Class NavigationAccessDecisionService

java.lang.Object
com.svenruppert.jsentinel.authorization.navigation.NavigationAccessDecisionService
public final class NavigationAccessDecisionService extends Object
Pure decision service for navigation security.

This class contains no Vaadin dependencies and can be fully unit-tested without BeforeEnterEvent, UI, VaadinSession, or a running Vaadin application.

The decision flow covers:

  • Public route — allow navigation
  • Restricted route without subject — redirect to login (unless the target is already the login view)
  • Restricted route with subject on login page — forward to default view (user is already logged in)
  • Restricted route with subject — allow (authentication passed; authorization is checked separately)

Authorization (role/permission checks) is handled by evaluateAuthorization(boolean, String, boolean), which is called after authentication passes.

  • Constructor Details

    • NavigationAccessDecisionService

      public NavigationAccessDecisionService()
      Creates a new instance.

  • Method Details

    • evaluateAuthentication

      public NavigationAccessDecision evaluateAuthentication(NavigationJSentinelContext ctx)
      Evaluates whether the current subject is authenticated for the given navigation context.

      This covers the login-check phase: is a subject present for a restricted route? Vaadin listeners call this first, and only proceed to evaluateAuthorization(boolean, String, boolean) if the result is NavigationAccessDecision.Allowed.

      Parameters:
      ctx - the navigation security context
      Returns:
      the authentication-phase decision

    • evaluateAuthorization

      public NavigationAccessDecision evaluateAuthorization(boolean hasRequiredAccess, String alternativeRoute, boolean asForward)
      Evaluates whether the current subject has sufficient authorization (roles/permissions) for the requested route.

      This covers the authorization-check phase: does the subject have the required roles or permissions? Called after authentication passes.

      Parameters:
      hasRequiredAccess - whether the subject satisfies the access requirements
      alternativeRoute - the route to redirect to if access is denied
      asForward - if true, use forward instead of reroute
      Returns:
      the authorization-phase decision