spring_security_core library

Security that does not depend on HTTP: who is logged in, users and password hashes, and access rules on bean methods. Import it in a Flutter app or any spring_boot_dart application that needs logins or @PreAuthorize.

What it gives:

The current user: SecurityContextHolder keeps the Authentication of each request on a server (per Zone), and of the whole app in Flutter.
Logins: you write a UserDetailsService that loads your users; the auto-configured AuthenticationManager checks passwords against it and publishes success and failure events.
Password hashing: PasswordEncoders for Argon2 (the default), PBKDF2 and scrypt in Spring's formats, so hashes move between Java and Dart, behind a DelegatingPasswordEncoder that names the algorithm in each hash ({argon2}...).
Method security: @PreAuthorize, @PostAuthorize, @Secured, @PreFilter and @PostFilter on bean methods, checked in the bean's proxy. Adding the dependency switches them on.
Building blocks for access rules: AuthorizationManagers for roles, authorities and login kinds, and RoleHierarchyImpl.

@Service()
class OrderService {
  // Admins cancel any order, other users only their own.
  @PreAuthorize("hasRole('ADMIN') or #order.owner == principal.username")
  Future<void> cancel(Order order) async { ... }
}

The web side (the filter chain in front of controllers, form, basic and token logins, sessions, CSRF) is spring_boot_starter_security, which brings this package. This import re-exports spring_boot_starter_logging and, through it, spring_boot_dart and spring_core_dart. It is the Dart version of Spring Security's core (spring-security-core with method security).

