Add nullability to spring-security-core

Closes gh-17534

Author: rwinch

config/src/test/kotlin/org/springframework/security/config/annotation/web/OAuth2ResourceServerDslTests.kt

@@ -242,7 +242,7 @@ class OAuth2ResourceServerDslTests {
 
     class MockAuthenticationManager(var authentication: Authentication) : AuthenticationManager {
 
-        override fun authenticate(authentication: Authentication?): Authentication {
+        override fun authenticate(authentication: Authentication): Authentication {
             return this.authentication
         }
 

config/src/test/kotlin/org/springframework/security/config/annotation/web/session/SessionConcurrencyDslTests.kt

@@ -217,7 +217,7 @@ class SessionConcurrencyDslTests {
                 sessionManagement {
                     sessionConcurrency {
                         maximumSessions {
-                            authentication -> if (isAdmin.authorize({ authentication }, null)!!.isGranted) -1 else 1
+                            authentication -> if (isAdmin.authorize({ authentication }, "")!!.isGranted) -1 else 1
                         }
                         maxSessionsPreventsLogin = true
                     }

config/src/test/kotlin/org/springframework/security/config/web/server/ServerFormLoginDslTests.kt

@@ -172,7 +172,7 @@ class ServerFormLoginDslTests {
     }
 
     class NoopReactiveAuthenticationManager: ReactiveAuthenticationManager {
-        override fun authenticate(authentication: Authentication?): Mono<Authentication> {
+        override fun authenticate(authentication: Authentication): Mono<Authentication> {
             return Mono.empty()
         }
     }

config/src/test/kotlin/org/springframework/security/config/web/server/ServerHttpBasicDslTests.kt

@@ -151,7 +151,7 @@ class ServerHttpBasicDslTests {
     }
 
     class NoopReactiveAuthenticationManager: ReactiveAuthenticationManager {
-        override fun authenticate(authentication: Authentication?): Mono<Authentication> {
+        override fun authenticate(authentication: Authentication): Mono<Authentication> {
             return Mono.empty()
         }
     }

config/src/test/kotlin/org/springframework/security/config/web/server/ServerHttpSecurityDslTests.kt

@@ -249,7 +249,7 @@ class ServerHttpSecurityDslTests {
     }
 
     class NoopReactiveAuthenticationManager: ReactiveAuthenticationManager {
-        override fun authenticate(authentication: Authentication?): Mono<Authentication> {
+        override fun authenticate(authentication: Authentication): Mono<Authentication> {
             return Mono.empty()
         }
     }

config/src/test/kotlin/org/springframework/security/config/web/server/ServerOAuth2ClientDslTests.kt

@@ -276,7 +276,7 @@ class ServerOAuth2ClientDslTests {
     }
 
     class NoopReactiveAuthenticationManager: ReactiveAuthenticationManager {
-        override fun authenticate(authentication: Authentication?): Mono<Authentication> {
+        override fun authenticate(authentication: Authentication): Mono<Authentication> {
             return Mono.empty()
         }
     }

core/spring-security-core.gradle

@@ -1,5 +1,9 @@
 import java.util.concurrent.Callable
 
+plugins {
+	id 'security-nullability'
+}
+
 apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'security-kotlin'
 

core/src/main/java/org/springframework/security/access/annotation/Jsr250MethodSecurityMetadataSource.java

@@ -25,6 +25,8 @@
 import jakarta.annotation.security.DenyAll;
 import jakarta.annotation.security.PermitAll;
 import jakarta.annotation.security.RolesAllowed;
+import org.jspecify.annotations.NullUnmarked;
+import org.jspecify.annotations.Nullable;
 
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.security.access.ConfigAttribute;
@@ -39,6 +41,7 @@
  * {@link org.springframework.security.authorization.method.Jsr250AuthorizationManager}
  * instead
  */
+@NullUnmarked
 @Deprecated
 public class Jsr250MethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
 
@@ -71,11 +74,11 @@ protected Collection<ConfigAttribute> findAttributes(Method method, Class<?> tar
 	}
 
 	@Override
-	public Collection<ConfigAttribute> getAllConfigAttributes() {
+	public @Nullable Collection<ConfigAttribute> getAllConfigAttributes() {
 		return null;
 	}
 
-	private List<ConfigAttribute> processAnnotations(Annotation[] annotations) {
+	private @Nullable List<ConfigAttribute> processAnnotations(Annotation @Nullable [] annotations) {
 		if (annotations == null || annotations.length == 0) {
 			return null;
 		}

core/src/main/java/org/springframework/security/access/annotation/SecuredAnnotationSecurityMetadataSource.java

@@ -22,6 +22,9 @@
 import java.util.Collection;
 import java.util.List;
 
+import org.jspecify.annotations.NullUnmarked;
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.core.GenericTypeResolver;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.security.access.ConfigAttribute;
@@ -41,13 +44,14 @@
  * @deprecated Use
  * {@link org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor#secured}
  */
+@NullUnmarked
 @Deprecated
 @SuppressWarnings({ "unchecked" })
 public class SecuredAnnotationSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
 
 	private AnnotationMetadataExtractor annotationExtractor;
 
-	private Class<? extends Annotation> annotationType;
+	private @Nullable Class<? extends Annotation> annotationType;
 
 	public SecuredAnnotationSecurityMetadataSource() {
 		this(new SecuredAnnotationMetadataExtractor());
@@ -73,11 +77,11 @@ protected Collection<ConfigAttribute> findAttributes(Method method, Class<?> tar
 	}
 
 	@Override
-	public Collection<ConfigAttribute> getAllConfigAttributes() {
+	public @Nullable Collection<ConfigAttribute> getAllConfigAttributes() {
 		return null;
 	}
 
-	private Collection<ConfigAttribute> processAnnotation(Annotation annotation) {
+	private @Nullable Collection<ConfigAttribute> processAnnotation(@Nullable Annotation annotation) {
 		return (annotation != null) ? this.annotationExtractor.extractAttributes(annotation) : null;
 	}
 

core/src/main/java/org/springframework/security/access/annotation/package-info.java

@@ -17,4 +17,7 @@
 /**
  * Support for JSR-250 and Spring Security {@code @Secured} annotations.
  */
+@NullMarked
 package org.springframework.security.access.annotation;
+
+import org.jspecify.annotations.NullMarked;