fix: register RequestUtil as a component for non-Boot Spring scans#24797
fix: register RequestUtil as a component for non-Boot Spring scans#24797totally-not-ai[bot] wants to merge 3 commits into
Conversation
Annotate RequestUtil with @component so that applications relying on a plain package scan of com.vaadin.flow.spring (e.g. Spring MVC apps that set up the SpringServlet via a WebMvcConfigurer rather than the Spring Boot auto-configuration) can find the bean. This mirrors the existing VaadinDefaultRequestCache, which is both @Component-annotated and exposed as a @bean from SpringSecurityAutoConfiguration. Fixes #24796
|
IIRC we avoid using But @heruan can for sure provide better insights. |
Replace the @component annotation on RequestUtil with a dedicated RequestUtilConfiguration @configuration class, following the convention of exposing library beans through configuration classes rather than stereotype annotations. A plain component scan of com.vaadin.flow.spring does not pick up SpringSecurityAutoConfiguration, since auto-configuration classes are discovered through the auto-configuration imports mechanism instead. The new configuration class is a regular component-scannable @configuration, so applications relying on such a scan (for example a Spring MVC app that registers the SpringServlet itself) get the RequestUtil bean. Both bean definitions are now @ConditionalOnMissingBean so exactly one RequestUtil is created when the configuration class and the auto-configuration are both present.
The Flow Spring Security beans (including RequestUtil) are only created when spring-security-config is on the classpath, because the configuration is gated by @ConditionalOnClass(WebSecurityCustomizer.class). That dependency is optional in the Vaadin Spring support, so a project that misses it silently gets none of these beans. Document this on the class, and explain that non-Boot applications which do not use the auto-configuration import mechanism should register the configuration explicitly (for example via @import) rather than relying on a plain component scan. This reverts the earlier attempt to expose RequestUtil through a component/configuration class, which is unnecessary once the required dependency is present.
|
Updated based on the findings in #24796: the root cause isn't a missing bean registration. Accordingly I reverted the |
|
1 participant
Annotate RequestUtil with @component so that applications relying on a
plain package scan of com.vaadin.flow.spring (e.g. Spring MVC apps that
set up the SpringServlet via a WebMvcConfigurer rather than the Spring
Boot auto-configuration) can find the bean. This mirrors the existing
VaadinDefaultRequestCache, which is both @Component-annotated and exposed
as a @bean from SpringSecurityAutoConfiguration.
Fixes #24796