Merge branch '4.4.x' into 4.5.x

inject-groovy/src/test/groovy/io/micronaut/inject/visitor/BeanIntrospectionSpec.groovy

@@ -2522,4 +2522,56 @@ class Holder<A extends Animal> {
             animal.isTypeVariable()
     }
 
+    void "test package private property introspection"() {
+        when:
+        def introspection = buildBeanIntrospection('test.Test', '''
+package test
+
+import io.micronaut.core.annotation.Introspected
+import io.micronaut.inject.visitor.MySuperclass
+
+@Introspected
+class Test extends MySuperclass {
+
+    String name
+}
+''')
+        then: 'the property in this class is introspected'
+        introspection.getProperty("name").orElse(null)
+
+        and: 'the public property in the java superclass is introspected'
+        introspection.getProperty("publicProperty").orElse(null)
+
+        and: 'the private property in the java superclass is not introspected'
+        !introspection.getProperty("privateProperty").orElse(null)
+
+        and: 'the package private superclass property is not introspected'
+        !introspection.getProperty("packagePrivateProperty").orElse(null)
+    }
+
+    void "test package private property introspection in same package"() {
+        when:
+        def introspection = buildBeanIntrospection('io.micronaut.inject.visitor.Test', '''
+package io.micronaut.inject.visitor
+
+import io.micronaut.core.annotation.Introspected
+
+@Introspected
+class Test extends MySuperclass {
+
+    String name
+}
+''')
+        then: 'the property in this class is introspected'
+        introspection.getProperty("name").orElse(null)
+
+        and: 'the public property in the java superclass is introspected'
+        introspection.getProperty("publicProperty").orElse(null)
+
+        and: 'the private property in the java superclass is not introspected'
+        !introspection.getProperty("privateProperty").orElse(null)
+
+        and: 'the package private superclass property is introspected, as we are in the same package'
+        introspection.getProperty("packagePrivateProperty").orElse(null)
+    }
 }

inject-groovy/src/test/groovy/io/micronaut/inject/visitor/MySuperclass.groovy

@@ -0,0 +1,4 @@
+package io.micronaut.inject.visitor
+
+class MySuperclass extends PackagePrivateSuperclass {
+}

inject-groovy/src/test/groovy/io/micronaut/inject/visitor/PackagePrivateSuperclass.java

@@ -0,0 +1,22 @@
+package io.micronaut.inject.visitor;
+
+class PackagePrivateSuperclass {
+
+    String packagePrivateProperty;
+
+    String getPackagePrivateProperty() {
+        return packagePrivateProperty;
+    }
+
+    private String privateProperty;
+
+    private String getPrivateProperty() {
+        return privateProperty;
+    }
+
+    public String publicProperty;
+
+    public String getPublicProperty() {
+        return publicProperty;
+    }
+}

inject-java-test/src/test/groovy/io/micronaut/inject/visitor/beans/BeanIntrospectionSpec.groovy

@@ -5230,6 +5230,75 @@ class Holder<A extends Animal> {
         animal.isTypeVariable()
     }
 