Classes

AbstractAuthenticationEvent: The base class of the application events about logins and logouts.
AbstractAuthenticationFailureEvent: Published by ProviderManager when a login is refused; a subclass tells why.
AbstractAuthenticationToken: A base class for Authentication implementations: it stores the authorities, the details and the authenticated flag, and derives name from the principal.
AbstractBindingResult: The common part of every BindingResult: the error list, nested paths, message codes and the field queries.
AbstractMessageSource: The base class for message sources: it does the locale fallbacks, the formatting and the parent lookup, so that a subclass only says where the texts are.
AbstractPropertyResolver: The common part of property resolvers: placeholder resolution, conversion, defaults and required keys. A subclass only says where raw values come from, in getRawProperty.
AbstractPropertySource<T extends Object>: One place property values come from, under a name: a config file, the command line, the environment variables, a map of defaults.
AbstractResource: A base class for new kinds of Resource: it fills in everything that can be derived from a few members.
AccountStatusUserDetailsChecker: The check run before the password: refuses locked, disabled and expired accounts, in that order.
AdviceBinding: The type of an advice parameter that the pointcut fills in, such as timed in @annotation(timed) or id in args(id, ..).
Advised: The interface every generated AOP proxy implements: it exposes the bean behind the proxy and the advice applied to it.
Advisor: A piece of advice packaged as an object: the MethodInterceptor to run around calls of other beans.
After: Marks an aspect method to run after each matched call, whether it returned or threw, like a finally block.
AfterReturning: Marks an aspect method to run after each matched call that returned normally, with the returned value.
AfterThrowing: Marks an aspect method to run after each matched call that threw, with the error.
AnnotationConfigApplicationContext: The application context of this package: it builds its beans from the BeanModules the generator writes for @ComponentScan.
AnnotationMatchingPointcut<A>: A pointcut that matches members carrying an annotation of type A, or every member of beans whose class carries it.
AnnotationPointcut: A marker for pointcuts that match only members or classes carrying annotations from outside package:spring_core_dart, such as @Cacheable or @Validated.
AnonymousAuthenticationToken: The identity given to a caller who has not logged in.
AntPathMatcher: The PathMatcher for Ant-style patterns, the syntax of locations such as resources*:i18n/**/*.properties.
AopContext: Gives an advised bean access to its own proxy, so it can call itself with the advice applied.
AopPointcut: A rule that decides which members of which beans an advisor's advice applies to.
AopProxyFactory: Knows how to wrap one bean class in its generated proxy class, and which of its members can be advised.
AopUtils: Helpers that tell whether an object is an AOP proxy and find the bean behind it.
ApplicationArguments: The arguments the program was started with, split into --options and plain arguments.
ApplicationContext: A running application's container: it holds the beans and gives access to the configuration, events, translated messages and resource files.
ApplicationContextAware: Implemented by a bean that wants the application context handed to it through a method call.
ApplicationContextAwareProcessor: The bean post-processor that calls the *Aware callbacks of this library on each bean, with the context's objects.
ApplicationContextEvent: The base class of the events a context publishes about itself: refreshed, started, stopped, paused, restarted, closed.
ApplicationContextInitializedEvent: Published once the context is created and the ApplicationContextInitializers have run, before any bean is created.
ApplicationContextInitializer: Code that prepares the context before its beans are created.
ApplicationEnvironmentPreparedEvent: Published once every property is known (command line, environment variables, config files, active profiles) and before the context is created.
ApplicationEvent: An optional base class for application events: it records which object raised the event and when.
ApplicationEventMulticaster: The part of the context that holds the listeners and delivers each published event to those that accept it.
ApplicationEventPublisher: Sends an event to every listener interested in it.
ApplicationEventPublisherAware: Implemented by a bean that wants the event publisher handed to it through a method call.
ApplicationFailedEvent: Published when the start fails or a runner throws, before the failure is reported and the context is closed.
ApplicationListener<E extends Object>: A bean that listens to one type of event by implementing an interface.
ApplicationListenerAdapter<E>: A GenericApplicationListener made from a function or an ApplicationListener, for events (or published objects) of type E.
ApplicationPreparedEvent: Published when the context is fully prepared, just before its beans are created.
ApplicationReadyEvent: Published when the start is complete: every bean is created and every runner has finished.
ApplicationRunner: A bean with work to do once, right after the application has started.
ApplicationStartedEvent: Published once every bean is created and the Started ... line is logged, just before the ApplicationRunners are called.
ApplicationStartingEvent: The first event of a run, published as soon as run begins, before anything is read or created.
Argon2PasswordEncoder: A PasswordEncoder using Argon2id, the winner of the Password Hashing Competition and the default for new hashes here.
Around: Marks an aspect method to run instead of each matched call, deciding whether and how the real method runs.
ArrayNode: A JSON array: an ordered list of child nodes, which can be changed in place.
Aspect: Marks a bean class as an aspect: a bean whose advice methods run around the calls of other beans.
AspectAdvice<A extends Object>: One advice method of an @Aspect class, described so it can be called without reflection.
AspectAdviceInterceptor: The MethodInterceptor that runs one aspect advice method: it turns the advice kind (before, after, around, ...) into the right place in the call.
AspectAutoProxyCreator: The bean post-processor that puts advice into effect: it replaces each bean that some advice matches with the bean's generated proxy.
AspectJProxyFactory: A ProxyFactory that also takes the advice of an @Aspect object.
AspectMetadata<A extends Object>: Everything the container needs to know about an @Aspect class: its advice methods, its named pointcuts and its instantiation model.
AssertFalse: A constraint that requires a bool to be false; null passes.
AssertTrue: A constraint that requires a bool to be true; null passes.
Async: Runs an @EventListener method on a TaskExecutor instead of in the publishing call.
AsyncMethodInvocation: The MethodInvocation of a method that returns a Future (or FutureOr), with a way to run code when that future completes.
AsyncStartup: A bean whose start finishes only after the context's refresh, such as a web server whose socket is bound asynchronously.
AuthenticatedAuthorizationManager<T>: An AuthorizationManager that grants by the kind of login, not by authorities: any real login, a full login, or only anonymous users.
Authentication: Who is calling and what they may do: the user's identity, their authorities and whether they are authenticated.
AuthenticationEventPublisher: Where ProviderManager reports each login outcome.
AuthenticationFailureBadCredentialsEvent: A login was refused for a wrong password or an unknown username (a BadCredentialsException or UsernameNotFoundException).
AuthenticationFailureCredentialsExpiredEvent: A login was refused because the password has expired.
AuthenticationFailureDisabledEvent: A login was refused because the account is disabled.
AuthenticationFailureExpiredEvent: A login was refused because the account has expired.
AuthenticationFailureLockedEvent: A login was refused because the account is locked.
AuthenticationFailureProviderNotFoundEvent: A login was refused because no AuthenticationProvider handles its kind of request, usually a configuration error.
AuthenticationFailureServiceExceptionEvent: A login could not be checked because something failed, such as the user store (an AuthenticationServiceException).
AuthenticationManager: The service that checks a login: given what the user presented, it returns the authenticated Authentication or throws.
AuthenticationProvider: One way of checking a login, such as "username and password against the user store" or "an API key against a table".
AuthenticationSuccessEvent: Published by ProviderManager each time a login succeeds, by any method (form, basic, bearer token, or a call of your own).
AuthenticationTrustResolver: Tells what kind of login an Authentication is: anonymous, "remember me", or a real one.
AuthenticationTrustResolverImpl: The standard AuthenticationTrustResolver: an AnonymousAuthenticationToken is anonymous, everything else that is authenticated is a real login.
AuthorityAuthorizationDecision: An AuthorizationDecision of a role or authority check that also says which authorities would have granted access, for logs and error pages.
AuthorityAuthorizationManager<T>: An AuthorizationManager that grants access when the user has one of the given authorities, after the roleHierarchy expanded the user's own.
AuthorityUtils: Helpers that turn authority names into GrantedAuthority lists and back.
AuthorizationDecision: The usual AuthorizationResult: a plain yes or no.
AuthorizationManager<T>: An access check: given the current user and the thing being accessed, of type T, it decides whether access is granted.
AuthorizationManagers: Builds one AuthorizationManager out of several: either, both, or the opposite.
AuthorizationResult: The answer of an access check: granted or not.
AutoConfiguration: Marks a class of a library (a "starter") whose @Bean methods give applications default beans, unless an application declares its own.
AutoConfigurationModule: Marks the module of beans a library (a "starter") adds to every application that depends on it.
AutowireCapableBeanFactory: The part of the container that injects and initializes objects it did not create.
Autowired: Asks the container to inject beans into a field, setter, method or constructor.
Aware: The common supertype of the interfaces through which the container hands a bean one of its own objects: its bean name, the bean factory, the environment and so on.
Banner: Text printed once when the application starts, before the context is created.
Bean: Marks a method whose return value is a bean.
BeanConstructor<T extends Object>: The description of the constructor an introspected class is created with (the unnamed one, or the one marked @JsonCreator()), with a closure that calls it.
BeanDefinition<T extends Object>: The recipe for one bean: its name, the types it can be found by, its scope and flags, and the closures that create, inject, initialize and destroy it.
BeanDefinitionRegistry: The write side of the container: where bean definitions are registered, removed and given aliases.
BeanDefinitionRegistryPostProcessor: A BeanFactoryPostProcessor that may also add, remove or replace bean definitions, before any postProcessBeanFactory runs.
BeanExpressionContext: The root object of @Value('#{...}') expressions, whose properties are the beans of a bean factory.
BeanExpressionContextAccessor: A PropertyAccessor that reads the beans of a BeanExpressionContext as its properties, so that #{mailer} is the bean mailer.
BeanExpressionResolver: Evaluates the #{...} expressions of @Value strings, after their ${...} placeholders are resolved.
BeanFactory: The read side of the container: it hands out beans by type or by name and answers questions about them without creating them.
BeanFactoryAccessor: A PropertyAccessor that reads beans as properties of a BeanFactory itself, for expressions whose value is a bean factory (factory.mailer).
BeanFactoryAware: A bean that is handed the bean factory that created it, so it can look up other beans by itself while it runs.
BeanFactoryPostProcessor: A hook that runs once at startup, after all bean definitions are registered and before any ordinary bean is created, to inspect or change them.
BeanFactoryResolver: A BeanResolver that answers @name references with the beans of a BeanFactory.
BeanFactoryUtils: Helpers that list beans across a whole hierarchy of factories, and that handle the & prefix of factory bean names.
BeanIntrospection<T extends Object>: Everything the generator knows about an introspected class: its properties, methods, constructor and annotations, with closures to use them.
BeanIntrospector: The registry that finds the BeanIntrospection of a class or object.
BeanMethod<T extends Object>: The description of one public instance method of an introspected class or bean, with a closure that calls it.
BeanMethodAnnotation: Marks an annotation class whose methods the runtime can find on beans.
BeanModule: Everything the generator found in one scanned directory: the bean definitions, plus the property files, imports and embedded resources that come with them.
BeanNameAware: A bean that is told the name it is registered under.
