I'm attempting to implement fine grain access control while still taking advantage of Spring data rest.
I'm working on securing a CrudRepository
so users can only modify or insert data that belongs to them. I'm making use of @PreAuthorize
/@PostAuthorize
and @PreFilter
/@PostFilter
to lock access down to the current principal.
So far my repository looks like this.
public interface MyRepository extends CrudRepository<MyObject, Integer> {
@PreAuthorize("#entity.userId == principal.id")
@Override
<S extends MyObject> S save(S entity);
@PreFilter("filterObject.userId === principal.id")
@Override
<S extends MyObject> Iterable<S> save(Iterable<S> entities);
@PostAuthorize("returnObject.userId == principal.id")
@Override
MyObject findOne(Integer integer);
@PostFilter("filterObject.userId == principal.id")
@Override
Iterable<MyObject> findAll();
}
While this is a bit tedious, it does seem to accomplish what I'm after. (If anyone knows a better way, feel free to let me know!)
Where I'm running into problems is with delete()
, count()
and exists()
@Override
long count();
@Override
void delete(Integer integer);
@Override
void delete(MyObject entity);
@Override
void deleteAll();
@Override
boolean exists(Integer integer);
These methods either take an Integer
ID parameter or none at all. It seems like I would have to first select the entity with the input ID and then perform the auth check.
Is this type of authorization possible within the repository?
Thanks
Aucun commentaire:
Enregistrer un commentaire