spring-projects / spring-projects/spring-data-rest
Method level @PreAuthorize does not overwrite a type level one [DATAREST-1579]
@odrotbohm is already working on this.
Since Dec 31, 2020.
- Dominant language
- Java
- Stars
- 958
- Forks
- 568
- PR merge metrics
- No merged PRs in 30d
Description
yerzhant opened DATAREST-1579 and commented
According to docs method level security settings must overwrite repository level settings. But it fails when it comes to URI conversion:
Failed to convert from type [java.net.URI] to type [kz.toyville.back.catalog.domain.entity.Category] for value '/category/1'; nested exception is org.springframework.security.access.AccessDeniedException: Access is denied"},"message":"Failed to convert /category/1 into kz.toyville.back.catalog.domain.entity.Category!
How To Reproduce
Run the "List toys for a category" test in the sample (link is below).
Expected behavior
Test List toys for a category (in CatalogWebTest) must not fail.
Sample
https://github.com/yerzhant/spring-rest-data-security
Reference URL: https://github.com/yerzhant/spring-rest-data-security
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.