BeanParameter: The description of one parameter of a constructor or method: its name, full type, whether it is named or required, and its annotations.
BeanPostProcessor: A hook that sees every bean as it is created, and may change or replace it before the container hands it out.
BeanProperty<T extends Object>: The description of one property of an introspected class: its name, type, annotations, and closures that read and write it.
BeanPropertyBindingResult: The BindingResult for an @Introspected object, the one used almost everywhere.
BeanRegistrar: Code that registers beans, written by hand instead of with annotations.
BeanRegistry: Where a BeanRegistrar registers its beans: a short API that turns each call into a bean definition of the context.
BeanResolver: Looks up the object an @name (or &name) reference stands for.
BeanValidator: The validator: it checks an object against the constraint annotations on its class (@NotBlank(), @Min(18), custom Constraints) and reports what is broken.
BeanWrapper: Reads and writes the properties of an object by path (address.city, tags[0]), converting written values to the property types.
Before: Marks an aspect method to run before each matched call.
Binder: Reads a group of properties from the environment as one typed value: a list, a map, a Duration or a whole settings object.
BindHandler: Hooks into a Binder.bind call, called for every property bound on the way: the top-level name, then each nested property and element.
BindingResult: The outcome of binding input onto an object and validating it: the Errors together with the object they are about.
BindResult<T>: The outcome of Binder.bind: the value, or the fact that no property was set.
BooleanNode: A JSON true or false.
BuiltinMethodResolver: A MethodResolver for the common methods of core Dart types, under their Dart names and the Java names Spring expressions use (size(), toUpperCase(), charAt(), equals(), getOrDefault(), putIfAbsent()).
BuiltinPropertyAccessor: A PropertyAccessor for the common read-only properties of core Dart types, which expressions cannot reach otherwise without reflection.
ByteArrayResource: A resource over bytes held in memory.
ClasspathResources: The registry behind classpath: locations: the files of lib/resources/ of the application and of its dependencies.
ClassType<T>: The TypeInfo of a class or scalar type that needs no further description: ClassType<String>(), ClassType<Book>().
ClockProvider: Where the date constraints (@Past(), @FutureDate(), ...) get the current time.
CommandLineRunner: A bean with work to do once after the application has started, which receives the program arguments as the raw list.
CommonAnnotationBeanPostProcessor: A marker in the post-processor chain that says where the @PostConstruct methods run.
Component: Marks a class as a bean: an object the container creates once, injects into others and closes at shutdown.
ComponentScan: Generates a module with every bean declared in the directory of the annotated file and its subdirectories.
ComposablePointcut: A pointcut built from other pointcuts with "or" (union) and "and" (intersection).
CompositePropertySource: One property source made of several others, asked in order.
CompositeStringExpression: A template made of several parts, text and #{...} expressions, whose value is the parts joined into one string.
Condition: A rule that decides whether a bean is registered at all.
Conditional: Registers a bean only when every listed Condition matches.
ConditionalOnBean: Registers a bean only when some other bean is already registered.
ConditionalOnBooleanProperty: Registers a bean only when a true / false property has the wanted value.
ConditionalOnCloudPlatform: Registers a bean only when the application runs on a given cloud platform, such as Kubernetes.
ConditionalOnExpression: Registers a bean only when an expression evaluates to true.
ConditionalOnMissingBean: Registers a bean only when no such bean is registered yet: the way a library offers a default that the application can replace.
ConditionalOnProperty: Registers a bean only when a property is set, or set to a given value.
ConditionalOnResource: Registers a bean only when every one of some files exists.
ConditionalOnSingleCandidate: Registers a bean only when exactly one bean of a type can be injected where that type is asked for.
ConditionContext: What a Condition can look at to decide: the configuration, the bean definitions registered so far, resource files, and the definition being decided.
ConditionEvaluation: The outcome of one condition evaluated while a context loaded its modules: which bean or class it guarded, and whether it matched.
ConditionEvaluationCache: A ConditionContext that remembers results while the modules load, so a ConditionGroup is decided only once.
ConditionEvaluationRecorder: Receives the outcome of every condition evaluated, for ConditionEvaluation reports.
ConditionEvaluationReport: The list of @Conditional... checks made while the beans were registered, with which ones matched and which did not.
ConditionGroup: The conditions of one configuration class, decided once for the whole class, so that the class is registered all or nothing.
ConfigDataEnvironment: Reads the application's config files (application.properties, application.yml and their profile variants, imports, config trees) into an environment and sets the active profiles they name.
Configurable: Lets the container inject an object it did not create, such as a Flutter State.
ConfigurableApplicationContext: An application context that can also be set up, started, paused and closed.
ConfigurableBeanFactory: The settings side of a bean factory: parent, conversion, @Value resolution, bean post-processors, custom scopes, dependency records and shutdown.
ConfigurableEnvironment: An Environment that can be changed: its list of property sources, its profiles and how it converts and resolves values.
ConfigurableListableBeanFactory: The container's full control: besides handing out beans, it lets code change bean definitions and the container's setup before any bean is created.
ConfigurablePropertyResolver: A PropertyResolver whose behaviour can be set: the conversion service, the placeholder syntax, and keys that must be present.
Configuration: Marks a class whose Bean methods create beans.
ConfigurationCondition: A Condition decided in one ConfigurationPhase only; plain conditions count in both.
ConfigurationProperties: Turns a class into a typed view of a group of settings: every field is filled from the property of the same name under prefix.
ConfigurationPropertiesBinder: The machinery that fills @ConfigurationProperties beans from the environment and validates them.
ConfigurationPropertyName: A property name split into its elements (app, read-timeout) and compared the relaxed way, so app.readTimeout, app.read_timeout and app.read-timeout are the same name.
ConfigurationPropertySources: Makes an environment find a property however a source spells it: a read of app.read-timeout also finds app.readTimeout, app.read_timeout or the variable APP_READTIMEOUT.
ConfigurationPropertySourcesPropertySource: The property source that ConfigurationPropertySources.attach puts first in an environment, so reads of a property find it under any spelling.
ConsoleAppender: The console output: formats each record with a LogPattern and passes the text to out, print by default.
Constraint: The base class of every validation rule written as an annotation, such as @NotBlank() or @Min(18), and the class to extend for your own.
ConstraintValidatorContext: The help a constraint gets while it checks one value: the validator's clock, and a way to report violations other than the default one.
ConstraintViolation: One broken rule: which constraint failed, where (the property path), on which value, and the finished message.
ConstraintViolationBuilder: A violation being put together inside a constraint: its message is set, a property path may be added, and addConstraintViolation reports it.
ConstructorBound: The hook the generated code uses to create a @ConfigurationProperties bean whose class has constructor parameters.
ConstructorResolver: A plug-in that tells expressions how to create an object for new Name(...).
ContextClosedEvent: Published when a context starts closing, while every bean is still available.
ContextPausedEvent: Published after pause() (or pauseAsync()) was called on a context: the pauseable lifecycle beans are stopped, for example while a Flutter app is in the background.
ContextRefreshedEvent: Published once a context has started: every eager singleton exists and the auto-startup lifecycle beans run.
ContextRestartedEvent: Published after restart() was called on a context: the auto-startup lifecycle beans run again, typically after a pause.
ContextStartedEvent: Published after start() was called on a context and its lifecycle beans were started.
ContextStoppedEvent: Published after stop() was called on a context and its running lifecycle beans were stopped.
Controller: Marks a class as a bean of the presentation layer.
ConversionService: Turns a value into a value of another type, such as the text '10s' from a config file into a Duration.
ConverterRegistry: The part of a conversion service that accepts new converters.
ConvertGroup: An annotation next to @Valid() that checks the nested value with another group: when the outer validation runs group from, the nested value is checked with group to.
CredentialsContainer: An object that holds a secret, such as a password, and can forget it.
CredentialsExpiryChecker: The check run after the password matched: refuses an expired password with a CredentialsExpiredException.
CustomScope: A place that keeps bean instances for a span of your choosing, such as a screen, a session or a job, and so defines a custom bean scope.
DaoAuthenticationProvider: The password login: it loads the user from a UserDetailsService and checks the typed password against the stored hash with a PasswordEncoder.
DataBinder: Copies input values, usually strings from a form or a query, onto the properties of an @Introspected object, then validates it, collecting every problem in one bindingResult.
DataSize: An amount of data, such as an upload limit or a cache size, stored as a whole number of bytes.
DataSizeUnit: The unit of a DataSize property written as a plain number.
DecimalMax: A constraint that requires a number below a decimal limit, or equal to it when inclusive.
DecimalMin: A constraint that requires a number above a decimal limit, or equal to it when inclusive.
DeclareParents: Makes the proxies of matching beans implement an extra interface, with an implementation the aspect supplies (an AspectJ "introduction").
Default: The validation group of every constraint declared without groups.
DefaultAuthenticationEventPublisher: The default AuthenticationEventPublisher: it publishes each outcome as an application event that @EventListener methods receive.
DefaultClockProvider: The ClockProvider of the system clock, DateTime.now(); the default of BeanValidator.
DefaultConversionService: A conversion service that already knows the types configuration values are usually read as: numbers, booleans, durations, data sizes, URIs, dates, encodings, resources and lists, sets and maps of them.
DefaultLifecycleProcessor: The LifecycleProcessor every context uses unless it declares its own: it starts the lifecycle beans phase by phase, lowest first, and stops them in the reverse order.
DefaultListableBeanFactory: The bean container itself: it holds the bean definitions, creates the beans in dependency order, injects them, and destroys them at the end.
DefaultMessageCodesResolver: The standard message codes of errors, the ones every binding result and validator uses unless told otherwise.
DefaultMessageRendering: Implemented by a MessageSourceResolvable whose default message must not go through MessageFormat.
DefaultMessageSourceResolvable: A ready-made MessageSourceResolvable: codes, arguments and a default message given as values.
DefaultPointcutAdvisor: The standard PointcutAdvisor: a pointcut, an interceptor and an order.
DefaultPropertySourceFactory: The factory @PropertySource uses when none is named: it reads the file as .properties.
DefaultResourceLoader: The ResourceLoader used everywhere: it knows resources:, file:, http:, https: and package: locations, plus any prefix taught by a ProtocolResolver.
DefaultValue: The value a constructor parameter of a @ConfigurationProperties class takes when its property is not set.
DeferredImportSelector: An ImportSelector that runs after every other module and component has been loaded.
DeferredLogs: A copy of every log record written while the application starts, kept for a logging system that is set up later.
DelegatingMessageSource: A message source with no messages of its own: it asks its parent, or fails when there is none.
DelegatingPasswordEncoder: A PasswordEncoder that stores the algorithm's name in front of each hash, as {id}, and checks every hash with the encoder of its id.
DenyAllPermissionEvaluator: The PermissionEvaluator used until the application declares one: it answers false to every hasPermission, so a forgotten evaluator denies rather than allows.
Dependency: The description of one injection point of a bean, used to check the bean graph at startup before anything is created.
DependencyResolver: The view of the container that a bean definition's create and inject callbacks receive, to get the dependencies of the bean being built.
