Enable Null Checking with JSpecify

Closes gh-3637

Author: rwinch

buildSrc/build.gradle

@@ -57,6 +57,7 @@ configurations {
 }
 
 dependencies {
+    implementation libs.spring.nullability
     implementation 'com.google.code.gson:gson:2.13.2'
     implementation 'net.sourceforge.saxon:saxon:9.1.0.8'
     implementation 'org.yaml:snakeyaml:1.33'

buildSrc/src/main/groovy/session-nullability.gradle

@@ -0,0 +1,3 @@
+plugins {
+	id 'io.spring.nullability'
+}

gradle/libs.versions.toml

@@ -42,3 +42,4 @@ io-spring-security-release-plugin = "io.spring.gradle:spring-security-release-pl
 org-springframework-boot-spring-boot-gradle-plugin = { module = "org.springframework.boot:spring-boot-gradle-plugin", version.ref = "org-springframework-boot" }
 io-spring-javaformat-spring-javaformat-checkstyle = "io.spring.javaformat:spring-javaformat-checkstyle:0.0.47"
 io-spring-nohttp-nohttp-checkstyle = "io.spring.nohttp:nohttp-checkstyle:0.0.11"
+spring-nullability = "io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.10"

spring-session-core/spring-session-core.gradle

@@ -1,3 +1,7 @@
+plugins {
+	id 'session-nullability'
+}
+
 apply plugin: 'io.spring.convention.spring-module'
 
 description = "Spring Session"

spring-session-core/src/main/java/org/springframework/session/MapSession.java

@@ -25,6 +25,8 @@
 import java.util.Set;
 import java.util.UUID;
 
+import org.jspecify.annotations.Nullable;
+
 /**
  * <p>
  * A {@link Session} implementation that is backed by a {@link java.util.Map}. The
@@ -188,7 +190,7 @@ boolean isExpired(Instant now) {
 
 	@Override
 	@SuppressWarnings("unchecked")
-	public <T> T getAttribute(String attributeName) {
+	public <T> @Nullable T getAttribute(String attributeName) {
 		return (T) this.sessionAttrs.get(attributeName);
 	}
 
@@ -198,7 +200,7 @@ public Set<String> getAttributeNames() {
 	}
 
 	@Override
-	public void setAttribute(String attributeName, Object attributeValue) {
+	public void setAttribute(String attributeName, @Nullable Object attributeValue) {
 		if (attributeValue == null) {
 			removeAttribute(attributeName);
 		}

spring-session-core/src/main/java/org/springframework/session/MapSessionRepository.java

@@ -19,6 +19,8 @@
 import java.time.Duration;
 import java.util.Map;
 
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.session.events.SessionDeletedEvent;
 import org.springframework.session.events.SessionExpiredEvent;
 import org.springframework.util.Assert;
@@ -79,7 +81,7 @@ public void save(MapSession session) {
 	}
 
 	@Override
-	public MapSession findById(String id) {
+	public @Nullable MapSession findById(String id) {
 		Session saved = this.sessions.get(id);
 		if (saved == null) {
 			return null;

spring-session-core/src/main/java/org/springframework/session/PrincipalNameIndexResolver.java

@@ -16,6 +16,8 @@
 
 package org.springframework.session;
 
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.expression.Expression;
 import org.springframework.expression.spel.standard.SpelExpressionParser;
 
@@ -47,7 +49,7 @@ public PrincipalNameIndexResolver(String indexName) {
 		super(indexName);
 	}
 
-	public String resolveIndexValueFor(S session) {
+	public @Nullable String resolveIndexValueFor(S session) {
 		String principalName = session.getAttribute(getIndexName());
 		if (principalName != null) {
 			return principalName;

spring-session-core/src/main/java/org/springframework/session/Session.java

@@ -20,6 +20,8 @@
 import java.time.Instant;
 import java.util.Set;
 
+import org.jspecify.annotations.Nullable;
+
 /**
  * Provides a way to identify a user in an agnostic way. This allows the session to be
  * used by an HttpSession, WebSocket Session, or even non web related sessions.
@@ -51,7 +53,7 @@ public interface Session {
 	 * @return the Object associated with the specified name or null if no Object is
 	 * associated to that name
 	 */
-	<T> T getAttribute(String attributeName);
+	<T> @Nullable T getAttribute(String attributeName);
 
 	/**
 	 * Return the session attribute value or if not present raise an

spring-session-core/src/main/java/org/springframework/session/SessionRepository.java

@@ -16,6 +16,8 @@
 
 package org.springframework.session;
 
+import org.jspecify.annotations.Nullable;
+
 /**
  * A repository interface for managing {@link Session} instances.
  *
@@ -59,7 +61,7 @@ public interface SessionRepository<S extends Session> {
 	 * @return the {@link Session} by the {@link Session#getId()} or null if no
 	 * {@link Session} is found.
 	 */
-	S findById(String id);
+	@Nullable S findById(String id);
 
 	/**
 	 * Deletes the {@link Session} with the given {@link Session#getId()} or does nothing

spring-session-core/src/main/java/org/springframework/session/SingleIndexResolver.java

@@ -19,6 +19,8 @@
 import java.util.Collections;
 import java.util.Map;
 
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.util.Assert;
 
 /**
@@ -42,7 +44,7 @@ protected String getIndexName() {
 		return this.indexName;
 	}
 
-	public abstract String resolveIndexValueFor(S session);
+	public abstract @Nullable String resolveIndexValueFor(S session);
 
 	public final Map<String, String> resolveIndexesFor(S session) {
 		String indexValue = resolveIndexValueFor(session);