.transform / .compose duplicates Mono execution with Spring Security - spring-boot

Question

While implementing an authentication solution based on Spring Security Reactive, I faced an issue where the operations in the chain get duplicated at some point. From that, everything was called twice.
The culprit was the operator .transform at one point of the chain. After editing the called method and replacing the operator by .flatMap, the issue was resolved and everything was only called once.
The question
According to the operator's documentation, the
function is applied to an original operator chain at assembly time to augment it with the encapsulated operators
and
is basically equivalent to chaining the operators directly.
Why did the operator .transform trigger a second subscription to the chain, then ?
The context
This authentication flow takes a trusted username and retrieves its details from a webservice.
The authentication method to implement the ReactiveAuthenticationManager :
#Override
public Mono<Authentication> authenticate(Authentication providedAuthentication) {
String username = (String) providedAuthentication.getPrincipal();
String token = (String) providedAuthentication.getCredentials();
return Mono.just(providedAuthentication)
.doOnNext(x -> LOGGER.debug("Starting authentication of user {}", x))
.doOnNext(AuthenticationValidator.validateProvided)
.then(ReactiveSecurityContextHolder.getContext())
.map(SecurityContext::getAuthentication)
.flatMap(auth -> AuthenticationValidator.validateCoherence(auth, providedAuthentication))
.switchIfEmpty(Mono.defer(() -> {
LOGGER.trace("Switch if empty before retrieving user");
return retrieveUser(username, token);
}))
.doOnNext(logAccess);
}
The duplication of the calls started from the supplier of .switchIfEmpty until the end of the chain.
The method creating the Mono used by .switchIfEmpty :
private Mono<PreAuthenticatedAuthenticationToken> retrieveUser(String username, String token) {
return Mono.just(username)
.doOnNext(x -> LOGGER.trace("Before find by username"))
.then(habileUserDetails.findByUsername(username, token))
.cast(XXXUserDetails.class)
.transform(rolesProvider::provideFor)
.map(user -> new PreAuthenticatedAuthenticationToken(user, GlobalConfiguration.NO_CREDENTIAL, user.getAuthorities()))
.doOnNext(s -> LOGGER.debug("User data retrieved from XXX"));
}
The operator .transform on line 4 has been replaced by .flatMap to resolve the issue.
The original method called by the .transform operator :
public Mono<CompleteXXXUserDetails> provideFor(Mono<XXXUserDetails> user) {
return user
.map(XXXUserDetails::getAuthorities)
.map(l -> StreamHelper.transform(l, GrantedAuthority::getAuthority))
.map(matcher::match)
.map(enricher::enrich)
.map(l -> StreamHelper.transform(l, SimpleGrantedAuthority::new))
.zipWith(user, (authorities, userDetails)
-> CompleteXXXUserDetails.from(userDetails).withAllAuthorities(authorities));
}
Here is a trace of the execution :
DEBUG 20732 --- [ctor-http-nio-3] c.a.s.s.h.a.XXXAuthenticationManager : Starting authentication of user [REDACTED]
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.h.a.XXXAuthenticationManager : Switch if empty before retrieving user
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.h.a.XXXAuthenticationManager : Before find by username
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.xxx.user.UserRetriever : Between request and call
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.h.u.retriever.UserRetrieverV01: Calling webservice v01
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.h.a.XXXAuthenticationManager : Before find by username
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.xxx.user.UserRetriever : Between request and call
TRACE 20732 --- [ctor-http-nio-3] c.a.s.s.h.u.retriever.UserRetrieverV01: Calling webservice v01
For information, I'm using Spring Boot 2.1.2.RELEASE.

Answer 1

This answer doesn't address the root cause but rather explains how a transform could be applied several times when subscribed to several times, which is not the case in OP's issue. Edited the original text into a quote.
That statement is only valid when the transform is applied as a top-level operator in the chain you subscribe to. Here you are applying it within retrieveUser, which is invoked inside a Mono.defer (which goal is to execute that code for each different subscription).
(edit:) so if that defer is subscribed to x times, the transform Function will be applied x times as well.
compose is basically transform-inside-a-defer by the way.

Answer 2

The issue is in the fact that you do a user.whatever(...).zipWith(user, ...).
With transform, this translates to:
Mono<XXXUserDetails> user = Mono.just(username)
.doOnNext(x -> LOGGER.trace("Before find by username"))
.then(habileUserDetails.findByUsername(username, token))
.cast(XXXUserDetails.class);
return user.wathewer(...)
.zipWith(user, ...);
Whereas with flatMap I assume you did something to the effect of flatMap(u -> provideFor(Mono.just(u))? If so, that would translate to:
Mono<XXXUserDetails> user = Mono.just(username)
.doOnNext(x -> LOGGER.trace("Before find by username"))
.then(habileUserDetails.findByUsername(username, token))
.cast(XXXUserDetails.class);
return user.flatMap(u -> {
Mono<XXXUserDetails> capture = Mono.just(u);
return capture.whatever(...)
.zipWith(capture, ...);
}
You can see how both subscribe twice to a Mono<XXXUserDetails due to zipWith.
The reason is seems to subscribe once with flatMap is because it captures the output of the upstream pipeline and applies the provideFor function on that capture. The capture (Mono.just(u)) is subscribed twice but acts as a cache and doesn't bear any logic / logs / etc...
With transform, there is no capture. The provideFor function is applied directly to the upstream pipeline, which makes the fact that it subscribes twice quite visible.