DependsOn: Names beans that must be created before this one and destroyed after it.
Description: A human-readable description of a bean.
DescriptiveResource: A resource that never exists, standing for a location that cannot be resolved.
DestructionAwareBeanPostProcessor: A BeanPostProcessor that is also called before each bean is destroyed.
Digits: A constraint that limits how many digits a number has before and after the decimal point.
DisposableBean: A bean that wants a call when the container discards it, to release what it holds: connections, files, timers, subscriptions.
DurationStyle: Reads and writes durations as text, in the two forms configuration files use: the short form 10s and ISO-8601 PT10S.
DurationUnit: The unit of a Duration property written as a plain number.
DynamicType: The TypeInfo of dynamic, Object? or a type that is not described further: values are taken as they are. void (e.g. of ResponseEntity<void>) is DynamicType.forVoid, so a reader can ignore the value.
Each: An annotation that checks every element of a list or set, or every value of a map, against constraints.
EachKey: An annotation that checks every key of a map against constraints.
Email: A constraint that requires a string to look like an email address.
EmbeddedResource: The content of one file of lib/resources/, written into the generated code at build time.
EmbeddedValueResolverAware: Implemented by a bean that resolves @Value-style texts itself: it receives a function that resolves ${...} placeholders and #{...} expressions.
EncodedResource: A resource paired with the character encoding to read it in; null means UTF-8.
EnumerablePropertySource<T extends Object>: A property source that can list every key it has.
EnumType<E extends Enum>: The TypeInfo of an enum, with its values, so a value can be found by name: EnumType<Mood>(Mood.values). jsonValue reads the field marked @JsonValue(), when the enum has one.
Environment: The application's configuration as code sees it: every property from every source (config files, command line, environment variables), and the active profiles.
EnvironmentAccessor: A PropertyAccessor that reads configuration properties of an Environment, so that environment['app.name'] in an expression is the value of app.name.
EnvironmentAware: Implemented by an object that wants the configuration (properties and profiles) handed to it through a method call.
EnvironmentMethodResolver: A MethodResolver that lets expressions call the methods of an Environment (or any PropertyResolver) under their Java names.
EnvironmentPostProcessor: Code that changes the application's properties or profiles before any bean is created.
Errors: The list of errors found for one object, and the way a validator records them.
EvaluationContext: The world an expression is evaluated in: its root object, its variables, and the plug-ins that decide which properties, methods, types and beans it can reach.
EventListener: Marks a bean method that the context calls for each published event of its parameter type.
EventListenerMethod<T extends Object>: One @EventListener method of a bean class T, described by generated code: which events it takes, its condition, its order and how to call it.
EventResultType<R extends Object>: The declared result type R of an @EventListener method (the element type of an Iterable result), so that its results are published as R.
ExitCodeEvent: Announces that the application is about to end with a non-zero exit code.
ExitCodeExceptionMapper: Turns the error that made a runner fail into an exit code.
ExitCodeGenerator: An object that decides the exit code of the process when the application ends.
Expression: A parsed expression, ready to be evaluated as often as needed.
ExpressionParser: Turns expression text into an Expression that can be evaluated.
ExpressionPointcut: A pointcut written as an AspectJ-style expression, the syntax of the @Before / @Around / ... annotations.
ExpressionState: The working state of one evaluation: which object names currently apply to, what #this is, and how many operations have run.
FactoryBean<T extends Object>: A bean whose job is to make another object: the container hands out what getObject returns, not the factory itself.
FailureAnalysis: A plain-language explanation of why the application failed to start, with what to do about it.
FailureAnalyzer: Explains a startup error that spring_boot_dart does not know, as an APPLICATION FAILED TO START report instead of a stack trace.
Fallback: Makes this bean the one used only when no other bean of the type is there.
FieldError: A validation or binding error about one field of an object: which field, the value that was rejected, and the message codes.
FileAppender: A log file, which the web cannot have: this version keeps the API of the real one so code compiles everywhere, but its constructor throws.
FileSystemResource: A Resource for a file (or directory) on the local file system, given by its path.
Filter: A rule that selects classes for ComponentScan.includeFilters or ComponentScan.excludeFilters.
FunctionMethodResolver<T extends Object>: A MethodResolver for objects of type T, built from one function per method name.
FunctionPropertyAccessor<T extends Object>: A PropertyAccessor for objects of type T, built from one getter (and optionally one setter) function per property name.
FunctionProtocolResolver: A ProtocolResolver made from a function, for a resolver too small to deserve a class.
FutureDate: A constraint that requires a DateTime after now.
FutureOrPresent: A constraint that requires a DateTime that is not in the past.
GenericApplicationListener: A listener that receives any event and decides at runtime, per event, whether to handle it.
GenericConversionService: A conversion service that starts empty and converts only what is registered on it.
GenericType<T>: The TypeInfo of a generic class other than the collections, with the descriptions of its type arguments: GenericType<ResponseEntity<Book>>([ClassType<Book>()]). T is the whole type; arguments describe its type arguments in order.
GlobalSecurityContextHolderStrategy: A strategy with exactly one context for the whole program.
GrantedAuthoritiesMapper: Turns the authorities a login produced into the ones the application checks.
GrantedAuthority: One permission held by a logged-in user, named by a string such as ROLE_ADMIN (a role), SCOPE_read (an OAuth scope) or any name the application chooses.
GrantedAuthorityDefaults: Changes the prefix that role checks add, ROLE_ by default.
GroupSequence: A class annotation that checks the class's rules in stages: the groups in value are checked in order, and checking stops at the first group with a violation.
HierarchicalBeanFactory: A bean factory with a parent: what it cannot find among its own beans, it looks up in the parent.
HierarchicalMessageSource: A MessageSource that asks a parent message source for the codes it does not have.
Import: Adds beans that the component scan does not find: configuration classes from elsewhere, or code that registers beans.
ImportBeanDefinitionRegistrar: Code that registers full bean definitions, with access to the ones already registered.
ImportDeclaration: One entry of @Import that names code registering beans (a BeanRegistrar, ImportSelector or ImportBeanDefinitionRegistrar), recorded in BeanModule.registrars.
ImportSelector: Code that chooses, at startup, which modules of beans to add.
IndexAccessor: A plug-in that makes target[index] work for your own indexable types.
InitializingBean: A bean that wants a call once all its dependencies are injected, to finish its setup.
Inject: Asks the container to inject a field, setter, method or constructor; the standard Java (JSR-330) name for Autowired.
InMemoryProtocolResolver: A ProtocolResolver that serves prefix:path locations from a map of paths to text held in memory.
InMemoryUserDetailsManager: A user store kept in a map in memory, for tests, demos and small tools.
InstantiationAwareBeanPostProcessor: A BeanPostProcessor that is also called around the creation and the injection of each bean, not only around its initialization.
InteractiveAuthenticationSuccessEvent: Published when a user logged in through the login form and is now logged in for the session.
InterfaceMetadata<T extends Object>: The description of an interface that is implemented by a proxy: its name, its annotations and its methods.
InterfaceProxies: The lookup that generated proxy code uses to get its handler; not meant for other code.
InterfaceProxy: Marks an annotation class whose interfaces become beans implemented by generated code: each call is handed to an InvocationHandler.
Introduction: An extra interface that a @DeclareParents field adds to the proxies of matching beans, with the way to create its implementation.
Introspected: Marks a class whose properties, constructor and methods the generator describes, so the framework can read and fill its objects without reflection.
IntrospectionMethodResolver: A MethodResolver that calls the methods of @Introspected classes, using the metadata the code generator wrote for them.
IntrospectionPropertyAccessor: A PropertyAccessor that reads and writes the properties of @Introspected classes, using the metadata the code generator wrote for them.
InvocationHandler: The object that does the work of an interface proxy: every call of the generated implementation ends up in invoke.
InvocationHandlerFactory: A bean that provides the InvocationHandler for the interface proxies it supports, for example those annotated @FeignClient.
JoinPoint: One intercepted call, as advice sees it: which member is called, on which bean, with which arguments.
JsonAlias: Other JSON names a property (or constructor parameter) is read from, besides its own.
JsonAnyGetter: Writes the entries of a map property as extra properties of the object, after the declared ones.
JsonAnySetter: Collects the JSON properties a class does not have, instead of skipping them or failing.
JsonCreator: Marks the constructor (or factory constructor) the mapper creates objects with when reading JSON.
JsonDeserializer<T extends Object>: Custom code that builds values of T from decoded JSON, for a type the mapper cannot read on its own or should read differently.
JsonFeature: An on/off setting of a mapper, named after Jackson's feature flags.
JsonFormat: Changes the JSON form of one property's value: a date pattern and time zone, or a shape (a number as a string, an enum by index, ...).
JsonIgnore: Leaves a property out of JSON in both directions.
JsonIgnoreProperties: Lists JSON properties a class ignores, and can make it accept unknown ones when reading.
JsonInclude: Decides which values of a property, or of every property of a class, are written: for example, leave out nulls.
JsonMapper: An ObjectMapper with a builder, for configuring a mapper step by step in Jackson 3's style.
JsonMapperBuilder: Collects settings, serializers and modules, then creates a JsonMapper with build.
JsonMapperBuilderCustomizer: A bean that adjusts the auto-configured ObjectMapper while keeping everything else about it.
JsonModule: A group of serializers and deserializers that is added to a mapper in one step.
JsonNaming: Sets the naming strategy of one class's properties, overriding the mapper's.
JsonNode: One value of a JSON document held as a tree: an object, array, string, number, boolean or null, with typed accessors for navigating it.
JsonProperty: Gives a property, constructor parameter or enum constant another name in JSON, or limits it to one direction.
JsonPropertyOrder: Puts chosen properties of a class first when it is written, for JSON that people read or that a fixed format expects.
JsonSerializer<T extends Object>: Custom code that writes values of T as JSON, for a type the mapper cannot handle or should write differently.
JsonSubType: One entry of JsonSubTypes: a subclass and the type ids it is written and read with (Jackson's @JsonSubTypes.Type).
JsonSubTypes: Lists the subclasses of a @JsonTypeInfo class and their type ids.
JsonTypeInfo: Makes a class hierarchy polymorphic in JSON: each object carries a type id, so a value of the base type is read back as the right subclass.
JsonTypeName: Sets the type id of a subclass in a @JsonTypeInfo hierarchy.
JsonUnwrapped: Writes the properties of a nested object inline, in the enclosing object, instead of under its own key.
JsonValue: Makes one value stand for the whole object in JSON: an enum constant's JSON form, or a small value class written as a plain string or number.
JsonView: Puts a property into one or more views, so the same class can be written with fewer or more properties depending on who reads it.
Lazy: Delays the creation of a bean, or of what an injection point receives, until it is first used.
LazyInitializationBeanFactoryPostProcessor: Makes every singleton bean lazy: created the first time it is needed, not at startup.
LazyInitializationExcludeFilter: Keeps some beans created at startup when spring.main.lazy-initialization=true makes the others lazy.
Lifecycle: A bean that runs something in the background between a start and a stop, such as a timer, a server or a connection.
LifecycleProcessor: The part of the context that starts and stops its Lifecycle beans, at refresh, pause, restart and close.
ListableBeanFactory: A bean factory that can list its beans: all names, the beans of a type, the beans carrying an annotation.
