Class SecuredProxy

java.lang.Object
com.svenruppert.jsentinel.standalone.SecuredProxy
public final class SecuredProxy extends Object
Builds a dynamic-proxy wrapper around any interface so that every invocation routes through JSentinelEnforcer: if the method (or its declaring class) carries a security annotation, the matching evaluator runs before the call is delegated to the real implementation. Denied decisions raise AccessDeniedException; granted decisions fall through.

Runtime sibling of the compile-time path: classes annotated with Secured get a <Type>Secured subclass generated by security-processor. Both paths share the same JSentinelEnforcer so the rules are consistent.

Subject resolution: the proxy reads the current subject through the application's AuthenticationService + SubjectStore, and assembles a JSentinelSubject on the fly via the configured AuthorizationService.

Usage: 

MyService secured = SecuredProxy.wrap(MyService.class, new MyServiceImpl());
secured.deleteDocument(id);  // throws AccessDeniedException if not allowed

  • Method Details

    • wrap

      public static <T> T wrap(Class<T> interfaceType, T delegate)
      Wraps delegate in a dynamic proxy that enforces the security annotations declared on interfaceType (class-level or per method).
      Type Parameters:
      T - the interface type
      Parameters:
      interfaceType - the interface the proxy implements
      delegate - the real implementation
      Returns:
      a proxy implementing interfaceType

    • requireAllowed

      public static void requireAllowed(Class<?> ownerClass, String methodName)
      Single-shot check on the calling method. Useful when an interface isn't a clean fit (callbacks, lambdas) but the application still wants to enforce @RequiresPermission / @RequiresRole declaratively.

      Pass MyClass.class and a method name; the enforcer picks up class-level or method-level annotations and throws on a denied decision.

      Parameters:
      ownerClass - the class declaring the method
      methodName - the method name (overloads ignored — first match)
      Throws:
      com.svenruppert.jsentinel.authorization.api.AccessDeniedException - if the evaluator rejects the call