Class SecuredVisibility

java.lang.Object

com.svenruppert.jsentinel.components.SecuredVisibility

@ExperimentalJSentinelApi
public final class SecuredVisibility
extends Object

Shared decision point for the Phase-8b secured Vaadin components (SecuredButton, SecuredRouterLink, SecuredMenuItem).

The component declares a SecuredVisibility.Requirement (zero or more required roles + zero or more required permissions) and a SecuredVisibilityMode. On every apply(...) call this helper:

1. Resolves the current typed subject via SubjectStores.subjectStore() and the registered AuthenticationService.subjectType().
2. Asks the registered AuthorizationService for the subject's roles + permissions (the AuthorizationService is the authoritative source — the SubjectStore alone may carry a typed user without the role view).
3. Computes admission via isAllowed(Requirement, HasRoles, HasPermissions).
4. Toggles visible / enabled on the supplied component target.

Admission semantics — a request is admitted when:

• All required permissions are present (AND across permissions), AND
• All required roles are present (AND across roles).

An empty SecuredVisibility.Requirement is always admitted — apps that need "any of these roles" semantics compose the affordance with a narrower wrapper or use one of the dedicated @RequiresAnyPermission-style annotations on a higher-level guard.

If no subject is bound or the security SPIs are not wired, the helper denies the affordance. UI components must never grant by default when authentication is unknown.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	SecuredVisibility.JSentinelView	The slice of the current subject the components consult.
static final record	SecuredVisibility.Requirement	What a secured component requires to be enabled / visible.
static interface	SecuredVisibility.Target	Target a SecuredVisibility helper toggles.

Method Summary

Modifier and Type	Method	Description
static void	apply(SecuredVisibility.Target target, SecuredVisibility.Requirement requirement, SecuredVisibilityMode mode)	Resolves the current subject and applies the requirement to target according to mode.
static void	apply(SecuredVisibility.Target target, SecuredVisibility.Requirement requirement, SecuredVisibilityMode mode, Supplier<Optional<SecuredVisibility.JSentinelView>> viewSupplier)	Test-friendly variant: the caller supplies the security view directly rather than going through the SPI lookup.
static Optional<SecuredVisibility.JSentinelView>	currentJSentinelView()	SPI lookup: typed user via SubjectStore → roles + permissions via the registered AuthorizationService.
static boolean	isAllowed(SecuredVisibility.Requirement requirement, com.svenruppert.jsentinel.authorization.api.roles.HasRoles roles, com.svenruppert.jsentinel.authorization.api.permissions.HasPermissions permissions)	Computes admission from the requirement against the supplied role and permission views.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

isAllowed

public static boolean isAllowed(SecuredVisibility.Requirement requirement,
 com.svenruppert.jsentinel.authorization.api.roles.HasRoles roles,
 com.svenruppert.jsentinel.authorization.api.permissions.HasPermissions permissions)

Computes admission from the requirement against the supplied role and permission views. Both arguments may be null (treated as empty).

Parameters:

requirement - non-null

roles - caller's role view; may be null

permissions - caller's permission view; may be null

Returns:

true when every required role and permission is present

apply

public static void apply(SecuredVisibility.Target target,
 SecuredVisibility.Requirement requirement,
 SecuredVisibilityMode mode)

Resolves the current subject and applies the requirement to target according to mode.

Parameters:

target - Vaadin component to toggle; non-null

requirement - what the component requires; non-null

mode - hide-vs-disable on denial; non-null

apply

public static void apply(SecuredVisibility.Target target,
 SecuredVisibility.Requirement requirement,
 SecuredVisibilityMode mode,
 Supplier<Optional<SecuredVisibility.JSentinelView>> viewSupplier)

Test-friendly variant: the caller supplies the security view directly rather than going through the SPI lookup.

Parameters:

target - non-null

requirement - non-null

mode - non-null

viewSupplier - supplies the current (roles, permissions) tuple; non-null

currentJSentinelView

public static Optional<SecuredVisibility.JSentinelView> currentJSentinelView()

SPI lookup: typed user via SubjectStore → roles + permissions via the registered AuthorizationService. Returns empty when any prerequisite is missing (no SPI wiring, no current subject, …) — the caller treats absence as denial.

Returns:

current security view, if resolvable