可访问 Bean 的位置或时间的限制

Question

我面临无法访问我创建的 Bean 的情况，这让我想知道它们在哪里以及何时出现！？

我制作了两个 Bean，一个作用域为 singleton，另一个作用域为 request。我已经通过在RestController 类中自动装配它们来确保它们得到正确实现。毫无疑问，它们是人口稠密的。

现在我编写了一个扩展PreInvocationAuthorizationAdvice 的授权检查器类。作为一个授权类，我需要访问当前用户的信息。所以我将当前用户的 Bean 自动连接到这个类，这是 request 作用域 Bean。我还需要一个定制的 ACL 引擎，它以singleton 的方式自动装配。但是当我达到需要使用这两个属性的时候，它们都是null！

那么，我可以在何时何地访问 Bean 有什么限制？

顺便说一句，我的 @Configuration 类也由 @ComponentScan({"my.base.package"}) 注释，这是我指定类的父包，包括 @Autowired 属性。

[更新]

我想我找到了问题所在，但我正在努力寻找解决方案。

具有@Autowired 属性的类被实例化为 Bean 本身。我认为这个迟到的 Bean 在它所依赖的其他 Bean 之前被实例化，因此它们还不可用。无论如何我可以指定被实例化的 Bean 的顺序吗？

[附注]

任何将此问题标记为“离题，因为：这个问题似乎与编程无关”的人太有趣了:)

[更新]

仅当@Autowired 属性为空时的示例。

这些是我的配置类：

@Configuration
@PropertySource("/config.properties")
@ComponentScan({"my.package"})
public class AppConfig implements ApplicationContextAware
{
    private ApplicationContext appContext;
    @Autowired
    private Environment env;

    @Override
    public void setApplicationContext(ApplicationContext applicationContext)
        throws BeansException
    {
        this.appContext = applicationContext;
    }

    @Bean
    public RedissonClient getRedisson()
    {
        //Code ommited: returning a redisson connection.
    }
}

@Configuration
@ComponentScan({"my.pacakge"})
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends GlobalMethodSecurityConfiguration
{
    @Bean
    public AclEngine getAclEngine()
    {
        return new AclEngine();
    }

    @Autowired
    private RedissonClient redisson;

    @Bean
    @Scope(value = "request")
    public User getCurrentUser()
    {
        //Code ommited: retrieving the user from Redisson and returning it.
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth)
        throws Exception
    {
        auth.authenticationProvider(authenticator());
    }

    @Bean
    public AuthenticationProvider authenticator()
    {
        return new AclAuthenticationProvider();
    }

    @Bean
    HttpSessionSecurityContextRepository getHttpSessionSecurityContextRepository()
    {
        HttpSessionSecurityContextRepository x = new HttpSessionSecurityContextRepository();
        x.setAllowSessionCreation(false);
        return x;
    }

    @Bean
    SecurityContextPersistenceFilter getSecurityContextPersistenceFilter()
    {
        return new SecurityContextPersistenceFilter(getHttpSessionSecurityContextRepository());
    }

    @Override
    protected AccessDecisionManager accessDecisionManager()
    {
        try {
            AffirmativeBased ab = (AffirmativeBased) super.accessDecisionManager();
            List<AccessDecisionVoter<? extends Object>> advs = ab.getDecisionVoters();
            ResourceBasedPreInvocationAdvice expressionAdvice = new ResourceBasedPreInvocationAdvice();

            List<AccessDecisionVoter<? extends Object>> toBeRemoved = new ArrayList<>();
            for (AccessDecisionVoter<? extends Object> adv : advs) {
                if (adv instanceof PreInvocationAuthorizationAdviceVoter) {
                    toBeRemoved.add(adv);
                }
            }
            for (AccessDecisionVoter<? extends Object> adv : toBeRemoved) {
                advs.remove(adv);
            }
            advs.add(new PreInvocationAuthorizationAdviceVoter(expressionAdvice));
            return ab;
        }
        catch (ClassCastException ex) {
            ArrayList decisionVoters = new ArrayList();
            ResourceBasedPreInvocationAdvice expressionAdvice = new ResourceBasedPreInvocationAdvice();
            decisionVoters.add(new PreInvocationAuthorizationAdviceVoter(expressionAdvice));
            return new AffirmativeBased(decisionVoters);
        }
    }

    public class AclAuthenticationProvider implements AuthenticationProvider
    {
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException
        {
            return null;
        }

        @Override
        public boolean supports(Class<?> authentication)
        {
            return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));
        }
    }

    public class SessionInitializer extends AbstractHttpSessionApplicationInitializer
    {
        public SessionInitializer()
        {
            super(SecurityConfig.class);
        }
    }
}

最后我面临的问题是：

public class ResourceBasedPreInvocationAdvice implements PreInvocationAuthorizationAdvice
{
    @Autowired
    private User currentUser;
    @Autowired
    private AclEngine aclEngine;

    @Override
    public boolean before(Authentication authentication, MethodInvocation methodInvocation, PreInvocationAttribute preInvocationAttribute)
    {
        //Where I want to access currentUser and aclEngine but they are null.
        //I can trace the code to this point without any Exception thrown!
    }
}

Answer 1

@Override
protected AccessDecisionManager accessDecisionManager()
{
    try {
        AffirmativeBased ab = (AffirmativeBased) super.accessDecisionManager();
        List<AccessDecisionVoter<? extends Object>> advs = ab.getDecisionVoters();
        ResourceBasedPreInvocationAdvice expressionAdvice = new ResourceBasedPreInvocationAdvice();

        List<AccessDecisionVoter<? extends Object>> toBeRemoved = new ArrayList<>();
        for (AccessDecisionVoter<? extends Object> adv : advs) {
            if (adv instanceof PreInvocationAuthorizationAdviceVoter) {
                toBeRemoved.add(adv);
            }
        }
        for (AccessDecisionVoter<? extends Object> adv : toBeRemoved) {
            advs.remove(adv);
        }
        advs.add(new PreInvocationAuthorizationAdviceVoter(expressionAdvice));
        return ab;
    }
    catch (ClassCastException ex) {
        ArrayList decisionVoters = new ArrayList();
        ResourceBasedPreInvocationAdvice expressionAdvice = new ResourceBasedPreInvocationAdvice();
        decisionVoters.add(new PreInvocationAuthorizationAdviceVoter(expressionAdvice));
        return new AffirmativeBased(decisionVoters);
    }
}

Spring 只会将引用注入到它管理的类实例（又名 bean）中。当您在方法中创建 bean 并将它们直接注入其他 bean 时，这些新创建的 bean 是 Spring Managed bean，因此不符合 Spring 的任何自动布线或后处理条件。

代替

ResourceBasedPreInvocationAdvice expressionAdvice = new ResourceBasedPreInvocationAdvice();

您应该将该代码移动到 @Bean 方法，以便它成为 Spring 托管 bean 并注入依赖项。

@Bean
public ResourceBasedPreInvocationAdvice expressionAdvice() {
    return new ResourceBasedPreInvocationAdvice();
}

并且只是引用这个方法而不是创建一个新实例。

ResourceBasedPreInvocationAdvice expressionAdvice = expressionAdvice();