ListenerRegistration: What ApplicationContext.addListener returns: call remove to stop the listener.
ListeningSecurityContextHolderStrategy: A SecurityContextHolderStrategy that tells listeners about every setContext and clearContext, and leaves the rest to the strategy it wraps.
ListType<E>: The TypeInfo of a List<E>, with the description of its elements: ListType<Book>(ClassType<Book>()).
LiteralExpression: An expression whose value is fixed text: a template with no #{...} in it, or a text part of a template.
Locales: Helpers for locales written as strings, such as de_CH.
Log: An annotation that gives a class a ready-made log getter, so its methods can log without declaring a logger.
LogAppender: One output of the logging system: it receives every log record that passes the logger levels and writes it somewhere.
LogBuffer: The most recent log records, kept in memory so the application can show them: records, filtering with LogQuery, live streams, counters and text export.
LogFormatUtils: Formats values for log lines: what the framework writes about values from outside (a path, a user name, a header) goes through it.
LoggingSystem: Where log records go once this starter is installed: it receives every record written through SpringLog and sends it to the console, the in-memory buffer, the log file and any appender you added.
LoggingSystemInitializer: The bean that ties the LoggingSystem to the life of an application context. Applications never use it; the starter registers it.
LogoutSuccessEvent: Published by the web starter's logout when a logged-in user logged out; not for anonymous users.
LogPattern: A log line format: a pattern such as %d %5p [%logger] %m, read once, that turns each SpringLogRecord into text.
LogQuery: A filter for the records of a LogBuffer, such as "warnings and errors of neon.shop that mention payment".
Lookup: Marks a method that returns a bean of the container on every call.
MapAccessor: A PropertyAccessor that treats the entries of a map as properties, so user.name works when user is a map such as decoded JSON.
MapBindingResult: A BindingResult for values held in a map instead of an object.
MapPropertySource: A property source over a map of keys to values.
MapType<K, V>: The TypeInfo of a Map<K, V>, with the descriptions of its keys and values: MapType<String, int>(ClassType<String>(), ClassType<int>()).
MapValueResolver: A ValueResolver that reads the values from a map keyed by parameter path, the one to use with DataBinder.construct in most cases.
Matches: A constraint that requires a string to match the regular expression regexp as a whole.
Max: A constraint that requires a number of at most value.
MergedBeanDefinitionPostProcessor: A BeanPostProcessor that is shown each bean definition once, when its first bean has been constructed and before it is injected.
MessageCodesResolver: The rule that turns an error code and a field into the list of message codes an error carries.
MessageFormat: Fills arguments into a message pattern such as Hello {0}!, using the syntax of Java's MessageFormat, which message files are written in.
MessagesBundleCondition: A condition that matches when the message bundle exists, that is when resources:<basename>.properties exists for one of the configured basenames.
MessageSource: Turns a message code and a locale into a text in that language, with the arguments filled in.
MessageSourceAccessor: A wrapper around a MessageSource that remembers a locale, so that lookups need not pass it every time.
MessageSourceAware: Implemented by a bean that wants the translated messages handed to it through a method call.
MessageSourceResolvable: A message described by codes rather than text: the codes to look up, the arguments to fill in and a default text.
MethodInterceptor: Code that runs around calls of other beans, written as a class instead of an @Aspect method.
MethodInvocation: One intercepted call as a MethodInterceptor sees it: the call's details plus a way to continue it.
MethodResolver: A plug-in that tells expressions which code to run for a method call such as greeter.greet('Ada').
MethodSecurityAttributes: The security annotations that apply to one bean member, found the way Spring finds them.
MethodSecurityExpressionHandler: The engine behind method security: it parses the expressions of the security annotations and evaluates them for each call.
MethodSecurityExpressionRoot: What a security expression reads its names from: hasRole(...), principal, returnObject and the rest are members of this object.
MethodSecurityInterceptor: The code that runs around every call of a secured bean method and enforces its security annotations.
MethodSecurityPointcut: Selects the bean members that method security must wrap: those with a security annotation of their own or from their class.
MethodSecurityValidator: The startup check that makes sure no security annotation is silently ignored.
MethodSignature: What is known about an advised member without calling it: its name, its types, its annotations and those of its class.
MethodValidationInterceptor: The AOP advice that checks the arguments and the return value of a call against the method's constraints.
MethodValidationPostProcessor: The bean that turns on method validation: it applies a MethodValidationInterceptor to every bean whose class is annotated @Validated().
Min: A constraint that requires a number of at least value.
MissingNode: The stand-in that JsonNode.path and JsonNode.at return where the document has no node, so navigation can go on without null checks.
MustBeNull: A constraint that requires the value to be null, usually in one validation group only.
MutablePropertySources: The ordered list of property sources an environment reads from; for each key, the first source that has it wins.
Name: Gives a @ConfigurationProperties field or constructor parameter a property name other than its Dart name.
Named: Marks a class as a bean, or selects a bean at an injection point; the standard Java (JSR-330) name for Component and Qualifier.
NameMatchMethodPointcut: A pointcut that matches members by name, with * wildcards.
Negative: A constraint that requires a number below 0.
NegativeOrZero: A constraint that requires a number of 0 or less.
NoOpPasswordEncoder: A PasswordEncoder that stores the password as typed, without hashing.
NotBlank: A constraint that requires text with at least one visible character: null, '' and ' ' fail.
NotEmpty: A constraint that requires a string, list, set or map that is neither null nor empty.
NotNull: A constraint that requires a value: null fails, anything else passes.
NullAuthoritiesMapper: The GrantedAuthoritiesMapper that changes nothing: the default.
NullBean: The object that stands for a bean whose @Bean method (or create callback) returned null.
NullNode: A JSON null value, which is present (unlike a MissingNode).
NullRoleHierarchy: The RoleHierarchy used when the application declares none: every role is only itself.
NumericNode: A JSON number: an int when the JSON had no fraction, else a double.
ObjectError: A validation error about a whole object rather than one of its fields, such as "the passwords differ" or a failed class-level constraint.
ObjectFactory<T extends Object>: Something that returns an object of T when asked: the smallest form of a lazy dependency.
ObjectMapper: Converts Dart objects to JSON and back: the one place where models, JSON text, decoded maps and JsonNode trees meet.
ObjectNode: A JSON object: named child nodes, kept in insertion order.
ObjectProvider<T extends Object>: A handle on the beans of T that looks them up only when asked: one bean, the bean if there is one, or all of them.
ObjectReader: A reader bound to one @JsonView: it reads only the properties of that view and skips the others, with its mapper's settings.
ObjectWriter: A writer bound to one @JsonView: it writes only the properties of that view, with its mapper's settings.
OperatorOverloader: A plug-in that gives arithmetic operators a meaning for your own types, such as + on two money amounts.
Order: An annotation that gives a bean (or a @Bean method, an event listener method) its place when several are run or injected in turn; lower values come first.
OrderComparator: Sorts objects the way the framework does: PriorityOrdered first, then by order value, objects with equal values keeping their original order.
Ordered: An object that says where it goes when several objects of its kind are run or listed in turn; lower numbers come first.
ParserContext: Tells the parser whether a text is one expression or a template of literal text with embedded expressions, and which delimiters mark them.
PasswordCheckLimiter: Bounds the password checks (hashing) of the DaoAuthenticationProvider: at most maxConcurrent run at once, at most maxQueued wait, and another one fails at once with a PasswordChecksBusyException.
PasswordEncoder: Turns a password into a hash you can store, and later checks a typed password against that hash.
PasswordEncoderFactories: Creates the recommended PasswordEncoder for an application.
Past: A constraint that requires a DateTime before now.
PastOrPresent: A constraint that requires a DateTime that is not in the future.
PathMatcher: Tests paths such as config/dev/app.properties against patterns with wildcards such as config/**/*.properties, and pulls values out of them.
PathMatchingResourcePatternResolver: The ResourcePatternResolver used everywhere: it expands Ant-style patterns (*, **, ?) in file: and classpath locations.
PayloadApplicationEvent<T extends Object>: The envelope the context puts around a published object that is not an ApplicationEvent, adding a source and a timestamp.
Pbkdf2PasswordEncoder: A PasswordEncoder using PBKDF2, the key derivation function required by some standards (such as FIPS 140).
PermissionEvaluator: The application's answer to hasPermission(...) in security expressions: may this user do this to that object?
Pointcut: Gives a pointcut expression a name, so several advice methods can share it.
PointcutAdvisor: An Advisor that applies only to the members its pointcut selects.
Positive: A constraint that requires a number greater than 0.
PositiveOrZero: A constraint that requires a number of 0 or more.
PostAuthorize: Hands the result of a bean method to the caller only when an expression about it is true; otherwise the caller gets an AccessDeniedException instead.
PostConstruct: Marks a method the container calls once a bean is fully injected, before anyone uses it.
PostFilter: After a bean method returned a collection, removes the elements the current user may not see.
PreAuthenticatedAuthenticationToken: A login that another system has already checked: the application only learns who the user is and what they may do, and checks no password itself.
PreAuthorize: Allows a call of a bean method only when an expression about the current user and the arguments is true; otherwise the method does not run.
PreDestroy: Marks a method the container calls when a bean is destroyed: when the context closes for a singleton, when its scope ends for a scoped bean.
PreFilter: Before a bean method runs, removes from a collection argument the elements the current user may not touch.
Primary: Makes this bean the one injected when several beans have the requested type.
Principal: The identity of whoever makes a request: a user, a client application or another service, reduced to a name.
PriorityOrdered: An Ordered object that goes before every plain Ordered one, whatever the numbers.
ProceedingJoinPoint: The JoinPoint of @Around advice, which can also run the call.
Profile: Registers a bean only when the active profiles match.
ProfileCondition: The condition behind @Profile: it matches when one of its profile expressions matches the active profiles.
Profiles: A condition on profiles, such as "dev, and eu or us", parsed once and tested against the active profiles.
PropertiesLoaderUtils: Reads a .properties Resource into a map of keys to values in one call.
PropertiesParser: Reads text in the .properties format (key=value lines) into a map.
PropertiesPropertySourceLoader: The reader for .properties config files, used for application.properties and its profile variants.
PropertyAccessor: A plug-in that tells expressions how to read and write the properties of some kind of object, so that point.x works.
PropertyPlaceholderHelper: The engine that replaces ${name} and ${name:default} placeholders in text, looking each name up with a function you give.
PropertyResolver: Reading properties by key: as text or as a typed value, with or without a default, and resolving ${...} placeholders in any text.
PropertySource: Adds property files to the environment, on top of the application's configuration files.
PropertySourceDeclaration: One @PropertySource annotation, recorded in a BeanModule: which property files to add to the environment, and when.
PropertySourceFactory: Turns a file named in @PropertySource into a property source; write one to let @PropertySource read a format other than .properties.
PropertySourceLoader: A reader for one config file format: it turns the text of a file into property sources, one per document in the file.
PropertySourceProcessor: The code that reads the files of @PropertySource annotations into an environment.
PropertySourcesPropertyResolver: The property resolver that reads from a list of property sources, the first source with a non-null value winning.
