spring-projects / spring-projects/spring-data-rest

Convenience shortcut for aggregate security annotations [DATAREST-1078]

Open
#1,443 0 comments 0 reactions 1 assignee View on GitHub

@odrotbohm is already working on this.

Since Dec 31, 2020.

in: repository type: enhancement
Dominant language
Java
Stars
958
Forks
568
PR merge metrics
No merged PRs in 30d

Description

Christopher Smith opened DATAREST-1078 and commented

This request might be more suitable for Commons.

I'm implementing a fairly common pattern using SDR, where a company-wide database should be viewable and searchable by anyone with USER permission, but only editable by someone with ADMIN permission. Since I want to take advantage of the convenience of PagingAndSortingRepository, I will need to redeclare lots of methods and apply repetitive security annotations. It would be very convenient to be able to apply blanket policies to all read or write methods on a repository interface:

@RepositorySecurity(
  read = { @PreAuthorize("hasRole('USER')") },
  write = { @PreAuthorize("hasRole('ADMIN')") }
)
public interface ListingRepository extends PagingAndSortingRepository<Listing, Long> {
}

Affects: 2.6.3 (Ingalls SR3)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.