Merge branch '24.5' into cherry-pick-20688-to-24.5-1734103957398

flow-server/src/main/java/com/vaadin/flow/server/auth/NavigationAccessControl.java

@@ -454,7 +454,7 @@ public NavigationContext createNavigationContext(Class<?> navigationTarget,
         Objects.requireNonNull(vaadinService);
         return new NavigationContext(vaadinService.getRouter(),
                 navigationTarget, new Location(path), RouteParameters.empty(),
-                vaadinRequest.getUserPrincipal(),
-                getRolesChecker(vaadinRequest), false);
+                getPrincipal(vaadinRequest), getRolesChecker(vaadinRequest),
+                false);
     }
 }

flow-tests/vaadin-spring-tests/test-spring-security-flow-methodsecurity/src/test/java/com/vaadin/flow/spring/flowsecurity/AbstractIT.java

@@ -93,6 +93,8 @@ protected void login(String username, String password) {
         form.getUsernameField().setValue(username);
         form.getPasswordField().setValue(password);
         form.submit();
+        waitUntilNot(
+                driver -> driver.getCurrentUrl().contains("my/login/page"));
         waitUntilNot(driver -> $(LoginOverlayElement.class).exists());
     }
 
@@ -102,12 +104,14 @@ protected void assertLoginViewShown() {
     }
 
     protected void assertRootPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ROOT_PAGE_HEADER_TEXT, headerText);
     }
 
     protected void assertAnotherPublicPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ANOTHER_PUBLIC_PAGE_HEADER_TEXT, headerText);
@@ -130,7 +134,7 @@ protected void assertAdminPageShown(String fullName) {
     }
 
     protected void assertPathShown(String path) {
-
+        waitForClientRouter();
         waitUntil(driver -> {
             String url = driver.getCurrentUrl();
             if (!url.startsWith(getRootURL())) {

flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AbstractIT.java

@@ -96,6 +96,8 @@ protected void login(String username, String password) {
         form.getUsernameField().setValue(username);
         form.getPasswordField().setValue(password);
         form.submit();
+        waitUntilNot(
+                driver -> driver.getCurrentUrl().contains("my/login/page"));
         waitUntilNot(driver -> $(LoginOverlayElement.class).exists());
     }
 
@@ -105,12 +107,14 @@ protected void assertLoginViewShown() {
     }
 
     protected void assertRootPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ROOT_PAGE_HEADER_TEXT, headerText);
     }
 
     protected void assertAnotherPublicPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ANOTHER_PUBLIC_PAGE_HEADER_TEXT, headerText);
@@ -133,7 +137,7 @@ protected void assertAdminPageShown(String fullName) {
     }
 
     protected void assertPathShown(String path) {
-
+        waitForClientRouter();
         waitUntil(driver -> {
             String url = driver.getCurrentUrl();
             if (!url.startsWith(getRootURL())) {

flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AppViewIT.java

@@ -4,6 +4,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.time.Duration;
 import java.util.List;
 import java.util.stream.Collectors;
 
@@ -12,6 +13,7 @@
 import org.hamcrest.MatcherAssert;
 import org.junit.Assert;
 import org.junit.Test;
+import org.openqa.selenium.WebDriver;
 
 import com.vaadin.flow.component.button.testbench.ButtonElement;
 import com.vaadin.flow.component.upload.testbench.UploadElement;
@@ -220,7 +222,8 @@ public void upload_file_in_private_view() throws IOException {
                 .getResourceAsStream("image.png");
         IOUtils.copyLarge(imageStream, new FileOutputStream(tmpFile));
         tmpFile.deleteOnExit();
-        upload.upload(tmpFile);
+        upload.upload(tmpFile, 0);
+        waitForUploads(upload, 60);
 
         TestBenchElement text = $("p").id("uploadText");
         TestBenchElement img = $("img").id("uploadImage");
@@ -400,4 +403,25 @@ private List<MenuItem> getMenuItems() {
         }).collect(Collectors.toList());
     }
 