ProtocolResolver: A plug-in that teaches a resource loader a location prefix of its own, such as asset: or db:.
ProviderManager: The standard AuthenticationManager: it asks a list of AuthenticationProviders in turn until one authenticates the request.
ProxyFactory: Builds extra proxies of a bean in code, with advice chosen by the caller rather than by the context's aspects.
ProxyInvoker: The runtime engine behind one proxy: it runs each call of a proxied member through the advice that matches that member.
ProxyMethod: The description of one method of an interface proxy: its name, parameters, return type and annotations, and a way to call it.
Qualifier: Picks one bean among several of the same type, by a label or a bean name.
RandomValuePropertySource: A property source that makes up a new random value for every key that starts with random..
ReloadableResourceBundleMessageSource: A message source that reads its texts from .properties files, one file per language, and can re-read them when they change.
RenamedPropertiesEnvironmentPostProcessor: Stops the start when a property still has the name Spring Boot gives it and this project has renamed.
Repository: Marks a class as a bean that stores and loads data.
ResolvableAttribute: A string attribute of a constraint, such as the regular expression of @Matches, passed as an argument of a field error.
Resource: A piece of content the application reads, wherever it lives: a file of lib/resources/ (the classpath), a file on disk, a URL, a Flutter asset, bytes in memory.
ResourceBanner: A banner whose text comes from a file, such as lib/resources/banner.txt.
ResourceLoader: Turns a location string such as resources:mail.txt, file:./data.csv or https://... into a Resource to read.
ResourceLoaderAware: Implemented by an object that wants the context's resource loader (to read files such as resources:templates/mail.txt) handed to it through a method call.
ResourcePatternResolver: A ResourceLoader that also finds all resources matching a pattern with wildcards, such as resources:templates/*.html or file:config/**/*.properties.
ResourcePropertySource: A property source with the properties of one .properties file.
RoleHierarchy: The rule that a role includes others, such as "an admin can do all a staff member can".
RoleHierarchyImpl: A RoleHierarchy written as text, one rule per line: ROLE_ADMIN > ROLE_STAFF means an admin also has every authority of staff.
Scope: Sets how many instances of a bean exist and how long each one lives.
ScopeType: The names of the two built-in scopes, for @Scope(...) and BeanDefinition.scope.
SCryptPasswordEncoder: A PasswordEncoder using scrypt, a memory-hard function older than Argon2.
Secured: Allows a call of a bean method only when the user has one of the listed authorities; the simple form of PreAuthorize.
SecurityContext: A small box holding the authentication of the current user, or null when nobody is logged in.
SecurityContextChangedEvent: What changed when a SecurityContext was set or cleared: the context before and the one after.
SecurityContextChangedListener: Called after each change of the current SecurityContext made through a ListeningSecurityContextHolderStrategy.
SecurityContextHolder: The entry point to the current user: static methods that read, set and scope the current SecurityContext.
SecurityContextHolderStrategy: The rule that decides which SecurityContext is "current": one per request, one per program, or something else.
SecurityContextImpl: The standard SecurityContext: a mutable field and nothing else.
SecurityExpressionContextCustomizer: A hook that adjusts every evaluation context of security expressions, to make more things readable in @PreAuthorize and its siblings.
Service: Marks a class as a bean that holds business logic.
SetType<E>: The TypeInfo of a Set<E>, with the description of its elements: SetType<String>(ClassType<String>()).
SimpleApplicationEventMulticaster: The standard ApplicationEventMulticaster: it calls the accepting listeners in order, in the publishing call or on a task executor.
SimpleAsyncTaskExecutor: A TaskExecutor that runs each task in a later event-loop turn (Timer.run), so the caller goes on first.
SimpleCommandLinePropertySource: The property source over the program's command-line arguments, so that --server.port=9090 sets the property server.port.
SimpleEvaluationContext: An evaluation context that only lets an expression read (and, if allowed, write) properties: the one to use for expressions that come from outside, such as a filter typed by a user or a field path sent by a client.
SimpleEvaluationContextBuilder: Sets up a SimpleEvaluationContext: which methods, index accessors, conversions and root object it has.
SimpleGrantedAuthority: The usual GrantedAuthority: nothing but its name.
SimpleMapScope: A ready-made CustomScope that keeps its instances in a map until you call destroy.
SingleResultAuthorizationManager<T>: An AuthorizationManager that gives the same answer every time, without looking at the user.
SingletonBeanRegistry: The part of the container that accepts ready-made objects as beans.
Size: A constraint on the length of a string, or the number of entries of a list, set or map: from min to max, both included.
SmartApplicationListener: A GenericApplicationListener that decides by the runtime types of the event and its source, and has an order among the listeners.
SmartFactoryBean<T extends Object>: A FactoryBean that tells the container more about its product: whether it is a prototype, whether to create it at startup, and which other types it can serve.
SmartInitializingSingleton: A singleton that wants a call once every non-lazy singleton has been created, at the end of startup.
SmartInstantiationAwareBeanPostProcessor: An InstantiationAwareBeanPostProcessor that can also tell the type a bean will have before it is created.
SmartLifecycle: A Lifecycle bean that the context starts by itself at the end of the refresh and stops in order at shutdown.
SmartValidator: A Validator that can check only the constraints of some validation groups.
SpelExpression: One parsed SpEL expression: the syntax tree of the text and the parser options it runs under.
SpelExpressionParser: The parser of the Spring Expression Language: it turns expression text into an Expression you can evaluate.
SpelLimits: The fixed size limits of what one operator may build, which keep a hostile expression from exhausting memory or time.
SpelNode: One node of a parsed expression's syntax tree: a literal, a property reference, an operator, a method call, ...
SpelOperations: The operators of SpEL as plain functions: what an expression computes for /, ==, <, + on text, and and the like, apart from the tree that holds the operands.
SpelParserConfiguration: The options of a SpelExpressionParser: the limits that protect against hostile or runaway expressions, and auto-grow for data binding.
SpelParserConfigurationBuilder: Builds a SpelParserConfiguration, starting from the defaults.
SpelPatterns: The compiler of the regular expressions used by matches (the operator and the String method), with Spring's length limit and a guard against patterns that could hang the program.
SpelType: The description of a type that expressions may name: its name, its static fields and methods, its constructor, and how to test an instance.
SpelTypeConstructorResolver: The default ConstructorResolver: it runs the constructor function registered on a SpelType for new Name(...).
SpelTypeMethodResolver: The MethodResolver for static methods, T(Name).method(...): it runs the functions listed in SpelType.staticMethods.
SpringApplication: Starts an application: reads its configuration, creates its beans and runs its startup tasks, in a fixed and documented order.
SpringApplicationEvent: A step of the application's start, announced to listeners.
SpringApplicationJsonEnvironmentPostProcessor: Reads properties given as one JSON document, in the SPRING_APPLICATION_JSON environment variable or the spring.application.json property.
SpringBootApplication: Marks the main function of an application, so that the generator writes everything needed to start it.
SpringBootBanner: The banner printed when the application sets none: the Spring logo in ASCII art and the spring_boot_dart version.
SpringHotReload: Restarts a running server or command-line application when its beans change during a hot reload on the Dart VM.
SpringLog: A named logger: the object code logs through, and the static switches (levels, handler, holds) of logging as a whole.
SpringLogHold: The records held back by one SpringLog.hold, until release.
SpringLogRecord: One logged message with everything known about it, as a log handler receives it.
StandardBeanExpressionResolver: Evaluates the #{...} parts of @Value strings (and of other framework values, such as @ConditionalOnExpression) against the beans of a bean factory.
StandardEnvironment: The environment implementation used everywhere: an empty list of property sources except the environment variables, plus profiles.
StandardEvaluationContext: An evaluation context with every feature of the language enabled: the one to use for expressions you or your application wrote.
StandardOperatorOverloader: The default OperatorOverloader: it takes over no operator, so arithmetic on operands without a built-in rule fails with operatorNotSupportedBetweenTypes (EL1030E).
StandardTypeComparator: The default TypeComparator: it orders numbers, strings, dates, durations, booleans, enums and other Comparables, with null before everything.
StandardTypeConverter: The default TypeConverter: it hands every conversion to a ConversionService.
StandardTypeLocator: The usual TypeLocator: a registry of SpelTypes by name, with the core Dart types and the common Java names already in it.
StaticMessageSource: A message source whose messages are added in code rather than read from files.
StringNode: A JSON string. asInt, asDouble and asBoolean convert numeric and "true" / "false" text.
SyncTaskExecutor: A TaskExecutor that runs each task right away, in the calling code.
SystemEnvironmentPropertySource: The property source over the operating system's environment variables, which finds server.port in the variable SERVER_PORT.
TaskExecutor: Something that runs a task now or later, so that the code handing it over does not have to wait.
TemplateParserContext: A template ParserContext with delimiters of your choice.
TestingAuthenticationToken: An already authenticated token with the authorities you name, for tests and for code that runs as a fixed identity.
TruePointcut: A pointcut that matches every member of every bean.
TypeComparator: Decides how two values are ordered for <, <=, >, >= and between.
TypeConverter: Converts a value to another type while an expression is evaluated.
TypeInfo<T>: A description of a full Dart type, such as List<Book> or String?, that code can take apart at run time without reflection.
TypeInfoVisitor<R>: One method per kind of TypeInfo, called by TypeInfo.accept with the kind's type arguments in scope.
TypeLocator: Finds the type a name stands for in T(Name), new Name(...) and instanceof T(Name).
UrlResource: A Resource on a web server, read with an HTTP GET request.
User: A ready-made UserDetails: a username, a password hash, authorities and the four account flags, all fixed at creation.
UserBuilder: Collects the parts of a User step by step; get one from User.withUsername or User.withUserDetails.
UserDetails: What the security code needs to know about one of your users to log them in: the username, the stored password hash, the authorities and whether the account may log in at all.
UserDetailsChecker: A check of an account's state, run during a password login.
UserDetailsManager: A UserDetailsService that can also add, change and remove users.
UserDetailsPasswordService: Saves a new hash of a user's password when the login code re-hashes it.
UserDetailsService: Your user store, as the login code sees it: one method that finds a user by the name typed at login.
UsernamePasswordAuthenticationToken: A login with a username and a password, both before and after it is checked.
Valid: An annotation that asks for the constraints inside an object to be checked: of a nested object, of the objects in a list, set or map, or of a request body or method argument.
Validated: An annotation that asks for validation, optionally with validation groups.
ValidationUtils: Static helpers for writing and running a Validator.
Validator: A check of an object written in code: it looks at the object and records each problem in an Errors.
Value: Injects a value from the configuration (properties, environment variables) or from an expression, instead of a bean.
ValueRef: A handle on the place an assignable expression names (a property, a variable, a list or map element), to read and write it.
ValueResolver: The source of the input values when DataBinder.construct creates an object through its constructor.
VarargsFunction: A wrapper that lets a Dart function accept any number of trailing arguments when an expression calls it, like a Java varargs method (String.join(delimiter, String... elements)).
YamlPropertySourceLoader: The reader for YAML config files (.yml, .yaml), used for application.yml and its profile variants.
ZoneSecurityContextHolderStrategy: The default strategy: each runWithContext scope has its own context, and code outside every scope shares one program-wide context.

