vendredi 17 avril 2015

Repository access control in Spring Data Rest based off user princpal

I'm attempting to implement fine grain access control while still taking advantage of Spring data rest.


I'm working on securing a CrudRepository so users can only modify or insert data that belongs to them. I'm making use of @PreAuthorize/@PostAuthorize and @PreFilter/@PostFilter to lock access down to the current principal.


So far my repository looks like this.



public interface MyRepository extends CrudRepository<MyObject, Integer> {

@PreAuthorize("#entity.userId == principal.id")
@Override
<S extends MyObject> S save(S entity);

@PreFilter("filterObject.userId === principal.id")
@Override
<S extends MyObject> Iterable<S> save(Iterable<S> entities);

@PostAuthorize("returnObject.userId == principal.id")
@Override
MyObject findOne(Integer integer);

@PostFilter("filterObject.userId == principal.id")
@Override
Iterable<MyObject> findAll();

}


While this is a bit tedious, it does seem to accomplish what I'm after. (If anyone knows a better way, feel free to let me know!)


Where I'm running into problems is with delete(), count() and exists()



@Override
long count();

@Override
void delete(Integer integer);

@Override
void delete(MyObject entity);

@Override
void deleteAll();

@Override
boolean exists(Integer integer);


These methods either take an Integer ID parameter or none at all. It seems like I would have to first select the entity with the input ID and then perform the auth check.


Is this type of authorization possible within the repository?


Thanks


Aucun commentaire:

Enregistrer un commentaire