Only @Component are considered for method security processing

spring-aot/src/main/java/org/springframework/security/PrePostSecuredNativeConfigurationProcessor.java

@@ -27,8 +27,8 @@
 import org.springframework.aop.framework.Advised;
 import org.springframework.aot.context.bootstrap.generator.infrastructure.nativex.BeanFactoryNativeConfigurationProcessor;
 import org.springframework.aot.context.bootstrap.generator.infrastructure.nativex.NativeConfigurationRegistry;
-import org.springframework.aot.context.bootstrap.generator.infrastructure.nativex.NativeConfigurationUtils;
 import org.springframework.aot.context.bootstrap.generator.infrastructure.nativex.NativeProxyEntry;
+import org.springframework.aot.support.BeanFactoryProcessor;
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.core.DecoratingProxy;
 import org.springframework.core.annotation.MergedAnnotations;
@@ -86,7 +86,9 @@ private static boolean isPrePostSecured(Class<?> type, SearchStrategy strategy)
 	static class Processor {
 
 		void process(ConfigurableListableBeanFactory beanFactory, NativeConfigurationRegistry registry) {
-			NativeConfigurationUtils.doWithComponents(beanFactory,
+
+			new BeanFactoryProcessor(beanFactory).processBeans(
+					(beanType) -> isPrePostSecured(beanType, SearchStrategy.TYPE_HIERARCHY),
 					(beanName, beanType) -> {
 						// Check if it is an interface or the PrePost annotations are not directly on this 'class' (in which
 						// case we assume it is on a super interface - this is not perfect)
@@ -106,8 +108,8 @@ void process(ConfigurableListableBeanFactory beanFactory, NativeConfigurationReg
 							logger.debug("creating AOTProxy for this class: " + beanType.getName());
 							registry.proxy().add(NativeProxyEntry.ofClass(beanType, ProxyBits.IS_STATIC));
 						}
-					},
-					(beanName, beanType) -> isPrePostSecured(beanType, SearchStrategy.TYPE_HIERARCHY));
+					}
+			);
 		}
 	}
 }

spring-aot/src/test/java/org/springframework/security/PrePostSecuredNativeConfigurationProcessorTests.java

@@ -182,6 +182,25 @@ void postFilterAnnotationOnClassMethod() {
 		assertThat(aotProxyDescriptor.getProxyFeatures()).isEqualTo(ProxyBits.IS_STATIC);
 	}
 
+	@Test
+	void preAuthorizeAnnotationOnNonComponent() {
+		DefaultListableBeanFactory beanFactory = new DefaultListableBeanFactory();
+		beanFactory.registerBeanDefinition("noise", BeanDefinitionBuilder.rootBeanDefinition(String.class).getBeanDefinition());
+		beanFactory.registerBeanDefinition("endpoint", BeanDefinitionBuilder.rootBeanDefinition(PreAuthorizeNonComponent.class).getBeanDefinition());
+		NativeConfigurationRegistry registry = process(beanFactory);
+		Set<NativeProxyEntry> proxyEntries = registry.proxy().getEntries();
+		assertThat(proxyEntries).hasSize(1);
+		ProxiesDescriptor proxiesDescriptor = registry.proxy().toProxiesDescriptor();
+		Set<JdkProxyDescriptor> proxyDescriptors = proxiesDescriptor.getProxyDescriptors();
+		assertThat(proxyDescriptors).hasSize(1);
+		JdkProxyDescriptor proxyDescriptor = proxyDescriptors.iterator().next();
+		assertThat(proxyDescriptor).isInstanceOf(AotProxyDescriptor.class);
+		AotProxyDescriptor aotProxyDescriptor = (AotProxyDescriptor) proxyDescriptor;
+		assertThat(aotProxyDescriptor.getTargetClassType()).isEqualTo(PreAuthorizeNonComponent.class.getName());
+		assertThat(aotProxyDescriptor.getInterfaceTypes()).isEmpty();
+		assertThat(aotProxyDescriptor.getProxyFeatures()).isEqualTo(ProxyBits.IS_STATIC);
+	}
+
 	private NativeConfigurationRegistry process(DefaultListableBeanFactory beanFactory) {
 		NativeConfigurationRegistry registry = new NativeConfigurationRegistry();
 		new PrePostSecuredNativeConfigurationProcessor().process(beanFactory, registry);
@@ -246,4 +265,10 @@ public List<String> foo() {
 			return Collections.emptyList();
 		}
 	}
+
+	static class PreAuthorizeNonComponent {
+		@PreAuthorize("hasRole('ADMIN')")
+		public void foo() {
+		}
+	}
 }