*")
          .withPermissionRoots(new String[] {"OTHER"})
          .withOperationTypes(new OperationType[] {OperationType.UPDATE})
          .withAspect(DefaultPolicyAspect.class);
 }

    When adding policy protection to a method in your own codebase (i.e. extending from Broadleaf), it is generally easiest to add the Policy annotation to your methods, which will automatically be picked up by DefaultPolicyAspect.

    When adding policy protection to a method in the Broadleaf codebase (or Spring codebase) for which there is not already existing protection, it is necessary to declare an aspect and appropriate supporting PolicyOverride instances. See CrudPolicyAspect as an example that catches calls to methods in Spring's CrudRepository. Also, review CrudPolicyConfiguration for examples of the supporting PolicyOverride instances declared against that aspect.

    PolicyOverride instances are also Ordered. The first matching override in the ordered list is the one to be used. This means it is easy to replace the behavior introduced by a PolicyOverride instance in the Broadleaf codebase with a different/custom PolicyOverride instance matching on the same method with a higher precedence ordering.

    Author:
    Jeff Fischer