Obtaining actual parameter values in a Jersey ResourceFilterFactory

Question

I want to implement custom authorisation in my REST services using Jersey. This custom authorisation inspects annotations on methods as well as the actual parameters that a method receives.

My jax-rs annotated method looks like:

@GET
@Path("customers")
@Requires(Role.CustomerManager)
public Customer getCustomer(@ParseFromQueryString @CheckPermission final Customer customer) {
    // ...
}

The @ParseFromQueryString is an annotation that indicates Jersey (through an Injectable provider) to unmarshall a Customer from a query string. The code for that looks like:

public class QueryStringCustomerInjectable implements Injectable<Customer> {
  public Customer getValue() {
    final Customer customer = new Customer();
    // ... a UriInfo was injected using the @Context annotation
    // ... extract parameters from QueryString and use setters
    return customer;
  }
}

The @CheckPermission annotation indicates my custom authoriser that permissions are to be checked on a customer. Some users have access to information on some customers. Similarly, the @Requires annotation takes a role that the invoker should have. These are not java's security roles (Strings), rather, they are enum values.

Using Jersey's ResourceDebuggingFilter as a starting point, I have been able to get to the point of knowing which method will be invoked. However, I still haven't figured out how to determine which parameters will actually be used to invoke the method.

At the top of my head, I can think of two work arounds:

1. A Method interceptor using Guice + Jersey.
2. Code this logic in the QueryStringCustomerInjectable, but this seems a bit sloppy. It would be a class doing too much.

Yet, I would really like to do this using only Jersey / JAX-RS. I feel that I am so close!

Ideas? Pointers?

Thanks!

Answer 1

You should use Filters or Interceptors to handle all the information about method. see Jersey Filter and Interceptors