Align Servlet ExchangeFilterFunction CoreSubscriber

[jgrandja]

Fixes gh-7422

The intention of the new SecurityReactorContextConfiguration is that it's meant to be used/shared by both ServletOAuth2AuthorizedClientExchangeFilterFunction and ServletBearerExchangeFilterFunction. However, the changes in this PR work only for ServletOAuth2AuthorizedClientExchangeFilterFunction.

When this PR is merged than I believe we can remove OAuth2ResourceServerConfiguration and apply a very small change in ServletBearerExchangeFilterFunction, which will than resolve #7423.

[jzheaux]

LGTM

Note: I pulled your changes locally to try them out with Resource Server, performing the needed changes, and it continued to work as expected.

[robotmrv]

@jgrandja @rwinch
as far as function from Hooks.onLastOperator is invoked for each last operator in a chain it means that such simple code will print 201:

public static void main(String[] args) {
    final AtomicInteger counter = new AtomicInteger();
    Hooks.onLastOperator(pub -> {
        counter.incrementAndGet();
        return pub;
    });
    Flux.range(0, 200)
            .flatMap(it -> Mono.defer(() -> Mono.just(it)))//just do some work
            .blockLast();
    System.out.println("counter: " + counter);
}

it means that 200 publishers and probably subscribers and attributes maps will be created just for nothing.
To reduce allocation this code could be rewritten to

public void afterPropertiesSet() {
	Function<? super Publisher<Object>, ? extends Publisher<Object>> lifter =
			Operators.liftPublisher((s, sub) -> createRequestContextSubscriberIfNecessary(sub));
	Hooks.onLastOperator(SECURITY_REACTOR_CONTEXT_OPERATOR_KEY, pub -> {
		HttpServletRequest request = null;
		HttpServletResponse response = null;
		ServletRequestAttributes requestAttributes =
				(ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
		if (requestAttributes != null) {
			request = requestAttributes.getRequest();
			response = requestAttributes.getResponse();
		}
		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
		if (authentication == null && request == null && response == null) {
			// No need to create lift Publisher so return original
			return pub;
		}
		return lifter.apply(pub);
	});
}
...
<T> CoreSubscriber<T> createRequestContextSubscriberIfNecessary(CoreSubscriber<T> delegate) {
	if (delegate.currentContext().hasKey(SECURITY_CONTEXT_ATTRIBUTES)) {
        //already enriched. no nead to create Subscriber
		return delegate;
	}
... // the rest logic is the same 
}

[jgrandja]

@robotmrv Your tips on the Reactive end of things has been very valuable. Thank you for keeping an eye out on improvements. I applied your suggested changes :) Thanks again!

[jgrandja]

Merged via 2a5bd6e