Extending filter options when accessing /entities/... [DATAREST-146]

Thomas Darimont opened DATAREST-146 and commented

Github Author: jhiemer
Github Last-Updated: 2013-02-20T21:33:26Z
This issue was automatically imported from github

Hi Jon,
me again, who comes up with a request. I talked to @olivergierke last saturday, and a feature that is really missing is the ability to filter based on the current user role. Oliver and me discussed various advantages and disadvantages using @PostAuthorize or @PreAuthorize. Both solutions have significant drawbacks. What we thought of was something like an extension of the query:

java

@Query("where entity.user = :user")
findAll(@Param("user") User user)

The difficulty here is definitely to set this findAll(User user..) as the default lookup, and or even worse, if the current role is the "application administrator", to switch it with a pure findAll() without any user filter.

Perhaps we could use this issue do discuss several scenarios and potential solutions to the problem described.

Reference URL: https://api.github.com/repos/SpringSource/spring-data-rest/issues/72