Enums

AdviceKind: The five kinds of aspect advice, one per annotation, listed in the order they nest inside one aspect.
BannerMode: Where the startup banner goes: the console, the log, or nowhere.
ChronoUnit: A unit of time, from nanoseconds to days: the unit in which a plain number is read as a duration.
CloudPlatform: A cloud platform an application can run on (Kubernetes, Heroku, Cloud Foundry, ...), recognised from the environment variables the platform sets.
ConfigurationPhase: The moment of loading at which a ConfigurationCondition is decided.
ConfigurationPropertyNameForm: How an element of a ConfigurationPropertyName is returned by ConfigurationPropertyName.getElement: as written, dashed or reduced to letters and digits. Bracketed elements are always returned as written.
DataUnit: A unit a DataSize can be written in, each 1024 times the one before.
DateTimeFeature: On/off settings for writing and reading DateTime and Duration, named after Jackson 3's DateTimeFeature (set by spring.json.datatype.datetime.*; Spring Boot 4: spring.jackson.datatype.datetime.*).
DependencyKind: The form of an injection point that a Dependency describes: one bean, all beans of a type, a provider, a @Value, and so on.
DeserializationFeature: On/off settings for reading JSON, named after Jackson's DeserializationFeature; the defaults are Spring Boot's.
FilterType: How a Filter decides whether a class matches.
IntrospectionPart: A part of an introspected class that a BeanIntrospection may leave out.
JsonFormatShape: The JSON shapes JsonFormat.shape can ask for (Jackson's JsonFormat.Shape).
JsonInclusion: Which property values are written, for JsonInclude and the mapper's inclusion (Jackson's JsonInclude.Include).
JsonPropertyAccess: The directions a property takes part in, for JsonProperty.access (Jackson's JsonProperty.Access).
JsonTypeId: What identifies the subclass in JSON, for JsonTypeInfo.use (Jackson's JsonTypeInfo.Id).
JsonTypeInclusion: Where the type id is placed, for JsonTypeInfo.include (Jackson's JsonTypeInfo.As).
MapperFeature: On/off settings that change how the mapper sees classes, named after Jackson's MapperFeature.
MemberKind: Whether an advised member is a method, a getter or a setter.
Operation: The arithmetic operators an OperatorOverloader can take over.
PatternFlag: Options for the regular expression of Matches and Email, such as matching without regard to case.
Pbkdf2Algorithm: The HMAC that Pbkdf2PasswordEncoder derives keys with; it fixes the hash length too.
PropertyNamingStrategy: A rule that turns Dart property names (publishedAt) into JSON names (published_at), applied to every property of a class or of the whole mapper.
ScopedProxyMode: Whether a bean of a custom (or prototype) scope is injected directly or through a scoped proxy (@Scope(proxyMode:)).
SearchStrategy: Which contexts ConditionalOnBean and ConditionalOnMissingBean search for beans, when contexts have parents.
SerializationFeature: On/off settings for writing JSON, named after Jackson's SerializationFeature.
SpelMessage: The catalogue of SpEL failures: each value is one kind of error with its code (EL1005E) and message text.
SpelMessageKind: The severity of a SpelMessage. Every message defined today is an error; the other kinds exist because Spring defines them.
SpringLogLevel: How important a log message is, from trace (most detail) to error; off silences a logger.

Constants

methodSecurityAdvisorOrder → const int: The position of method security among the advice wrapped around a bean method: before every other advice.
springBootVersion → const String: The version of spring_boot_dart this program was built with.

Properties

loggingAutoConfiguration → List<BeanDefinition<Object>>: The bean definitions this starter adds to every application that depends on it.
final
printLogHandlerColours ↔ bool: Whether printLogHandler colours its lines with ANSI escape codes.
getter/setter pair
printLogHandlerOut ↔ void Function(String line): Where printLogHandler writes its lines: standard output on the Dart VM, print in Flutter (the device log) and on the web (the browser's console). Replace it to send them elsewhere, or in a test of the output.
getter/setter pair
securityCoreAutoConfiguration → List<BeanDefinition<Object>>: The beans this package adds to every application that depends on it; they switch method security and password logins on without any setup.
final

Functions

analyzeFailure(Object error, {Iterable<FailureAnalyzer> analyzers = const []}) → FailureAnalysis?: Explains a startup error: the FailureAnalysis that SpringApplication prints when the start fails, or null when nothing recognises error.
conditionsMatch(Iterable<Condition> conditions, ConditionContext context, {ConfigurationPhase? phase, String? source}) → bool: Whether every one of conditions matches; the context calls it for each definition while the modules load.
constantTimeEquals(List<int> a, List<int> b) → bool: Whether a and b hold the same bytes, compared in a time that does not depend on where they differ.
hasPhaseCondition(Iterable<Condition> conditions, ConfigurationPhase phase) → bool: Whether conditions (also inside a ConditionGroup) include a ConfigurationCondition of phase; the context uses it to tell which definitions must wait for the registerBean phase.
isMethodSecurityAnnotation(Object annotation) → bool: Whether annotation is one of the five method security annotations: PreAuthorize, PostAuthorize, Secured, PreFilter or PostFilter.
jsonMapperBuilderFromProperties(Environment environment, {BeanIntrospector? introspector, Iterable<JsonSerializer<Object>> serializers = const [], Iterable<JsonDeserializer<Object>> deserializers = const [], Iterable<JsonModule> modules = const []}) → JsonMapperBuilder: The JsonMapperBuilder that objectMapperFromProperties would build, with the spring.json.* properties of environment applied.
objectMapperFromProperties(Environment environment, {BeanIntrospector? introspector, Iterable<JsonSerializer<Object>> serializers = const [], Iterable<JsonDeserializer<Object>> deserializers = const [], Iterable<JsonModule> modules = const []}) → ObjectMapper: Builds an ObjectMapper from the spring.json.* properties of environment, the same way the auto-configured bean is built.
parseDataSize(String value) → int: Reads a size written in a property, such as logging.file.rolling-policy.max-file-size, and returns it in bytes.
parseSpringLogLevel(String? value) → SpringLogLevel?: Reads a level name as written in configuration (logging.level.*): trace, debug, info, warn or warning, error (also fatal) and off, in any case and with spaces around. null for anything else, so the caller can report the bad value.
pointcutMatchesBean(AopPointcut pointcut, MethodSignature signature, String beanName, List<String> beanAliases, {List<String> introducedTypes = const []}) → bool: Whether pointcut matches the member signature of the bean beanName, with everything the bean is known by.
printLogHandler(SpringLogRecord record) → void: The SpringLog.handler used until a logging backend replaces it: writes each record as one line, [logger] LEVEL: message, to standard output on the Dart VM, to the device log in Flutter and to the browser's console on the web.
retypeFuture<T>(Object? value) → Future<T>: Turns the result of an advised call into a Future<T>.
secureRandomBytes(int length) → Uint8List: length random bytes from Random.secure(), suitable for salts, keys and tokens that an attacker must not guess.
selectAutoConfigurations(List<BeanModule> modules, {Map<BeanModule, AutoConfigurationModule> metadata = const {}, Iterable<Type> excludeTypes = const [], Iterable<String> excludeNames = const []}) → List<BeanModule>: Takes the auto-configuration modules of the libraries an application uses, drops the excluded ones and returns the rest in the order they must be registered.
verifyAuthorization<T>(AuthorizationManager<T> manager, Authentication? authentication(), T object) → Future<void>: Asks manager about object and throws an AuthorizationDeniedException unless it granted access.
wildcardMatch(String pattern, String text) → bool: Whether text matches pattern, where * stands for any characters.

