Add Supplier Support

Issue gh-14597

Author: jzheaux

core/src/main/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactory.java

@@ -34,6 +34,7 @@
 import java.util.SortedSet;
 import java.util.TreeMap;
 import java.util.TreeSet;
+import java.util.function.Supplier;
 import java.util.stream.Stream;
 
 import reactor.core.publisher.Flux;
@@ -91,7 +92,7 @@ public final class AuthorizationAdvisorProxyFactory
 	/**
 	 * The default {@link TargetVisitor}, which will proxy {@link Class} instances as well
 	 * as instances contained in reactive types (if reactor is present), collection types,
-	 * and other container types like {@link Optional}
+	 * and other container types like {@link Optional} and {@link Supplier}
 	 */
 	public static final TargetVisitor DEFAULT_VISITOR = isReactivePresent
 			? new DelegateVisitor(new ClassVisitor(), new ReactiveTypeVisitor(), new ContainerTypeVisitor())
@@ -330,6 +331,9 @@ public Object visit(AuthorizationAdvisorProxyFactory proxyFactory, Object target
 			if (target instanceof Optional<?> optional) {
 				return proxyOptional(proxyFactory, optional);
 			}
+			if (target instanceof Supplier<?> supplier) {
+				return proxySupplier(proxyFactory, supplier);
+			}
 			return null;
 		}
 
@@ -462,6 +466,10 @@ private Optional<?> proxyOptional(AuthorizationProxyFactory proxyFactory, Option
 			return optional.map(proxyFactory::proxy);
 		}
 
+		private Supplier<?> proxySupplier(AuthorizationProxyFactory proxyFactory, Supplier<?> supplier) {
+			return () -> proxyFactory.proxy(supplier.get());
+		}
+
 	}
 
 	private static class ReactiveTypeVisitor implements TargetVisitor {

core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java

@@ -31,6 +31,7 @@
 import java.util.SortedSet;
 import java.util.TreeMap;
 import java.util.TreeSet;
+import java.util.function.Supplier;
 import java.util.stream.Stream;
 
 import org.jetbrains.annotations.NotNull;
@@ -242,6 +243,17 @@ public void proxyWhenPreAuthorizeForOptionalThenHonors() {
 		SecurityContextHolder.clearContext();
 	}
 
+	@Test
+	public void proxyWhenPreAuthorizeForSupplierThenHonors() {
+		SecurityContextHolder.getContext().setAuthentication(this.user);
+		AuthorizationAdvisorProxyFactory factory = AuthorizationAdvisorProxyFactory.withDefaults();
+		Supplier<Flight> flights = () -> this.flight;
+		assertThat(flights.get().getAltitude()).isEqualTo(35000d);
+		Supplier<Flight> secured = proxy(factory, flights);
+		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> secured.get().getAltitude());
+		SecurityContextHolder.clearContext();
+	}
+
 	@Test
 	public void proxyWhenPreAuthorizeForStreamThenHonors() {
 		SecurityContextHolder.getContext().setAuthentication(this.user);