001/*
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements.  See the NOTICE file distributed with
004 * this work for additional information regarding copyright ownership.
005 * The ASF licenses this file to You under the Apache License, Version 2.0
006 * (the "License"); you may not use this file except in compliance with
007 * the License.  You may obtain a copy of the License at
008 *
009 *      http://www.apache.org/licenses/LICENSE-2.0
010 *
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS,
013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 * See the License for the specific language governing permissions and
015 * limitations under the License.
016 */
017package org.apache.juneau.rest.server.guard;
018
019import org.apache.juneau.rest.server.*;
020
021/**
022 * Deny-all {@link RestGuard} — rejects every request with {@code 403 Forbidden}.
023 *
024 * <p>
025 * Used as the secure-by-default placeholder on operations or resources that require an
026 * authentication / authorization chain the importer must explicitly opt into. Without the
027 * importer's override, every request is denied; once a user-supplied
028 * {@link org.apache.juneau.commons.inject.Bean @Bean} {@link RestGuardList} is registered on the
029 * resource, the framework's bean-store override seam <b>replaces</b> the entire
030 * annotation-derived guard list (including this deny-all) with the user-supplied chain &mdash;
031 * see the {@code RestOpContext.guards} memoizer for the full lookup contract.
032 *
033 * <h5 class='figure'>Composition example:</h5>
034 *
035 * <p class='bjava'>
036 *    <jc>// Default-deny on a resource until the importer wires up auth.</jc>
037 *    <ja>@Rest</ja>(path=<js>"/admin"</js>, guards=DenyAllGuard.<jk>class</jk>)
038 *    <jk>public class</jk> AdminResource <jk>extends</jk> RestServlet {
039 *
040 *       <jc>// Importer opt-in: register a guard chain that allows authorized callers through.</jc>
041 *       <ja>@Bean</ja>(name=<js>"guards"</js>)
042 *       <jk>public</jk> RestGuardList guards(BeanStore <jv>bs</jv>) {
043 *          <jk>return</jk> RestGuardList.<jsm>create</jsm>(<jv>bs</jv>)
044 *             .append(<jk>new</jk> MyAuthGuard())
045 *             .build();
046 *       }
047 *    }
048 * </p>
049 *
050 * <h5 class='section'>See Also:</h5><ul>
051 *    <li class='jc'>{@link RestGuard}
052 *    <li class='jc'>{@link RestGuardList}
053 *    <li class='ja'>{@link Rest#guards()}
054 *    <li class='ja'>{@link RestOp#guards()}
055 * </ul>
056 *
057 * @since 10.0.0
058 */
059public class DenyAllGuard extends RestGuard {
060
061   @Override /* Overridden from RestGuard */
062   public boolean isRequestAllowed(RestRequest req) {
063      return false;
064   }
065}