+    void "test package private property introspection"() {
+        when:
+        BeanIntrospection introspection = buildBeanIntrospection('test.Test', '''
+package test;
+
+import io.micronaut.core.annotation.Introspected;
+import io.micronaut.inject.visitor.beans.MySuperclass;
+
+@Introspected
+class Test extends MySuperclass {
+
+    private final String name;
+
+    Test(String name) {
+        this.name = name;
+    }
+
+    String getName() {
+        return name;
+    }
+}
+''')
+        then: 'the property in this class is introspected'
+        introspection.getProperty("name").orElse(null)
+
+        and: 'the public property in the java superclass is introspected'
+        introspection.getProperty("publicProperty").orElse(null)
+
+        and: 'the private property in the java superclass is not introspected'
+        !introspection.getProperty("privateProperty").orElse(null)
+
+        and: 'the package private superclass property is not introspected'
+        !introspection.getProperty("packagePrivateProperty").orElse(null)
+    }
+
+    void "test package private property introspection in same package"() {
+        when:
+        BeanIntrospection introspection = buildBeanIntrospection('io.micronaut.inject.visitor.beans.Test', '''
+package io.micronaut.inject.visitor.beans;
+
+import io.micronaut.core.annotation.Introspected;
+
+@Introspected
+class Test extends MySuperclass {
+
+    private final String name;
+
+    Test(String name) {
+        this.name = name;
+    }
+
+    String getName() {
+        return name;
+    }
+}
+''')
+        then: 'the property in this class is introspected'
+        introspection.getProperty("name").orElse(null)
+
+        and: 'the public property in the java superclass is introspected'
+        introspection.getProperty("publicProperty").orElse(null)
+
+        and: 'the private property in the java superclass is not introspected'
+        !introspection.getProperty("privateProperty").orElse(null)
+
+        and: 'the package private superclass property is introspected, as we are in the same package'
+        introspection.getProperty("packagePrivateProperty").orElse(null)
+    }
+
     void "test private property 1"() {
         given:
         BeanIntrospection introspection = buildBeanIntrospection('test.OptionalDoubleHolder', '''
@@ -5255,6 +5324,7 @@ class OptionalDoubleHolder {
         introspection.getProperty("optionalDouble").get().getType() == OptionalDouble.class
         introspection.getProperty("optionalDouble").get().hasAnnotation(DecimalMin)
     }
+
     void "test private property 2"() {
         given:
         BeanIntrospection introspection = buildBeanIntrospection('test.OptionalStringHolder', '''

inject-java-test/src/test/groovy/io/micronaut/inject/visitor/beans/MySuperclass.java

@@ -0,0 +1,4 @@
+package io.micronaut.inject.visitor.beans;
+
+public class MySuperclass extends PackagePrivateSuperclass {
+}

inject-java-test/src/test/groovy/io/micronaut/inject/visitor/beans/PackagePrivateSuperclass.java

@@ -0,0 +1,22 @@
+package io.micronaut.inject.visitor.beans;
+
+class PackagePrivateSuperclass {
+
+    String packagePrivateProperty;
+
+    String getPackagePrivateProperty() {
+        return packagePrivateProperty;
+    }
+
+    private String privateProperty;
+
+    private String getPrivateProperty() {
+        return privateProperty;
+    }
+
+    public String publicProperty;
+
+    public String getPublicProperty() {
+        return publicProperty;
+    }
+}

inject-kotlin/src/main/kotlin/io/micronaut/kotlin/processing/visitor/KotlinClassElement.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2022 original authors
+ * Copyright 2017-2024 original authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import com.google.devtools.ksp.getDeclaredProperties
 import com.google.devtools.ksp.getKotlinClassByName
 import com.google.devtools.ksp.isAbstract
 import com.google.devtools.ksp.isConstructor
+import com.google.devtools.ksp.isJavaPackagePrivate
 import com.google.devtools.ksp.isPrivate
 import com.google.devtools.ksp.symbol.ClassKind
 import com.google.devtools.ksp.symbol.KSAnnotated
@@ -64,7 +65,7 @@ import io.micronaut.inject.ast.utils.AstBeanPropertiesUtils
 import io.micronaut.inject.ast.utils.EnclosedElementsQuery
 import io.micronaut.inject.processing.ProcessingException
 import io.micronaut.kotlin.processing.getBinaryName
-import java.util.*
+import java.util.Optional
 import java.util.function.Function
 import java.util.stream.Stream
 
@@ -815,7 +816,7 @@ internal open class KotlinClassElement(
                 }
 
                 PropertyElement::class.java -> {
-                    classNode.getDeclaredProperties().toList()
+                    classNode.getDeclaredProperties().filter { !it.isJavaPackagePrivate() }.toList()
                 }
 
                 ConstructorElement::class.java -> {

inject-kotlin/src/test/groovy/io/micronaut/kotlin/processing/visitor/BeanIntrospectionSpec.groovy

@@ -2352,6 +2352,53 @@ class Holder<A : Animal>(
             animal.isTypeVariable()
     }
 