Typedefs

BeanConfigurer = void Function(Object bean, DependencyResolver resolver): A function that injects the dependencies of an object the container did not create, an instance of a @Configurable class.
ConstructorExecutor = Object? Function(EvaluationContext context, List<Object?> arguments): The function a ConstructorResolver returns to run one new Name(...): it gets the evaluated arguments and returns the new object.
MethodExecutor = Object? Function(EvaluationContext context, Object target, List<Object?> arguments): The function a MethodResolver returns to run one method call: it gets the target and the evaluated arguments and returns the result.
SpringLogHandler = void Function(SpringLogRecord record): A function that receives log records: the type of SpringLog.handler (where records go) and of SpringLog.listen listeners.
StringValueResolver = String Function(String value): A function that resolves the ${...} placeholders in a string and returns the result.

Exceptions / Errors

AccessDeniedException: The current user is known but may not do what was asked.
AccessException: The exception a plug-in (property or index accessor, method, constructor or bean resolver, executor) throws to say it could not do its job.
AccountExpiredException: The login was refused because the account has expired (UserDetails.isAccountNonExpired is false).
AccountStatusException: The base class of the failures where the account exists but may not log in now: locked, disabled, expired, or with an expired password.
AopConfigException: Thrown when AOP is set up in a way that cannot work, usually at startup: advice matches a bean that cannot be proxied, an aspect has an unsupported instantiation model, or a proxy's advisors are changed although it has none.
AopInvocationException: Thrown by an advised call when the advice cannot run as written, like Spring's AopInvocationException.
ApplicationContextException: The error a context throws when one of its own steps fails, as opposed to an error in creating a bean.
AuthenticationCredentialsNotFoundException: A security check ran with no Authentication in the security context, not even an anonymous one.
AuthenticationException: The base class of every "who are you?" failure: a login was refused, or an identity is needed and there is none.
AuthenticationServiceException: A login could not be checked because something failed, such as the user database being down, rather than because the credentials are wrong.
AuthorizationDeniedException: The AccessDeniedException thrown when an access check says no; it carries the result that denied.
BadCredentialsException: A login was refused because the username or the password is wrong.
BeanCreationException: The error thrown when creating a bean failed: its constructor or @Bean method, its injection or an init callback threw.
BeanCreationNotAllowedException: The error thrown when a singleton that does not exist yet is requested while the factory destroys its singletons.
BeanCurrentlyInCreationException: The error thrown when beans depend on each other in a cycle, so none of them can be created first.
BeanDefinitionOverrideException: The error thrown when a bean name or alias is registered while the name is already taken.
BeanDefinitionStoreException: The error thrown when a bean definition cannot be registered: an invalid name, or a name that is taken.
BeanIsNotAFactoryException: The error thrown when &name asks for the factory of a bean that is not a FactoryBean.
BeanNotOfRequiredTypeException: The error thrown when a bean exists but is not of the requested type.
BeansException: The common supertype of the errors the container throws: a missing or ambiguous bean, a failed creation, a clashing name, a bad property path.
BindException: The exception DataBinder.close throws when binding or validation found errors; it carries them in bindingResult.
ConfigDataLoadException: The startup error for config data that exists but cannot be used.
ConfigDataLocationNotFoundException: The startup error for a required directory location that does not exist, such as spring.config.import=file:./config/ without a ./config/ directory.
ConfigDataResourceNotFoundException: The startup error for a config file that must exist and does not, such as spring.config.import=file:./secrets.yml when there is no secrets.yml.
ConfigurationPropertiesBindException: The error thrown when configuration values are invalid: a value that cannot be converted, a required value that is missing, or a validation constraint that fails.
ConstraintDeclarationException: Thrown when a constraint is declared wrongly: invalid settings (Size(min: -1), min > max, a malformed regular expression), @ConvertGroup without @Valid(), or @Each on a value that is not a collection. Jakarta's ConstraintDeclarationException.
ConstraintViolationException: The exception a @Validated() bean throws when a call's arguments or its return value break their constraints.
ConversionException: The error a conversion service throws when a value cannot be turned into the requested type.
ConversionFailedException: The conversion error for a value the converter could not handle, such as '12x' for an int.
ConverterNotFoundException: The conversion error for a target type that nothing converts to, or a source that no converter of that target accepts.
CredentialsExpiredException: The login was refused because the password has expired (UserDetails.isCredentialsNonExpired is false).
DisabledException: The login was refused because the account is disabled (UserDetails.isEnabled is false).
EvaluationException: An expression was valid but could not be evaluated: a missing property, an unknown type, a failed conversion.
ExpressionException: The common supertype of everything that can go wrong with an expression: invalid text (ParseException) or a failed evaluation (EvaluationException).
GroupDefinitionException: Thrown when a group sequence is defined wrongly: a cycle, Default in a class's @GroupSequence, the class missing from it, or Default as a key of BeanValidator.groupSequences. Jakarta's GroupDefinitionException.
InsufficientAuthenticationException: Access needs a real login, but the caller is anonymous.
InternalAuthenticationServiceException: A login could not be checked because the authentication code itself failed.
IntrospectionPartError: The error thrown when code needs a part of an introspected class that its description leaves out.
InvalidConfigDataPropertyException: The startup error for a property written in a config file where it is not allowed.
InvalidConfigurationPropertyNameException: The error for a name that should be canonical and is not, such as a @ConfigurationProperties prefix written app.readTimeout instead of app.read-timeout.
InvalidPropertyException: The error a BeanWrapper throws when a property path is malformed (items[, address..city).
JsonMappingException: The error the JSON mapper throws when JSON cannot be turned into the requested type, or a value cannot be written as JSON.
JsonNodeException: The error a JsonNode accessor throws when the node has the wrong kind, such as stringValue() on a number, or cannot be converted.
LockedException: The login was refused because the account is locked (UserDetails.isAccountNonLocked is false).
MethodInvocationException: The error a BeanWrapper throws when a property's setter itself threw, for example because it validates the value.
MissingPropertyException: The error for a property read as required that no source has.
MissingRequiredPropertiesException: The error for properties that were declared required and have no value.
NoSuchBeanDefinitionException: The error thrown when no bean matches a requested type, qualifier or name.
NoSuchMessageException: Thrown when a message code is not found and no default message was given.
NotReadablePropertyException: The error a BeanWrapper throws when a property path cannot be read.
NotWritablePropertyException: The error a BeanWrapper throws when a property path cannot be written.
NoUniqueBeanDefinitionException: The error thrown when several beans match a requested type and none of them wins.
NullValueInNestedPathException: The error a BeanWrapper throws when a path goes through a null value, such as address in address.city.
ParseException: The text of an expression or template is not valid, so it cannot be parsed.
PasswordChecksBusyException: Too many password checks are running and waiting: this one was not started.
PlaceholderResolutionException: The error for a ${...} placeholder that has no value and no default, or that refers to itself in a loop (a=${b}, b=${a}).
PropertyBatchUpdateException: The error BeanWrapper.setPropertyValues throws when one or more of the values could not be written, after trying all of them.
PropertySourceNotFoundException: The startup error for a file named in @PropertySource that does not exist.
ProviderNotFoundException: No AuthenticationProvider of a ProviderManager accepts this kind of login request (its supports returned false for all of them).
RenamedPropertiesException: The start failed because properties still have a name that was renamed (see RenamedPropertiesEnvironmentPostProcessor.renamed).
ScopeNotActiveException: The error thrown when a bean is looked up while its scope is not active, for example a screen-scoped bean while no screen is open.
ScopeNotRegisteredException: The error thrown when a bean of a custom scope is looked up and no scope of that name is registered.
SpelEvaluationException: Evaluating a SpEL expression failed; messageCode says why.
SpelParseException: The text of a SpEL expression is not valid; messageCode says what is wrong.
TypeMismatchException: The error a BeanWrapper throws when a value cannot be converted to the type of the property it is written to, such as 'old' for an int.
UnexpectedTypeException: Thrown when a constraint meets a value of a type it cannot check: @Size on an int, @NotBlank on a List. Jakarta's UnexpectedTypeException.
UnsatisfiedDependencyException: The error thrown when an injection point of a bean cannot be filled: the bean, its injection point and the reason are in the message.
UsernameNotFoundException: No user has the given username.
ValidationException: The base of the exceptions that mean validation itself is set up wrongly: a bad constraint declaration or group definition, never an invalid value.

spring_security_core library

Classes

Enums

Constants

Properties

Functions

Typedefs

Exceptions / Errors

spring_security_core package

spring_security_core library