+    // Workaround for https://github.com/vaadin/flow-components/issues/3646
+    // The issue causes the upload test to be flaky
+    private void waitForUploads(UploadElement element, int maxSeconds) {
+        WebDriver.Timeouts timeouts = getDriver().manage().timeouts();
+        timeouts.scriptTimeout(Duration.ofSeconds(maxSeconds));
+
+        String script = """
+                var callback = arguments[arguments.length - 1];
+                var upload = arguments[0];
+                let intervalId;
+                intervalId = window.setInterval(function() {
+                  var inProgress = upload.files.filter(function(file) { return file.uploading;}).length >0;
+                  if (!inProgress) {
+                    window.clearInterval(intervalId);
+                    callback();
+                  }
+                }, 500);
+                """;
+        getCommandExecutor().getDriver().executeAsyncScript(script, element);
+    }
+
 }

flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/UIAccessContextIT.java

@@ -64,6 +64,7 @@ public void securityContextSetForUIAccess() throws Exception {
     }
 
     private void loginAdmin(HasElementQuery adminContext) {
+        waitForClientRouter();
         LoginFormElement form = adminContext.$(LoginOverlayElement.class)
                 .first().getLoginForm();
         form.getUsernameField().setValue("emma");

flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AbstractIT.java

@@ -96,6 +96,8 @@ protected void login(String username, String password) {
         form.getUsernameField().setValue(username);
         form.getPasswordField().setValue(password);
         form.submit();
+        waitUntilNot(
+                driver -> driver.getCurrentUrl().contains("my/login/page"));
         waitUntilNot(driver -> $(LoginOverlayElement.class).exists());
     }
 
@@ -105,12 +107,14 @@ protected void assertLoginViewShown() {
     }
 
     protected void assertRootPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ROOT_PAGE_HEADER_TEXT, headerText);
     }
 
     protected void assertAnotherPublicPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ANOTHER_PUBLIC_PAGE_HEADER_TEXT, headerText);
@@ -133,7 +137,7 @@ protected void assertAdminPageShown(String fullName) {
     }
 
     protected void assertPathShown(String path) {
-
+        waitForClientRouter();
         waitUntil(driver -> {
             String url = driver.getCurrentUrl();
             if (!url.startsWith(getRootURL())) {

flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AppViewIT.java

@@ -4,6 +4,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.time.Duration;
 import java.util.List;
 import java.util.stream.Collectors;
 
@@ -13,6 +14,7 @@
 import org.junit.Assert;
 import org.junit.Ignore;
 import org.junit.Test;
+import org.openqa.selenium.WebDriver;
 
 import com.vaadin.flow.component.button.testbench.ButtonElement;
 import com.vaadin.flow.component.upload.testbench.UploadElement;
@@ -222,7 +224,8 @@ public void upload_file_in_private_view() throws IOException {
                 .getResourceAsStream("image.png");
         IOUtils.copyLarge(imageStream, new FileOutputStream(tmpFile));
         tmpFile.deleteOnExit();
-        upload.upload(tmpFile);
+        upload.upload(tmpFile, 0);
+        waitForUploads(upload, 60);
 
         TestBenchElement text = $("p").id("uploadText");
         TestBenchElement img = $("img").id("uploadImage");
@@ -368,4 +371,25 @@ private List<MenuItem> getMenuItems() {
         }).collect(Collectors.toList());
     }
 
+    // Workaround for https://github.com/vaadin/flow-components/issues/3646
+    // The issue causes the upload test to be flaky
+    private void waitForUploads(UploadElement element, int maxSeconds) {
+        WebDriver.Timeouts timeouts = getDriver().manage().timeouts();
+        timeouts.scriptTimeout(Duration.ofSeconds(maxSeconds));
+
+        String script = """
+                var callback = arguments[arguments.length - 1];
+                var upload = arguments[0];
+                let intervalId;
+                intervalId = window.setInterval(function() {
+                  var inProgress = upload.files.filter(function(file) { return file.uploading;}).length >0;
+                  if (!inProgress) {
+                    window.clearInterval(intervalId);
+                    callback();
+                  }
+                }, 500);
+                """;
+        getCommandExecutor().getDriver().executeAsyncScript(script, element);
+    }
+
 }

flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/UIAccessContextIT.java

@@ -66,6 +66,7 @@ public void securityContextSetForUIAccess() throws Exception {
     }
 
     private void loginAdmin(HasElementQuery adminContext) {
+        waitForClientRouter();
         LoginFormElement form = adminContext.$(LoginOverlayElement.class)
                 .first().getLoginForm();
         form.getUsernameField().setValue("emma");

flow-tests/vaadin-spring-tests/test-spring-security-flow-websocket/src/test/java/com/vaadin/flow/spring/flowsecuritywebsocket/AppViewIT.java

