diff --git a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java index de0e9c9111..2722df98cd 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java +++ b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java @@ -136,11 +136,7 @@ final class AuthorizationAnnotationUtils { Class annotationType, Function, A> map) { MergedAnnotations mergedAnnotations = MergedAnnotations.from(annotatedElement, SearchStrategy.TYPE_HIERARCHY, RepeatableContainers.none()); - List annotations = mergedAnnotations.stream(annotationType) - .map(MergedAnnotation::withNonMergedAttributes) - .map(map) - .distinct() - .toList(); + List annotations = mergedAnnotations.stream(annotationType).map(map).distinct().toList(); return switch (annotations.size()) { case 0 -> null; diff --git a/core/src/test/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtilsTests.java b/core/src/test/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtilsTests.java index 3dfc24a9e3..f6bf450afd 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtilsTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtilsTests.java @@ -90,11 +90,7 @@ class AuthorizationAnnotationUtilsTests { void composedMergedAnnotationsAreNotSupported() { Class clazz = ComposedPreAuthAnnotationOnClass.class; PreAuthorize preAuthorize = AuthorizationAnnotationUtils.findUniqueAnnotation(clazz, PreAuthorize.class); - - // If you comment out .map(MergedAnnotation::withNonMergedAttributes) in - // AuthorizationAnnotationUtils.findDistinctAnnotation(), the value of - // the merged annotation would be "hasRole('composedRole')". - assertThat(preAuthorize.value()).isEqualTo("hasRole('metaRole')"); + assertThat(preAuthorize.value()).isEqualTo("hasRole('composedRole')"); } private interface BaseRepository {