Looking at the new APIs in ViewHandler below... why do we expose
addProtectedView()/removeProtectedView() methods instead of simply
allowing the the protected view Set to be modified directly?
On a related note: what's the rationale for allowing protected views to
be added and removed at runtime rather than requiring that this
configuration be defined once up front? (Are there some lazy loading
cases that we need to support, perhaps related to flows?)
/**
+ * <p class="changed_added_2_2">Return an unmodifiable
+ * <code>Set</code> of the protected views currently known to this
+ * <code>ViewHandler</code> instance. Compliant implementations must
+ * return a <code>Set</code> that is the concatenation of the
+ * contents of all the <code><url-pattern></code> elements
+ * within all the <code><protected-views></code> in all of the
+ * application configuration resources in the current application.
+ * The runtime must support calling this method at any time after
+ * application startup. The default implementation returns an
+ * unmodifiable empty <code>Set</code>.</p>
+ *
+ * @since 2.2
+ */
+ public Set<String> getProtectedViewsUnmodifiable() {
+ return Collections.unmodifiableSet(Collections.EMPTY_SET);
+ }
+
+ /**
+ * <p class="changed_added_2_2">Add the argument
+ * <code>urlPattern</code> to the thread safe <code>Set</code> of
+ * protected views for this application. Compliant implementations
+ * make it so a subsequent call to {_at_link
+ * #getProtectedViewsUnmodifiable} contains the argument. The
+ * runtime must support calling this method at any time after
+ * application startup. The default implementation takes no
+ * action.</p>
+ *
+ * @param urlPattern the url-pattern to add.
+ *
+ * @since 2.2
+ */
+ public void addProtectedView(String urlPattern) {
+
+ }
+
+ /**
+ * <p class="changed_added_2_2">Remove the argument
+ * <code>urlPattern</code> from the thread safe <code>Set</code> of
+ * protected views for this application, if present in the
+ * <code>Set</code>. If the argument <code>urlPattern</code> is not
+ * present in the <code>Set</code>, this method has no effect.
+ * Compliant implementations must make it so a subsequent call to
+ * {_at_link #getProtectedViewsUnmodifiable} does not contain the
+ * argument. The runtime must support calling this method at any
+ * time after application startup. Returns <code>true</code> if
+ * this <code>Set</code> contained the argument. The default
+ * implementation takes no action and returns
+ * <code>false</code>.</p>
+ *
+ * @param urlPattern the url-pattern to remove.
+ *
+ * @since 2.2
+ */
+ public boolean removeProtectedView(String urlPattern) {
+ return false;
+ }
Andy