+    void "test package private property introspection"() {
+        when:
+        def introspection = buildBeanIntrospection('test.Test', '''
+package test
+
+import io.micronaut.core.annotation.Introspected
+import io.micronaut.kotlin.processing.visitor.MySuperclass
+
+@Introspected
+class Test(val name: String) : MySuperclass()
+''')
+        then: 'the property in this class is introspected'
+        introspection.getProperty("name").orElse(null)
+
+        and: 'the public property in the java superclass is introspected'
+        introspection.getProperty("publicProperty").orElse(null)
+
+        and: 'the private property in the java superclass is not introspected'
+        !introspection.getProperty("privateProperty").orElse(null)
+
+        and: 'the package private superclass property is not introspected'
+        !introspection.getProperty("packagePrivateProperty").orElse(null)
+    }
+
+    void "test package private property introspection in same package"() {
+        when:
+        def introspection = buildBeanIntrospection('io.micronaut.kotlin.processing.visitor.Test', '''
+package io.micronaut.kotlin.processing.visitor
+
+import io.micronaut.core.annotation.Introspected
+
+@Introspected
+class Test(val name: String) : MySuperclass()
+''')
+        then: 'the property in this class is introspected'
+        introspection.getProperty("name").orElse(null)
+
+        and: 'the public property in the java superclass is introspected'
+        introspection.getProperty("publicProperty").orElse(null)
+
+        and: 'the private property in the java superclass is not introspected'
+        !introspection.getProperty("privateProperty").orElse(null)
+
+        and: 'the package private superclass property is introspected, as we are in the same package'
+        introspection.getProperty("packagePrivateProperty").orElse(null)
+    }
+
     void "test list property"() {
         given:
             BeanIntrospection introspection = buildBeanIntrospection('test.Cart', '''

inject-kotlin/src/test/java/io/micronaut/kotlin/processing/visitor/MySuperclass.java

@@ -0,0 +1,5 @@
+package io.micronaut.kotlin.processing.visitor;
+
+public class MySuperclass extends PackagePrivateSuperclass {
+
+}

inject-kotlin/src/test/java/io/micronaut/kotlin/processing/visitor/PackagePrivateSuperclass.java

@@ -0,0 +1,22 @@
+package io.micronaut.kotlin.processing.visitor;
+
+class PackagePrivateSuperclass {
+
+    String packagePrivateProperty;
+
+    String getPackagePrivateProperty() {
+        return packagePrivateProperty;
+    }
+
+    private String privateProperty;
+
+    private String getPrivateProperty() {
+        return privateProperty;
+    }
+
+    public String publicProperty;
+
+    public String getPublicProperty() {
+        return publicProperty;
+    }
+}

management/src/test/groovy/io/micronaut/management/endpoint/health/HealthEndpointSpec.groovy

@@ -172,6 +172,27 @@ class HealthEndpointSpec extends Specification {
         embeddedServer.close()
     }
 
+    void "test health endpoint returns 401 for sensitive true and details-visible anonymous"() {
+        given:
+        EmbeddedServer embeddedServer = ApplicationContext.run(EmbeddedServer, [
+                'spec.name': getClass().simpleName,
+                'endpoints.health.sensitive': StringUtils.TRUE,
+                'endpoints.health.details-visible': DetailsVisibility.ANONYMOUS])
+        URL server = embeddedServer.getURL()
+        HttpClient httpClient = embeddedServer.applicationContext.createBean(HttpClient, server)
+        BlockingHttpClient client = httpClient.toBlocking()
+
+        when:
+        client.exchange("/health", HealthResult)
+
+        then:
+        HttpClientResponseException ex = thrown(HttpClientResponseException)
+        HttpStatus.UNAUTHORIZED == ex.status
+
+        cleanup:
+        embeddedServer.close()
+    }
+
     void "test health endpoint with a high diskspace threshold"() {
         given:
         EmbeddedServer embeddedServer = ApplicationContext.run(EmbeddedServer, [

src/main/docs/guide/management/providedEndpoints/healthEndpoint.adoc

@@ -20,7 +20,7 @@ endpoints:
 
 - `details-visible` is one of api:management.endpoint.health.DetailsVisibility[]
 
-The `details-visible` setting controls whether health detail will be exposed to users who are not authenticated.
+The `details-visible` setting controls whether health detail will be exposed to users who are not authenticated. If the details-visible parameter is configured as ANONYMOUS, while the sensitive flag is set to true, the resulting outcome will be 401 Unauthorized.
 
 For example, setting: