dimanche 29 mars 2015

Spring framework, custom function in PreAuthorize of controller

I am new to spring and i'm trying to learn be developing a simple application.


This is the schema of the database: http://ift.tt/1BAcLk2


It is very simple, each user must start by logging in, and once they do it, a list of the teams in which are administrators is displayed. That information is stored in the table team_members



INSERT INTO team_members (user_id, team_id, role) VALUES ('1', '1', 'admin');
INSERT INTO team_members (user_id, team_id, role) VALUES ('1', '2', 'admin');
INSERT INTO team_members (user_id, team_id, role) VALUES ('2', '2', 'player');
INSERT INTO team_members (user_id, team_id, role) VALUES ('2', '3', 'admin');


My problem arises when a user tries to edit or access the page to edit of one of the teams. This is my controller to do it:



@RequestMapping(value="teams/{id}/edit", method=RequestMethod.GET)
public ModelAndView editTeamPage(@PathVariable Integer id) {
ModelAndView modelAndView = new ModelAndView("edit-team-form");
Team team = teamService.getTeam(id);
modelAndView.addObject("team",team);
return modelAndView;
}


To be able to access this page, this user must be authenticated isAuthenticated(), however, I would also like to check if the role of the user in the table team_members is admin.

So my question is, what is the best way to do this? Should I insert an if in the beggining of every controller function that must verify this condition? Is there a cleaner solution for this?


I tried to create



package com.sports.beans;

import org.springframework.stereotype.Component;

@Component("mySecurityService")
public class MySecurityService {

public boolean hasPermission(String key) {
return false;
}
}


and added @PreAuthorize("@mySecurityService.hasPermission('special')") to the controller function but it didn't work.


Aucun commentaire:

Enregistrer un commentaire