[peholmst]

Fixes the role-based access example in Secure React Views (articles/building-apps/react/security.adoc), a follow-up to #6622.

Problems

1. Reloading a role-protected view gave 403. The guide stripped the ROLE_ prefix in getRoles and wrote rolesAllowed: [ "ADMIN" ]. Client-side navigation and the menu worked. But when the page of a view with loginRequired: true loads, Spring Security compares rolesAllowed with the granted authorities exactly, so an administrator who reloaded the view, or came back to it after logging in, got 403 Forbidden. The underlying mismatch is reported as Page load of a React view checks rolesAllowed without the role prefix flow#26962. Related but separate: No redirect to /login if a user's role has no privileges flow#22280.
2. The getRoles example didn't type-check. @NonNull Collection<String> authorities, in a package without @NullMarked, generates authorities: Array<string | undefined>, so s.startsWith(...) fails with TS18048: 's' is possibly 'undefined'. In dev mode the type-check overlay also covers the login form.

Changes

• UserInfo is now record UserInfo(String name, List<String> roles), plus a package-info.java step with @NullMarked and a link to Type Nullability. The redundant @NonNull on getUserInfo() is gone.
• Expose Roles to the Context no longer shows getRoles code: configureAuth() reads the roles property by default. The section links to the Authentication Context reference for user information that keeps its roles elsewhere.
• rolesAllowed and hasAccess() use ROLE_ADMIN. The callout says what goes wrong without the prefix and links to Role Names in View Access Control, which recommends the same approach.

The guide stays a how-to: the details are in the Flow reference pages it links to.

Testing

A scratch app on Vaadin 25.4.0-alpha5 and Spring Boot 4.1.2 (Spring Security 7), built from the guide's snippets as written. In-memory users: admin (ADMIN, USER) and user (USER).

Check	Before	After
tsc --noEmit	2 × TS18048 in auth.ts	Passes; generated roles: Array<string>, Promise<UserInfo>
admin: log in from /admin	Redirected to /admin, then 403	Back on /admin?continue, view renders
admin: menu	Home, Account, Admin	Home, Account, Admin
admin: client navigation to /admin	Renders	Renders
admin: reload /admin	403	200, renders
admin: hasAccess() in account view	Admin-only text shown	Admin-only text shown
user: menu	—	Home, Account
user: client navigation to /admin	—	Sent to /login
user: reload /admin	—	403
user: hasAccess() in account view	—	Admin-only text hidden

Vale reports nothing on the changed lines.

Not included

No target/v25.3 label. v25.3 has the same example, but the reference pages this change links to (flow/security/react-views/..., Type Nullability) don't exist there, since #6622 wasn't picked to v25.3. A v25.3 fix needs its own links, and verification on 25.3.

🤖 Generated with Claude Code

[vaadin-review-bot]

✅ Nothing to flag — the changes look good.