Support security constraints on projections [DATAREST-1108]

Christopher Smith opened DATAREST-1108 and commented

The projection facility is useful for serializing specific sets of fields. However, there are many cases where only certain sets should be available to particular users (anonymous, non-object-owners, etc.). DATAREST-428 provides one way to customize projection selection based on user attributes, but this approach may be applicable broadly enough to add officially:

Support the standard Spring Security annotations on the projection interface itself. When the projection is requested, evaluate the annotations (e.g., for projection=full, check that #principal.id == #object.owner.id) and apply the security policy:

@Projection(name = "full", types = AResource.class)
@PreAuthorize("#principal.id == #object.owner.id")
public interface AllFieldsProjection {
    ...
}

This would cover a significant portion of the common use cases in a manner that's reusable, easy to understand, and without repeated boilerplate

Affects: 2.5.11 (Hopper SR11)

1 votes, 2 watchers