fix: simplify DefaultRestAuthenticatorEventPublisher construction

Parent `DefaultAuthenticationEventPublisher` creates its own
no-op publisher when constructed without arguments.

Author: matrei

plugin-rest/spring-security-rest/src/main/groovy/grails/plugin/springsecurity/rest/authentication/DefaultRestAuthenticationEventPublisher.groovy

@@ -30,23 +30,14 @@ import org.springframework.security.authentication.DefaultAuthenticationEventPub
 @CompileStatic
 class DefaultRestAuthenticationEventPublisher extends DefaultAuthenticationEventPublisher implements RestAuthenticationEventPublisher {
 
-    // Spring Security 7 no longer accepts a null ApplicationEventPublisher in the
-    // DefaultAuthenticationEventPublisher constructor, so use a no-op fallback until
-    // Spring injects the real publisher through the setter.
-    private static final ApplicationEventPublisher NO_OP_APPLICATION_EVENT_PUBLISHER = new ApplicationEventPublisher() {
-        @Override
-        void publishEvent(Object event) {
-        }
-    }
-
     private ApplicationEventPublisher applicationEventPublisher
 
     DefaultRestAuthenticationEventPublisher() {
-        this(null)
+        super()
     }
 
     DefaultRestAuthenticationEventPublisher(ApplicationEventPublisher publisher) {
-        super(publisher ?: NO_OP_APPLICATION_EVENT_PUBLISHER)
+        super(publisher)
         this.applicationEventPublisher = publisher
     }
 

plugin-rest/spring-security-rest/src/test/groovy/grails/plugin/springsecurity/rest/authentication/DefaultRestAuthenticationEventPublisherSpec.groovy

@@ -83,15 +83,6 @@ class DefaultRestAuthenticationEventPublisherSpec extends Specification {
         0 * eventPublisher.publishEvent(_)
     }
 
-    void "should allow null publisher in constructor and remain no-op for token events"() {
-        when:
-        new DefaultRestAuthenticationEventPublisher(null).publishTokenCreation(accessToken)
-
-        then:
-        noExceptionThrown()
-        0 * eventPublisher.publishEvent(_)
-    }
-
     void "should not execute parent publishEvent when publisher is not set"() {
         when:
         new DefaultRestAuthenticationEventPublisher().publishAuthenticationSuccess(accessToken)