Security rules

A security rule is a Supplier<Boolean> you hand to the builder. Before every method invocation the proxy evaluates the rule. If it returns false, the invocation is refused.

Basic usage

Service proxy = DynamicProxyBuilder
    .createBuilder(Service.class, new ServiceImpl())
    .addSecurityRule(() -> currentUserCanCallService())
    .build();

The rule is evaluated on every invocation. There is no caching. If your check is expensive, cache it yourself in the supplier.

Composing rules

You can register multiple security rules. They are evaluated in registration order; the first one that returns false short-circuits and blocks the call.

Service proxy = DynamicProxyBuilder
    .createBuilder(Service.class, new ServiceImpl())
    .addSecurityRule(() -> tenantIsActive())
    .addSecurityRule(() -> currentUserCanCallService())
    .addSecurityRule(() -> notInMaintenanceWindow())
    .build();

This is the equivalent of tenantIsActive() && currentUserCanCallService() && notInMaintenanceWindow() — but with each clause expressed as its own supplier, which makes it easy to test the rules in isolation.

What happens when a rule fails

When a security rule returns false, the proxy refuses the call. The real implementation is not invoked. Pre-actions registered before the security check are skipped. Post-actions are skipped. The caller observes the refusal — typically as null for reference-returning methods or the default primitive for primitive return types.

Note. Security rules are not a substitute for authentication or authorisation in a security framework. They are a thin runtime gate. For regulatory or audit-grade enforcement, layer them with the framework you already trust.

Combining with pre-actions

Security rules run before pre-actions. If you want logging that captures attempted calls — including refused ones — register a pre-action on a separate, outer proxy rather than on the secured one. Order matters.

Next

• Metrics — record method timings.
• Method decorators in static processors — equivalent enforcement at compile time, with per-method annotations.