Field Security [DATAREST-1045]

benkuly opened DATAREST-1045 and commented

I think it should be possible to secure exported and imported fields in Spring Data Rest. Because Validator or EventHandler can't see if an user changed an field, it isn't possible to deny any change of it.

Example1: an user has an field "role", he easilly can change it to "ADMIN".

Example2: user A is not friend of user B. A should see "name" of B, but not the "email".

See reference URL for more information.

Reference URL: http://stackoverflow.com/questions/43157192/field-security-in-spring-data-rest

Issue Links:

• DATAREST-428 Field level security/visibility of exported resources
  ("duplicates")