@@ -14,7 +14,17 @@ public class AppViewIT extends com.vaadin.flow.spring.flowsecurity.AppViewIT {
             session expiration handler to redirect to the timeout page instead
             of the logout view, because the logout process is still ongoing.
             """)
-    public void logout_via_doLogin_redirects_to_logout() {
-        super.logout_via_doLogin_redirects_to_logout();
+    public void logout_via_doLogoutURL_redirects_to_logout() {
+        super.logout_via_doLogoutURL_redirects_to_logout();
+    }
+
+    @Test
+    public void websocket_roles_checked_correctly_during_navigation() {
+        open("admin");
+        loginAdmin();
+        navigateTo("");
+        assertRootPageShown();
+        navigateTo("admin");
+        assertAdminPageShown(ADMIN_FULLNAME);
     }
 }

flow-tests/vaadin-spring-tests/test-spring-security-flow/src/main/java/com/vaadin/flow/spring/flowsecurity/views/AdminView.java

@@ -4,6 +4,9 @@
 
 import java.util.concurrent.TimeUnit;
 
+import org.springframework.security.concurrent.DelegatingSecurityContextRunnable;
+import org.springframework.security.core.context.SecurityContextHolder;
+
 import com.vaadin.flow.component.UI;
 import com.vaadin.flow.component.button.Button;
 import com.vaadin.flow.component.html.Div;
@@ -37,14 +40,16 @@ public AdminView(SecurityUtils securityUtils) {
         accessRolePrefixedAdminPageFromThread.setId(ROLE_PREFIX_TEST_BUTTON_ID);
         accessRolePrefixedAdminPageFromThread.addClickListener(event -> {
             UI ui = event.getSource().getUI().get();
-            new Thread(() -> {
+            Runnable doNavigation = () -> {
                 try {
                     TimeUnit.MILLISECONDS.sleep(100);
                     ui.access(() -> ui.navigate(RolePrefixedAdminView.class));
                 } catch (InterruptedException e) {
                 }
-
-            }).start();
+            };
+            Runnable wrappedRunnable = new DelegatingSecurityContextRunnable(
+                    doNavigation, SecurityContextHolder.getContext());
+            new Thread(wrappedRunnable).start();
         });
         add(accessRolePrefixedAdminPageFromThread);
     }

flow-tests/vaadin-spring-tests/test-spring-security-flow/src/main/java/com/vaadin/flow/spring/flowsecurity/views/PublicView.java

@@ -1,5 +1,8 @@
 package com.vaadin.flow.spring.flowsecurity.views;
 
+import org.springframework.security.concurrent.DelegatingSecurityContextRunnable;
+import org.springframework.security.core.context.SecurityContextHolder;
+
 import com.vaadin.flow.component.UI;
 import com.vaadin.flow.component.button.Button;
 import com.vaadin.flow.component.html.H1;
@@ -36,16 +39,19 @@ public PublicView() {
         Button backgroundNavigation = new Button(
                 "Navigate to admin view in 1 second", e -> {
                     UI ui = e.getSource().getUI().get();
-                    new Thread(() -> {
+                    Runnable navigateToAdmin = () -> {
                         try {
                             Thread.sleep(1000);
                         } catch (InterruptedException e1) {
                         }
                         ui.access(() -> {
                             ui.navigate(AdminView.class);
                         });
-
-                    }).start();
+                    };
+                    Runnable wrappedRunnable = new DelegatingSecurityContextRunnable(
+                            navigateToAdmin,
+                            SecurityContextHolder.getContext());
+                    new Thread(wrappedRunnable).start();
                 });
         backgroundNavigation.setId(BACKGROUND_NAVIGATION_ID);
         add(backgroundNavigation);

flow-tests/vaadin-spring-tests/test-spring-security-flow/src/test/java/com/vaadin/flow/spring/flowsecurity/AbstractIT.java

@@ -97,6 +97,8 @@ protected void login(String username, String password) {
         form.getUsernameField().setValue(username);
         form.getPasswordField().setValue(password);
         form.submit();
+        waitUntilNot(
+                driver -> driver.getCurrentUrl().contains("my/login/page"));
         waitUntilNot(driver -> $(LoginOverlayElement.class).exists());
     }
 
@@ -111,12 +113,14 @@ protected void assertLogoutViewShown() {
     }
 
     protected void assertRootPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ROOT_PAGE_HEADER_TEXT, headerText);
     }
 
     protected void assertAnotherPublicPageShown() {
+        waitForClientRouter();
         waitUntil(drive -> $("h1").attribute("id", "header").exists());
         String headerText = $("h1").id("header").getText();
         Assert.assertEquals(ANOTHER_PUBLIC_PAGE_HEADER_TEXT, headerText);
@@ -147,7 +151,7 @@ protected void assertRolePrefixedAdminPageShown(String fullName) {
     }
 
     protected void assertPathShown(String path) {
-
+        waitForClientRouter();
         waitUntil(driver -> {
             String url = driver.getCurrentUrl();
             if (!url.startsWith(getRootURL())) {