refactor: update AccessAwareJsonFilter and AccessAwareJsonViewAdvice for Jackson 3.x compatibility

Author: pwannenmacher

essencium-backend/src/main/java/de/frachtwerk/essencium/backend/controller/access/AccessAwareJsonFilter.java

@@ -19,19 +19,18 @@
 
 package de.frachtwerk.essencium.backend.controller.access;
 
-import com.fasterxml.jackson.core.JsonGenerator;
-import com.fasterxml.jackson.databind.SerializerProvider;
-import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import com.fasterxml.jackson.databind.ser.PropertyFilter;
-import com.fasterxml.jackson.databind.ser.PropertyWriter;
 import de.frachtwerk.essencium.backend.model.Ownable;
 import de.frachtwerk.essencium.backend.model.dto.EssenciumUserDetails;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.stream.Stream;
 import lombok.AllArgsConstructor;
 import org.springframework.security.core.GrantedAuthority;
+import tools.jackson.core.JsonGenerator;
+import tools.jackson.databind.SerializationContext;
+import tools.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import tools.jackson.databind.ser.PropertyFilter;
+import tools.jackson.databind.ser.PropertyWriter;
 
 @AllArgsConstructor
 public class AccessAwareJsonFilter<
@@ -40,9 +39,10 @@ public class AccessAwareJsonFilter<
   private AUTHUSER principal;
 
   @Override
-  public void serializeAsField(
-      Object pojo, JsonGenerator jsonGenerator, SerializerProvider provider, PropertyWriter writer)
+  public void serializeAsProperty(
+      Object pojo, JsonGenerator jsonGenerator, SerializationContext context, PropertyWriter writer)
       throws Exception {
+
     JsonAllowFor ann = writer.getMember().getAnnotation(JsonAllowFor.class);
     if (ann == null
         || Arrays.stream(ann.roles())
@@ -58,32 +58,26 @@ public void serializeAsField(
                         .map(GrantedAuthority::getAuthority)
                         .anyMatch(r::equals))
         || (ann.allowForOwner() && isOwner(pojo))) {
-      writer.serializeAsField(pojo, jsonGenerator, provider);
-    } else if (!jsonGenerator.canOmitFields()) {
-      writer.serializeAsOmittedField(pojo, jsonGenerator, provider);
+      writer.serializeAsProperty(pojo, jsonGenerator, context);
+    } else if (!jsonGenerator.canOmitProperties()) {
+      writer.serializeAsOmittedProperty(pojo, jsonGenerator, context);
     }
   }
 
   @Override
   public void serializeAsElement(
       Object elementValue,
       JsonGenerator jsonGenerator,
-      SerializerProvider provider,
+      SerializationContext context,
       PropertyWriter writer)
       throws Exception {
     // For array/collection elements, just serialize normally
-    writer.serializeAsField(elementValue, jsonGenerator, provider);
+    writer.serializeAsProperty(elementValue, jsonGenerator, context);
   }
 
   @Override
   public void depositSchemaProperty(
-      PropertyWriter writer, JsonObjectFormatVisitor objectVisitor, SerializerProvider provider) {
-    // Default implementation - include all properties in schema
-  }
-
-  @Override
-  public void depositSchemaProperty(
-      PropertyWriter writer, ObjectNode propertiesNode, SerializerProvider provider) {
+      PropertyWriter writer, JsonObjectFormatVisitor objectVisitor, SerializationContext context) {
     // Default implementation - include all properties in schema
   }
 
@@ -95,4 +89,9 @@ private boolean isOwner(Object obj) {
       return false;
     }
   }
+
+  @Override
+  public PropertyFilter snapshot() {
+    return this;
+  }
 }

essencium-backend/src/main/java/de/frachtwerk/essencium/backend/controller/advice/AccessAwareJsonViewAdvice.java

@@ -19,8 +19,10 @@
 
 package de.frachtwerk.essencium.backend.controller.advice;
 
+import de.frachtwerk.essencium.backend.controller.access.AccessAwareJsonFilter;
 import de.frachtwerk.essencium.backend.model.dto.EssenciumUserDetails;
 import jakarta.annotation.Nonnull;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.MethodParameter;
 import org.springframework.http.MediaType;
 import org.springframework.http.converter.HttpMessageConverter;
@@ -29,14 +31,25 @@
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.ser.FilterProvider;
+import tools.jackson.databind.ser.std.SimpleFilterProvider;
 
 @RestControllerAdvice
 public class AccessAwareJsonViewAdvice implements ResponseBodyAdvice<Object> {
   public static final String FILTER_NAME = "roleBasedFilter";
 
+  private final ObjectMapper objectMapper;
+
+  @Autowired
+  public AccessAwareJsonViewAdvice(ObjectMapper objectMapper) {
+    this.objectMapper = objectMapper;
+  }
+
   @Override
   public boolean supports(
-      @Nonnull MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
+      @Nonnull MethodParameter returnType,
+      @Nonnull Class<? extends HttpMessageConverter<?>> converterType) {
     // Support both Jackson2 (deprecated) and Jackson3 converters
     String converterName = converterType.getName();
     return converterName.contains("Jackson") && converterName.contains("HttpMessageConverter");
@@ -64,11 +77,23 @@ public Object beforeBodyWrite(
       return body;
     }
 
-    /*
-    TODO: MappingJacksonValue is deprecated in Spring Boot 7.0 and causes wrapped responses
-    For now, return the body directly without filtering
-    A proper Jackson 3.x solution needs to be implemented using @JsonFilter on model classes
-    */
-    return body;
+    // Create FilterProvider with role-based filter (Jackson 3.x API)
+    FilterProvider filters =
+        new SimpleFilterProvider()
+            .addFilter(FILTER_NAME, new AccessAwareJsonFilter<>(principal))
+            .setFailOnUnknownId(false);
+
+    // Configure a temporary ObjectMapper with the filter
+    // In Jackson 3.x we use rebuild() and filterProvider()
+    try {
+      ObjectMapper filteredMapper = objectMapper.rebuild().filterProvider(filters).build();
+
+      // Serialize and deserialize to apply the filters
+      String json = filteredMapper.writeValueAsString(body);
+      return filteredMapper.readValue(json, Object.class);
+    } catch (Exception e) {
+      // On error, return the original body
+      return body;
+    }
   }
 }