spring-projects / spring-projects/spring-data-rest
Convenience shortcut for aggregate security annotations [DATAREST-1078]
@odrotbohm is already working on this.
Since Dec 31, 2020.
- Dominant language
- Java
- Stars
- 958
- Forks
- 568
- PR merge metrics
- No merged PRs in 30d
Description
Christopher Smith opened DATAREST-1078 and commented
This request might be more suitable for Commons.
I'm implementing a fairly common pattern using SDR, where a company-wide database should be viewable and searchable by anyone with USER permission, but only editable by someone with ADMIN permission. Since I want to take advantage of the convenience of PagingAndSortingRepository, I will need to redeclare lots of methods and apply repetitive security annotations. It would be very convenient to be able to apply blanket policies to all read or write methods on a repository interface:
@RepositorySecurity(
read = { @PreAuthorize("hasRole('USER')") },
write = { @PreAuthorize("hasRole('ADMIN')") }
)
public interface ListingRepository extends PagingAndSortingRepository<Listing, Long> {
}
Affects: 2.6.3 (Ingalls SR3)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.