fix/miss-and-key-parse #39

Merged

christian.keller merged 5 commits from fix/miss-and-key-parse into main

2026-09-02 11:28:33 +00:00

christian.keller commented

2026-09-02 07:47:12 +00:00

Owner

No description provided.

christian.keller added 4 commits

2026-09-02 07:47:12 +00:00

fix(base): report key-part parse errors as 400 naming property and key shape 9d1f0786f2

A key part a mapper rejects (int, enum, date, UUID, ...) threw through
unwrapped - e.g. a raw NumberFormatException -> HTTP 500 naming neither
the entity nor the property. The factory now wraps mapper failures into
CrudRestException(400) naming the offending part and property, and
CrudUriService.uriToKey appends the entity and its typed key pattern.
The enum mapper reports the valid constants instead of failing on an
unsafe cast.

Claude-Session: https://claude.ai/code/session_01EpeQsTSU59Ni6tsCLJpk6D

fix(repo-jooq): report a dangling key reference on write as a request error 4dd67aedea

A reference column is written as the id sub-select of the row its
business key points at; a key matching no row wrote NULL, so a not-null
reference column surfaced as a DataIntegrityViolation -> HTTP 500 naming
the column, not the reference the caller got wrong. Insert and update
now translate that violation into a CrudRepoRequestException (-> 400)
naming the reference field, both entity paths and the dangling key.
A miss on a nullable reference column still writes NULL silently
(post-detect only, plan option 1).

Claude-Session: https://claude.ai/code/session_01EpeQsTSU59Ni6tsCLJpk6D

feat(security): carry denial details on CrudSecurityException, log them on demand c18f91ccc5

A denied @CrudSecured call threw a bare 'Not permitted to call method' -
nothing named the protected method or what was missing. The exception now
carries the protected method and the missing permission (subject/relation:
entity and operation) as fields; the message stays generic on purpose,
since it is rendered into client-facing responses and would otherwise let
a caller explore the permission space. crudular.security.log-denials
(default off) makes the aspect log the details server-side.

Claude-Session: https://claude.ai/code/session_01EpeQsTSU59Ni6tsCLJpk6D

feat(security): delegate request authorization to @CrudSecured handlers

/ release (pull_request) Successful in 2m59s

Details

7abb2e5474

A custom endpoint under the CRUD url prefix was held to permissions its
URL merely resembles (a POST with key parts demands CREATE, an
unclassifiable route the op-less ALL set) even when its handler carries
its own @CrudSecured check. The request manager now detects such handler
methods via Spring MVC's handler registry (CrudSecuredHandlerScanner,
lazy first-use scan, class- and method-level annotations both enforced)
and decides from those declarations through the CrudPermissionChecker
shared with the aspect - fail-closed at the filter instead of abstaining,
per docs/plans/request-authorization-delegation.md option 2. Generic
CRUDular endpoints (functional handlers) and consumer RouterFunctions
stay on the URL check. Supersedes the ObjectProvider aspect-gate draft on
crudRequestAuthorizationManager.

Claude-Session: https://claude.ai/code/session_01EpeQsTSU59Ni6tsCLJpk6D

christian.keller added 1 commit

2026-09-02 11:04:04 +00:00

fix: review findings

/ release (pull_request) Successful in 3m11s

Details

5a03be379a